Edit tour

Windows Analysis Report
view_01-64.exe

Overview

General Information

Sample name:	view_01-64.exe
Analysis ID:	1431424
MD5:	72ac0fb34f691758105bbc4eb920ad8a
SHA1:	6e4f9dedfeed0d06aec464584ca510ce08cbb5f4
SHA256:	ff6cc44c832e3318bc9d673f8eb053666d38002698814c23c88df9a6d357fd66
Infos:

Detection

Score:	30
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is a service DLL but no service has been registered

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

view_01-64.exe (PID: 7532 cmdline: "C:\Users\user\Desktop\view_01-64.exe" MD5: 72AC0FB34F691758105BBC4EB920AD8A)

view_01-64.tmp (PID: 7548 cmdline: "C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp" /SL5="$7047C,14900298,56832,C:\Users\user\Desktop\view_01-64.exe" MD5: A2C4D52C66B4B399FACADB8CC8386745)

cmd.exe (PID: 7880 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateService.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7932 cmdline: sc stop "VDR Servers Service" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

ServiceMinit.exe (PID: 7948 cmdline: server\bin\ServiceMinit.exe /UnregServer MD5: 01C338C4765202CB8D712FD7CCDF9BD1)

ServiceMinit.exe (PID: 7964 cmdline: server\bin\ServiceMinit.exe /Service MD5: 01C338C4765202CB8D712FD7CCDF9BD1)

cmd.exe (PID: 7988 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateSeverEnvironment.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 8040 cmdline: wscript InstSeverEnvironment.vbs MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8068 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\Viewer\CreateLatestBackup.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xcopy.exe (PID: 8120 cmdline: xcopy /E /Y ..\_previous ..\_latest MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)

xcopy.exe (PID: 8136 cmdline: xcopy /E /Y /U ..\dlls ..\_latest\dlls MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)

xcopy.exe (PID: 8152 cmdline: xcopy /E /Y /U ..\server ..\_latest\server MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)

xcopy.exe (PID: 7192 cmdline: xcopy /E /Y /U ..\Viewer ..\_latest\Viewer MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: wscript InstSeverEnvironment.vbs, CommandLine: wscript InstSeverEnvironment.vbs, CommandLine|base64offset|contains: +, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateSeverEnvironment.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7988, ParentProcessName: cmd.exe, ProcessCommandLine: wscript InstSeverEnvironment.vbs, ProcessId: 8040, ProcessName: wscript.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-MFO1U.tmp	ReversingLabs: Detection: 25%
Source: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-MFO1U.tmp	Virustotal: Detection: 34%	Perma Link
Source: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-QTH30.tmp	ReversingLabs: Detection: 21%
Source: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-QTH30.tmp	Virustotal: Detection: 34%	Perma Link
Source: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\liveplayer.exe (copy)	ReversingLabs: Detection: 21%
Source: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\liveplayer.exe (copy)	Virustotal: Detection: 34%	Perma Link
Source: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.exe (copy)	ReversingLabs: Detection: 25%
Source: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.exe (copy)	Virustotal: Detection: 34%	Perma Link

Multi AV Scanner detection for submitted file

Source: view_01-64.exe

Virustotal: Detection: 12%

Perma Link

Source: view_01-64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VR-7000_is1

Jump to behavior

Source:	Binary string: e:\scada_win\obj\Release.clientrecorder\clientrecorder.pdb source: clientrecorder.exe.13.dr
Source:	Binary string: c:\furuno\scada_win\obj\Release.rcplayer\rcplayer.pdb source: view_01-64.tmp, 00000001.00000003.1944388445.00000000061E7000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: NB10nlO6L:\jcomm\src\win32\jcomm1.0\ext\comm\build\win32\win32com.pdb source: is-JN5IK.tmp.1.dr
Source:	Binary string: c:\furuno\scada_win\app\confirmdialog\debug\confirmDialog.pdb source: is-KLCB3.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.rcplayer\rcplayer.pdb source: rcplayer.exe.13.dr
Source:	Binary string: c:\furuno\scada_win\obj\Release.extclient\extclient.pdb source: view_01-64.tmp, 00000001.00000003.1944388445.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, is-8706V.tmp.1.dr
Source:	Binary string: L:\jcomm\src\win32\jcomm1.0\ext\comm\build\win32\win32com.pdb source: is-JN5IK.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.extclient\extclient.pdb source: xcopy.exe, 0000000F.00000003.1874316381.0000028490F2E000.00000004.00000020.00020000.00000000.sdmp, extclient.exe.13.dr
Source:	Binary string: c:\workspace\src\client\scada_win\obj\Release.combine\combine.pdb source: is-RRTAP.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.speedtest\speedtest.pdb source: is-CKFTJ.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.liveremoteconverter\liveremoteconverter.pdb source: is-596LT.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.VdrCheckFileTest\VdrCheckFileTest.pdb source: is-7UQKD.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.ServiceMinit\ServiceMinit.pdb source: ServiceMinit.exe, ServiceMinit.exe, 00000006.00000000.1852164506.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000007.00000000.1853570408.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000007.00000002.1855826199.0000000000430000.00000002.00000001.01000000.00000008.sdmp, is-0KHA3.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.ServiceMinit\ServiceMinit.pdb$ source: ServiceMinit.exe, 00000006.00000000.1852164506.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000007.00000000.1853570408.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000007.00000002.1855826199.0000000000430000.00000002.00000001.01000000.00000008.sdmp, is-0KHA3.tmp.1.dr

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00452A60 FindFirstFileA,GetLastError,	1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00474F88 FindFirstFileA,FindNextFileA,FindClose,	1_2_00474F88
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004980A4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_004980A4
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464158
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00462750 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462750
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463CDC
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_0040D61A __getdrive,FindFirstFileA,__fullpath,__fullpath,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	6_2_0040D61A
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00417C6D __getdrive,FindFirstFileA,__fullpath,__fullpath,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	6_2_00417C6D

Source: is-1445O.tmp.1.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: is-1445O.tmp.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: view_01-64.tmp, view_01-64.tmp, 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: view_01-64.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: view_01-64.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: view_01-64.exe, 00000000.00000003.1644115575.00000000020F8000.00000004.00001000.00020000.00000000.sdmp, view_01-64.exe, 00000000.00000003.1643980688.0000000002400000.00000004.00001000.00020000.00000000.sdmp, view_01-64.tmp, view_01-64.tmp, 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: view_01-64.exe, 00000000.00000003.1644115575.00000000020F8000.00000004.00001000.00020000.00000000.sdmp, view_01-64.exe, 00000000.00000003.1643980688.0000000002400000.00000004.00001000.00020000.00000000.sdmp, view_01-64.tmp, 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/psU

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00423B84 NtdllDefWindowProc_A,	1_2_00423B84
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004125D8 NtdllDefWindowProc_A,	1_2_004125D8
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00478AC0 NtdllDefWindowProc_A,	1_2_00478AC0
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0042F520 NtdllDefWindowProc_A,	1_2_0042F520
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00457594 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00457594

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Code function: 1_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E934

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: 6_2_00406140 InitializeCriticalSection,EnterCriticalSection,OpenSCManagerA,MessageBoxA,OpenServiceA,CloseServiceHandle,MessageBoxA,ControlService,DeleteService,CloseServiceHandle,CloseServiceHandle,MessageBoxA,

6_2_00406140

Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_004555E4

Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_0040840C	0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004706A8	1_2_004706A8
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004809F7	1_2_004809F7
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004673A4	1_2_004673A4
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0043035C	1_2_0043035C
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004444C8	1_2_004444C8
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004345C4	1_2_004345C4
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00444A70	1_2_00444A70
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00486BD0	1_2_00486BD0
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00430EE8	1_2_00430EE8
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0045F0C4	1_2_0045F0C4
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00445168	1_2_00445168
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0045B174	1_2_0045B174
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004352C8	1_2_004352C8
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00469404	1_2_00469404
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00445574	1_2_00445574
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004519BC	1_2_004519BC
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00487B30	1_2_00487B30
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0043DD50	1_2_0043DD50
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0048DF54	1_2_0048DF54
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00418ED5	6_2_00418ED5
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_004123D5	6_2_004123D5
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_0042A578	6_2_0042A578
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00425581	6_2_00425581
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00432603	6_2_00432603
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00411722	6_2_00411722
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_004127F5	6_2_004127F5
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00414846	6_2_00414846
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00427A55	6_2_00427A55
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00427B6B	6_2_00427B6B
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00411BF5	6_2_00411BF5
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_0041DE5B	6_2_0041DE5B
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00412F70	6_2_00412F70
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00411FC9	6_2_00411FC9

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: String function: 00401220 appears 81 times
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: String function: 00413950 appears 84 times
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: String function: 004188A9 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 00408C0C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 00406AC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 0040595C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 00457F1C appears 73 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 00445DD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 00457D10 appears 96 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 004344DC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 004078F4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 00403494 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 00403684 appears 225 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 00453344 appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: String function: 004460A4 appears 59 times

Source: view_01-64.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: view_01-64.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: view_01-64.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-5113G.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-5113G.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-5113G.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: view_01-64.exe, 00000000.00000003.1644115575.00000000020F8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs view_01-64.exe
Source: view_01-64.exe, 00000000.00000003.1643980688.0000000002400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs view_01-64.exe

Source: view_01-64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: sus30.winEXE@28/1012@0/0

Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_004555E4

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Code function: 1_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,

1_2_00455E0C

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: InitializeCriticalSection,EnterCriticalSection,OpenSCManagerA,MessageBoxA,GetModuleFileNameA,CreateServiceA,CloseServiceHandle,MessageBoxA,CloseServiceHandle,CloseServiceHandle,

6_2_00405FE0

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: 6_2_004051C0 CoCreateInstance,StringFromGUID2,lstrlenW,RegQueryInfoKeyA,RegQueryInfoKeyA,

6_2_004051C0

Source: C:\Users\user\Desktop\view_01-64.exe

Code function: 0_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409C34

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: 6_2_00406280 InitializeCriticalSection,EnterCriticalSection,StartServiceCtrlDispatcherA,InitializeCriticalSection,EnterCriticalSection,

6_2_00406280

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: 6_2_00406280 InitializeCriticalSection,EnterCriticalSection,StartServiceCtrlDispatcherA,InitializeCriticalSection,EnterCriticalSection,

6_2_00406280

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

File created: C:\Program Files (x86)\FURUNO

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03

Source: C:\Users\user\Desktop\view_01-64.exe

File created: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateService.bat""

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\wscript.exe wscript InstSeverEnvironment.vbs

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Command line argument: UnregServer	6_2_00403970
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Command line argument: RegServer	6_2_00403970
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Command line argument: Service	6_2_00403970
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Command line argument: AppID	6_2_00403970
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Command line argument: LocalService	6_2_00403970

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\view_01-64.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: view_01-64.exe

Virustotal: Detection: 12%

Source: view_01-64.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: view_01-64.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\view_01-64.exe

File read: C:\Users\user\Desktop\view_01-64.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\view_01-64.exe "C:\Users\user\Desktop\view_01-64.exe"
Source: C:\Users\user\Desktop\view_01-64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp "C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp" /SL5="$7047C,14900298,56832,C:\Users\user\Desktop\view_01-64.exe"
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateService.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "VDR Servers Service"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe server\bin\ServiceMinit.exe /UnregServer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe server\bin\ServiceMinit.exe /Service
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateSeverEnvironment.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe wscript InstSeverEnvironment.vbs
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\Viewer\CreateLatestBackup.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y ..\_previous ..\_latest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y /U ..\dlls ..\_latest\dlls
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y /U ..\server ..\_latest\server
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y /U ..\Viewer ..\_latest\Viewer
Source: C:\Users\user\Desktop\view_01-64.exe	Process created: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp "C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp" /SL5="$7047C,14900298,56832,C:\Users\user\Desktop\view_01-64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateService.bat""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateSeverEnvironment.bat""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\Viewer\CreateLatestBackup.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "VDR Servers Service"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe server\bin\ServiceMinit.exe /UnregServer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe server\bin\ServiceMinit.exe /Service	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe wscript InstSeverEnvironment.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y ..\_previous ..\_latest	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y /U ..\dlls ..\_latest\dlls	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y /U ..\server ..\_latest\server	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y /U ..\Viewer ..\_latest\Viewer	Jump to behavior

Source: C:\Users\user\Desktop\view_01-64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\view_01-64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\xcopy.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: ifsutil.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\xcopy.exe	Section loaded: ntmarta.dll

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\xcopy.exe

File written: C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\onlndb\Config.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VR-7000_is1

Jump to behavior

Source: view_01-64.exe

Static file information: File size 15161609 > 1048576

Source:	Binary string: e:\scada_win\obj\Release.clientrecorder\clientrecorder.pdb source: clientrecorder.exe.13.dr
Source:	Binary string: c:\furuno\scada_win\obj\Release.rcplayer\rcplayer.pdb source: view_01-64.tmp, 00000001.00000003.1944388445.00000000061E7000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: NB10nlO6L:\jcomm\src\win32\jcomm1.0\ext\comm\build\win32\win32com.pdb source: is-JN5IK.tmp.1.dr
Source:	Binary string: c:\furuno\scada_win\app\confirmdialog\debug\confirmDialog.pdb source: is-KLCB3.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.rcplayer\rcplayer.pdb source: rcplayer.exe.13.dr
Source:	Binary string: c:\furuno\scada_win\obj\Release.extclient\extclient.pdb source: view_01-64.tmp, 00000001.00000003.1944388445.0000000005D10000.00000004.00001000.00020000.00000000.sdmp, is-8706V.tmp.1.dr
Source:	Binary string: L:\jcomm\src\win32\jcomm1.0\ext\comm\build\win32\win32com.pdb source: is-JN5IK.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.extclient\extclient.pdb source: xcopy.exe, 0000000F.00000003.1874316381.0000028490F2E000.00000004.00000020.00020000.00000000.sdmp, extclient.exe.13.dr
Source:	Binary string: c:\workspace\src\client\scada_win\obj\Release.combine\combine.pdb source: is-RRTAP.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.speedtest\speedtest.pdb source: is-CKFTJ.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.liveremoteconverter\liveremoteconverter.pdb source: is-596LT.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.VdrCheckFileTest\VdrCheckFileTest.pdb source: is-7UQKD.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.ServiceMinit\ServiceMinit.pdb source: ServiceMinit.exe, ServiceMinit.exe, 00000006.00000000.1852164506.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000007.00000000.1853570408.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000007.00000002.1855826199.0000000000430000.00000002.00000001.01000000.00000008.sdmp, is-0KHA3.tmp.1.dr
Source:	Binary string: e:\scada_win\obj\Release.ServiceMinit\ServiceMinit.pdb$ source: ServiceMinit.exe, 00000006.00000000.1852164506.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000007.00000000.1853570408.0000000000430000.00000002.00000001.01000000.00000008.sdmp, ServiceMinit.exe, 00000007.00000002.1855826199.0000000000430000.00000002.00000001.01000000.00000008.sdmp, is-0KHA3.tmp.1.dr

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Code function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_004502C0

Source: is-8V50C.tmp.1.dr	Static PE information: section name: .textbss
Source: is-PPA9R.tmp.1.dr	Static PE information: section name: .textbss
Source: is-596LT.tmp.1.dr	Static PE information: section name: .textbss
Source: is-AP3B5.tmp.1.dr	Static PE information: section name: .textbss
Source: is-CKFTJ.tmp.1.dr	Static PE information: section name: .textbss

Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_004065C8 push 00406605h; ret	0_2_004065FD
Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_00408104 push ecx; mov dword ptr [esp], eax	0_2_00408109
Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\view_01-64.exe	Code function: 0_2_00408F38 push 00408F6Bh; ret	0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0040994C push 00409989h; ret	1_2_00409981
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00483F88 push 00484096h; ret	1_2_0048408E
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004062B4 push ecx; mov dword ptr [esp], eax	1_2_004062B5
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004104E0 push ecx; mov dword ptr [esp], edx	1_2_004104E5
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00412928 push 0041298Bh; ret	1_2_00412983
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00494CAC push ecx; mov dword ptr [esp], ecx	1_2_00494CB1
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0040CE38 push ecx; mov dword ptr [esp], edx	1_2_0040CE3A
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004592D0 push 00459314h; ret	1_2_0045930C
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0040F398 push ecx; mov dword ptr [esp], edx	1_2_0040F39A
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00443440 push ecx; mov dword ptr [esp], ecx	1_2_00443444
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00485678 push ecx; mov dword ptr [esp], ecx	1_2_0048567D
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004517F8 push 0045182Bh; ret	1_2_00451823
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004519BC push ecx; mov dword ptr [esp], eax	1_2_004519C1
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00477B08 push ecx; mov dword ptr [esp], edx	1_2_00477B09
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00419C28 push ecx; mov dword ptr [esp], ecx	1_2_00419C2D
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0045FD1C push ecx; mov dword ptr [esp], ecx	1_2_0045FD20
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00499D30 pushad ; retf	1_2_00499D3F

Source: is-6L83T.tmp.1.dr

Static PE information: section name: .text entropy: 6.812097707799091

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-PPA9R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-84QUO.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRTransRtp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-5HDDL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\TVRSocket.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-PCP74.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\confirmDialog.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\vsend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-OUSS8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-6L83T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-2397E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\liveremoteconverter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-8V50C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\liveplayer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-QTH30.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRAVCtrlJNI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-895CV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-SKTFO.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\rserv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\is-5113G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Users\user\AppData\Local\Temp\is-S4J2T.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libvorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\tar32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-MFO1U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libogg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\speedtest.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\tarcmd.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\VDRTransRtp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\extclient.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\rcplayer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-L1595.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-N0LRV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libvorbisfile.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-OR35G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\combine.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\extclient.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-84GGN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\rcplayer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\clientrecorder.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libexpat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-M5B6A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\rserv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\UTSecureLayer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\extclient.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRAVCtrlJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-96783.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\rcplayer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-SDE95.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-KVTDD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-E2844.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\combine.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\speedtest.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-8706V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-CJB6D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\confirmDialog.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-EGJ3O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-CKFTJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\TVRThread.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\msend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libSecurityJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-KLCB3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRTransRtp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-U7GO5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\win32com.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-VDN2J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-5ROI4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\remoteclient.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-0KHA3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Users\user\AppData\Local\Temp\is-S4J2T.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-9JE74.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-RRTAP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\VDRAVCtrlJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\NmeaDecodeJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-FURKP.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\view_01-64.exe	File created: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-596LT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-AP3B5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-JN5IK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-3H48C.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	File created: C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\clientrecorder.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-PVGSK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\AisLibraryJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\VdrCheckFileTest.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-V337O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-7UQKD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\rserv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\dlls\TVRTrace.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\clientrecorder.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000\Live Player V5 (01.64).lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000\VR-7000 VDR Maintenance Viewer (01.64).lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000\VR-7000 Uninstall.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000 Previous Version	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000 Previous Version\Live Player V5 OLD (01.10).lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000 Previous Version\VR-7000 VDR Maintenance Viewer OLD (01.10).lnk	Jump to behavior

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: 6_2_00406280 InitializeCriticalSection,EnterCriticalSection,StartServiceCtrlDispatcherA,InitializeCriticalSection,EnterCriticalSection,

6_2_00406280

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop "VDR Servers Service"

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_0042285C
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004241DC IsIconic,SetActiveWindow,SetFocus,	1_2_004241DC
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00424194 IsIconic,SetActiveWindow,	1_2_00424194
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418384
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00417598 IsIconic,GetCapture,	1_2_00417598
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_0048393C IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_0048393C
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00417CCE IsIconic,SetWindowPos,	1_2_00417CCE
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417CD0

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Code function: 1_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F118

Source: C:\Users\user\Desktop\view_01-64.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-PPA9R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-84QUO.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRTransRtp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\TVRSocket.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-5HDDL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-PCP74.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\confirmDialog.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\vsend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-OUSS8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-2397E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-6L83T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\liveremoteconverter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-8V50C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\liveplayer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-QTH30.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRAVCtrlJNI.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-895CV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-SKTFO.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\rserv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\is-5113G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-S4J2T.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libvorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\tar32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-MFO1U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libogg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\speedtest.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\tarcmd.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\VDRTransRtp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\extclient.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\rcplayer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-L1595.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-N0LRV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libvorbisfile.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\extclient.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\combine.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-OR35G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-84GGN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\rcplayer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\clientrecorder.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libexpat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-M5B6A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\rserv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\UTSecureLayer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\extclient.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRAVCtrlJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\rcplayer.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-96783.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-SDE95.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-KVTDD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-E2844.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\combine.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\speedtest.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-8706V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-CJB6D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\confirmDialog.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-EGJ3O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-CKFTJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\TVRThread.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\libSecurityJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\msend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-KLCB3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRTransRtp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\win32com.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-U7GO5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-VDN2J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-5ROI4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\remoteclient.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-S4J2T.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-9JE74.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-RRTAP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\VDRAVCtrlJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\NmeaDecodeJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-FURKP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-596LT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-AP3B5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-JN5IK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-3H48C.tmp	Jump to dropped file
Source: C:\Windows\System32\xcopy.exe	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\clientrecorder.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-PVGSK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\AisLibraryJNI.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\VdrCheckFileTest.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-7UQKD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-V337O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\rserv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\clientrecorder.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\FURUNO\VR-7000\dlls\TVRTrace.dll (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\view_01-64.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5454

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_6-23924

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00452A60 FindFirstFileA,GetLastError,	1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00474F88 FindFirstFileA,FindNextFileA,FindClose,	1_2_00474F88
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_004980A4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_004980A4
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464158
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00462750 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462750
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: 1_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463CDC
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_0040D61A __getdrive,FindFirstFileA,__fullpath,__fullpath,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	6_2_0040D61A
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00417C6D __getdrive,FindFirstFileA,__fullpath,__fullpath,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime32_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	6_2_00417C6D

Source: C:\Users\user\Desktop\view_01-64.exe

Code function: 0_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409B78

Source: view_01-64.tmp, 00000001.00000003.1946055291.000000000065C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Y
Source: view_01-64.tmp, 00000001.00000003.1946055291.000000000065C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

API call chain: ExitProcess graph end node

graph_6-23926

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: 6_2_0040D11E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

6_2_0040D11E

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Code function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_004502C0

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: 6_2_00413763 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,

6_2_00413763

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_0040D11E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0040D11E
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_0041FA65 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0041FA65
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_0041EB5D SetUnhandledExceptionFilter,__encode_pointer,	6_2_0041EB5D
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_0041EB7F __decode_pointer,SetUnhandledExceptionFilter,	6_2_0041EB7F
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: 6_2_00413E36 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00413E36

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Code function: 1_2_00478504 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_00478504

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "VDR Servers Service"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe server\bin\ServiceMinit.exe /UnregServer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe server\bin\ServiceMinit.exe /Service	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wscript.exe wscript InstSeverEnvironment.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y ..\_previous ..\_latest	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y /U ..\dlls ..\_latest\dlls	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y /U ..\server ..\_latest\server	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /E /Y /U ..\Viewer ..\_latest\Viewer	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Code function: 1_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E09C

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: 6_2_00421FCF cpuid

6_2_00421FCF

Source: C:\Users\user\Desktop\view_01-64.exe	Code function: GetLocaleInfoA,	0_2_0040520C
Source: C:\Users\user\Desktop\view_01-64.exe	Code function: GetLocaleInfoA,	0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: GetLocaleInfoA,	1_2_00408568
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Code function: GetLocaleInfoA,	1_2_004085B4
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	6_2_00422145
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: GetLocaleInfoA,	6_2_0042616A
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_0042410A
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	6_2_0040C1E4
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: _LcidFromHexString,GetLocaleInfoA,	6_2_0042624C
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	6_2_004262E2
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: _LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	6_2_00426354
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_0042436C
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	6_2_00426524
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: _strlen,EnumSystemLocalesA,	6_2_004265E6
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: GetLocaleInfoA,	6_2_0042D659
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_00426674
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_0042660F
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	6_2_004266B0
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoA,	6_2_0041A83C
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	6_2_004249FB
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	6_2_00424C7F
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,GetLocaleInfoA,GetLocaleInfoA,_malloc,GetLocaleInfoA,MultiByteToWideChar,__freea,	6_2_00423E57
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	6_2_00423FCD
Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoW_stat,	6_2_00423F92

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Code function: 1_2_004585C8 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_004585C8

Source: C:\Users\user\Desktop\view_01-64.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Code function: 1_2_0045559C GetUserNameA,

1_2_0045559C

Source: C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe

Code function: 6_2_0041715D __lock,__invoke_watson,__invoke_watson,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

6_2_0041715D

Source: C:\Users\user\Desktop\view_01-64.exe

Code function: 0_2_00405CF4 GetVersionExA,

0_2_00405CF4

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	3 Native API	12 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	13 Service Execution	16 Windows Service	1 Access Token Manipulation	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	16 Windows Service	1 DLL Side-Loading	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	2 Masquerading	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
view_01-64.exe	12%	ReversingLabs
view_01-64.exe	12%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\combine.exe (copy)	2%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\combine.exe (copy)	3%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-84QUO.tmp	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-84QUO.tmp	3%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-MFO1U.tmp	26%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-MFO1U.tmp	34%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-PVGSK.tmp	2%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-PVGSK.tmp	3%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-QTH30.tmp	22%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-QTH30.tmp	34%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-U7GO5.tmp	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-U7GO5.tmp	3%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\liveplayer.exe (copy)	22%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\liveplayer.exe (copy)	34%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.exe (copy)	26%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.exe (copy)	34%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\msend.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\msend.exe (copy)	3%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\speedtest.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\Viewer\speedtest.exe (copy)	3%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRAVCtrlJNI.dll	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRAVCtrlJNI.dll	0%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRTransRtp.dll	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRTransRtp.dll	0%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\clientrecorder.exe	2%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\clientrecorder.exe	4%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\extclient.exe	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\extclient.exe	1%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\rcplayer.exe	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\rserv.exe	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\rserv.exe	5%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRAVCtrlJNI.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRAVCtrlJNI.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRTransRtp.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRTransRtp.dll (copy)	0%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-M5B6A.tmp	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-M5B6A.tmp	0%	Virustotal	Browse
C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-N0LRV.tmp	0%	ReversingLabs
C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-N0LRV.tmp	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://www.remobjects.com/psU	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
http://www.innosetup.com/	2%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	view_01-64.tmp, view_01-64.tmp, 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	view_01-64.exe	false		high
http://www.apache.org/licenses/LICENSE-2.0	is-1445O.tmp.1.dr	false		high
http://www.remobjects.com/psU	view_01-64.exe, 00000000.00000003.1644115575.00000000020F8000.00000004.00001000.00020000.00000000.sdmp, view_01-64.exe, 00000000.00000003.1643980688.0000000002400000.00000004.00001000.00020000.00000000.sdmp, view_01-64.tmp, 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
http://www.remobjects.com/ps	view_01-64.exe, 00000000.00000003.1644115575.00000000020F8000.00000004.00001000.00020000.00000000.sdmp, view_01-64.exe, 00000000.00000003.1643980688.0000000002400000.00000004.00001000.00020000.00000000.sdmp, view_01-64.tmp, view_01-64.tmp, 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/	is-1445O.tmp.1.dr	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	view_01-64.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431424
Start date and time:	2024-04-25 04:43:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	view_01-64.exe
Detection:	SUS
Classification:	sus30.winEXE@28/1012@0/0
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 96% Number of executed functions: 190 Number of non-executed functions: 210
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ServiceMinit.exe, PID 7964 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.540363884302869
Encrypted:	false
SSDEEP:	24:Q1NLI/TeZu9YM7/M2v2OAUWwGJtob132zmFdIq8qVsAFdIkjkjAloNzmWNvn:GNc/8u9YF2v2OAmGJab1mzmEP3AEyIAY
MD5:	AF54A8883211A3C956E9F41955125D54
SHA1:	DAACB0AFB3BA703B2B17AC93D5775206BD7A3AFC
SHA-256:	494AF8EE4EDB809B7E04CF42A6FC6E9BBD3781798A07BBA4CA2431A5A339835B
SHA-512:	09FAA6E6A86E29A7488E10B993DB434DCB62E331D7B0053169E9F3208C30429418EA9E664FF0AF9E7AAEF4C8DCB79BE39C28BF9846F05A902D01D55531156268
Malicious:	false
Reputation:	low
Preview:	@ECHO OFF..SETLOCAL ENABLEEXTENSIONS....REM ------------------------------------------------------------..REM Main Routine..REM ------------------------------------------------------------..SET LOGFILE=nul..REM SET LOGFILE=%TEMP%\VDRServiceRegist.log..ECHO ------------------------------------------------------------ >> %LOGFILE%..ECHO %DATE% %TIME% >> %LOGFILE%....REM see ./scada_win/app/ServiceMinit/ServiceMinit.rc..SET SERVICE_NAME="VDR Servers Service"....REM Stop Service..sc stop %SERVICE_NAME%..ECHO sc stop %SERVICE_NAME% RESULT:%ERRORLEVEL% >> %LOGFILE%....REM Regist Service..SET SERVICE_MINIT=server\bin\ServiceMinit.exe..CALL :REGIST_SERVICE....ECHO DONE. >> %LOGFILE%..EXIT....REM ------------------------------------------------------------..REM Regist Service..REM ------------------------------------------------------------..:REGIST_SERVICE..IF EXIST %SERVICE_MINIT% (.. ECHO Regist Service : %SERVICE_MINIT% >> %LOGFILE%.. %SERVICE_MINIT% /UnregServer.. ECHO %SERVICE_MINIT% /

C:\Program Files (x86)\FURUNO\VR-7000\CreateSeverEnvironment.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.944548827786958
Encrypted:	false
SSDEEP:	3:cYWLWnTAs2en2:3WYAXK2
MD5:	1E9D5E4E473BB1E85C8E596F8B3026B5
SHA1:	C3E2328311AA8D6E7BB4D5ED0238C803D85AC905
SHA-256:	BF23E7816400F1C208E5A4D397DA03ED0BE087AEBED6845F07BB79E0838D9AEA
SHA-512:	B38BBF8555AC4B86BECA1B35505E38899C561305F198BC3B932AC9C545B9FFCE282DC0C4A52F7857EE9197B4E8AF5F53F49A35CC4BD712185F9FB9E6A72A62D5
Malicious:	false
Preview:	wscript InstSeverEnvironment.vbs

C:\Program Files (x86)\FURUNO\VR-7000\DeleteService.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.106505774273587
Encrypted:	false
SSDEEP:	3:6090ERMCAVAMerTA4v:DXYybgi
MD5:	2EA1C7B1F55930C9AEFC37D288AE89A5
SHA1:	ADFC44AE6811D426DD70BC986ADC1FA4635CBF06
SHA-256:	BD855484AE6249F651E082BDC0C83D732F988818C2596C2655FA1AE9108B0B00
SHA-512:	DFD584E2FEC5831F4C110FE309FDBE7ECDC34620A8E5F004D806B08ABDA16DD9F9DAB5F977C7DD661C194C4C19B38A4DE44627ACA199768752D4D286A6C52863
Malicious:	false
Preview:	sc stop "Grass Servers Service"..server\bin\ServiceMinit.exe /UnregServer..

C:\Program Files (x86)\FURUNO\VR-7000\DeleteSeverEnvironment.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	3.9069050327968804
Encrypted:	false
SSDEEP:	3:cYKLD2ns2en2:3Kn2nXK2
MD5:	60205CC6480608E98E14D4BCECE0C3C0
SHA1:	EABC789A03D9CCE98CB750A760583023F0063FFC
SHA-256:	C7E629CB94B54623B592C64F3B6029B9D21BF24B3188FB69E2C05772541F059A
SHA-512:	BA11BC7B040C5B631B39FF6F33EDA820D66151173749385811175F7B22E2DEBCE99CB9F95EF680FE23BDA478ACF5765984E20CB58F3144E88F0CB46E58567428
Malicious:	false
Preview:	wscript UninstSeverEnvironment.vbs

C:\Program Files (x86)\FURUNO\VR-7000\InstSeverEnvironment.vbs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	5.299118839599219
Encrypted:	false
SSDEEP:	24:IN8KW5iQM7lI5yDiseh2PD/eoSVd+sHGLuGub3MJ:y8ITRMyDPD/O8s+X1
MD5:	5618CF19864999A6D4566D60F8525B40
SHA1:	A97188305138C0518E2E43E1F47A0158CE101FC8
SHA-256:	1EB7B63FB3BE1C9E138B94F27D5272434F880DD588789B24336D46D3B631D323
SHA-512:	25A56F01A473B56E163FF702021274057245885A7CDBB7FD0547E41A17DB217EDC9452C7D4D486FD4F8A979D5BED8B92BF3F7090071D8AC4868CCFA40DD5460B
Malicious:	false
Preview:	Option Explicit..Dim WShell..Dim SFileSystem..Dim WEnvironment..Dim Members..Dim i..Dim bFind..Dim SystemRootFolder..Dim CurrentDirectory..Dim SFolderObject..Dim SFolderCollection....Set WShell = CreateObject("WScript.Shell")..Set SFileSystem= CreateObject("Scripting.FileSystemObject")..Set WEnvironment = WShell.Environment("System")....'''''''''''''''''''''''''''''''''''''''''''''''''..' ...W.X.g........s.t.H..._..........SystemRootFolder = "%SERVER_DLLS%"....Members = Split (WEnvironment.Item("PATH"), ";")..bFind = false..For i = LBound(Members) To UBound(Members).. If StrComp (Members(i), SystemRootFolder ) = 0 Then..'.WScript.Echo "...."...bFind = true.. End If..Next....If bFind = false Then.. WEnvironment.Item("PATH") = WEnvironment.Item("PATH") & ";" & SystemRootFolder ..' WScript.Echo "..............................."..End If....''''''''''''''''''''''''''''''''''''''''''''''''''..'' .J.....g.f.B...N.g.....X......'CurrentDirectory = WShell.CurrentDirecto

C:\Program Files (x86)\FURUNO\VR-7000\ServiceMinit.log

Download File

Process:	C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe
File Type:	ASCII text, with very long lines (311), with CRLF line terminators
Category:	modified
Size (bytes):	2160
Entropy (8bit):	5.404521438517241
Encrypted:	false
SSDEEP:	48:pqv1Is1Q9QFDP1Bcr1z+1m9s+A6Ls+hVXs+ZsnqvnIsnQ9QFDPGBcrGz+Gm9sGuS:aTGg+VzkMa88VWVp
MD5:	4D79D71509E098CF6E7975083364784A
SHA1:	D8634F251D8096D5FF9497CC0B95886178E0EB8A
SHA-256:	6165E08568990AE3137F367A436B124D3AEA9363BFEC461B1ADE9885D741310F
SHA-512:	698D90151AB23D1AD4BA370CD54CF4A355D9829E1B16ECD5096D74524DA4A7C6472FC18AE10C29E4B1477057C750EB5130BC4F64CD146FD1D8CCB4531DC44DB6
Malicious:	false
Preview:	2024/04/25 02:44:48.121 [7952:ServiceMinit.cpp:0189] ============================================..2024/04/25 02:44:48.137 [7952:ServiceMinit.cpp:0190] CServiceModule::Init()..2024/04/25 02:44:48.137 [7952:ServiceMinit.cpp:0197] CServiceModule::PATH=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;..2024/04/25 02:44:48.137 [7952:ServiceMinit.cpp:0201] CServiceModule::HG_TOP_DIR=NULL..2024/04/25 02:44:48.137 [7952:ServiceMinit.cpp:0207] CServiceModule::SERVER_DLLS=NULL..2024/04/25 02:44:48.137 [7952:ServiceMinit.cpp:0565] CServiceModule::_tWinMain()..2024/04/25 02:44:48.152 [7952:ServiceMinit.cpp:0172] CServiceModule::UnregisterServer()..2024/04/25 02:44:48.152 [7952:ServiceMinit.cpp:0302] CServiceModule::Uninstall()..2024/04/25 02:44:48.152 [7952:ServiceMinit.cpp:0245] CServiceModule::IsInstalled()..2

C:\Program Files (x86)\FURUNO\VR-7000\UninstSeverEnvironment.vbs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1104
Entropy (8bit):	5.469738261088247
Encrypted:	false
SSDEEP:	24:IN8KNg5iQM7lISflvWtsehD5PD/uIyGLi1Y:y8STRDju/RXf
MD5:	EC4723BDFC1B0F8A04C6C483397466C6
SHA1:	5437FF0C03378D6E9BE5B9BA341A60208895B09F
SHA-256:	7402167192B842D30273CFE711E483F4974A92EC8D91E78AAA63269A343FC693
SHA-512:	60ED6560FAC57D76615A96F17FD617B499082213EF5D47377FBFC202404A82DD4498B8663DD63B46B661AA2218B00EC0E23F058587B2167FA4E452D01E95FCAA
Malicious:	false
Preview:	Option Explicit..Dim WShell..Dim SFileSystem..Dim WEnvironment..Dim Members..Dim i..Dim bFind..Dim SystemRootFolder..Dim UnInstallPath....Set WShell = CreateObject("WScript.Shell")..Set SFileSystem= CreateObject("Scripting.FileSystemObject")..Set WEnvironment = WShell.Environment("System")....'''''''''''''''''''''''''''''''''''''''''''''''''..' ...W.X.g......V.X.e.....[.g.t.H..._.........SystemRootFolder = WShell.RegRead("HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\SERVER_DLLS")......Members = Split (WEnvironment.Item("PATH"), ";")..bFind = false..UnInstallPath = vbNull..For i = LBound(Members) To UBound(Members)..'.WScript.Echo Members(i).. If StrComp (Members(i), SystemRootFolder ) = 0 Then..'.WScript.Echo "...."...bFind = true.. Else...If UnInstallPath = vbNull Then... UnInstallPath = Members(i)...Else... UnInstallPath = UnInstallPath & ";" & Members(i)...End If.. End If ..Next....If bFind = true Then..' WScript.Echo "...............

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\CreateLatestBackup.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	528
Entropy (8bit):	4.64282523445514
Encrypted:	false
SSDEEP:	6:/kHu7uNhRzj/s3FWnbnLNS6GFNAFS6W5x4fLVUaxJpeOzUKzq56KfsL/:/osuNhsW1dm95xUx9zBCfsL/
MD5:	5D2853DD89B04C09F6AFC0E0307FF7D4
SHA1:	414E14F1829A0F894E16FF25BF93432F32C33819
SHA-256:	A42744B020EFBB0D3DA88773434EE28920AC76A2D5946D8A76EF3BCA0B55A008
SHA-512:	0D6F905531BD425BA937F077EBB6AD340878CE1D542819799CB9AD601608B0BCF63BA3F0A582F825B43637B0FAA8EF57069270DB1BFFD52562AAE53644336999
Malicious:	false
Preview:	@ECHO OFF..SETLOCAL ENABLEEXTENSIONS....REM ------------------------------------------------------------..REM create latest backup..REM ------------------------------------------------------------..rmdir /S /Q ..\_latest..mkdir ..\_latest....REM copy previous to latest (make a state with files)..xcopy /E /Y ..\_previous ..\_latest....REM copy current to latest (only existing files)..xcopy /E /Y /U ..\dlls ..\_latest\dlls..xcopy /E /Y /U ..\server ..\_latest\server..xcopy /E /Y /U ..\Viewer ..\_latest\Viewer....exit..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\DeleteLatestBackup.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.3099117792814483
Encrypted:	false
SSDEEP:	3:/qQK2gupgw9xuvn1afugAG/s3tbadbNnLAdN:/kHu7uN5gj/s3FWnLAdN
MD5:	E7BF3257C2B7ED8755A28FA49224AC46
SHA1:	50BB3B8C7A5F2E12203675C8CE9431D5F88AB053
SHA-256:	9CA952C86AC13AE709F56191B29978A91A88A78FD98CE62F7BB0AA747A9D1BB6
SHA-512:	C682D05786C0C5FD9CCAC38D6E7E6036F8956C56D3D6940C6E80AB9D11FBE0D301BE2B68F7F9C66200603432D095568FE6692557AC98AD449D811C47601EDE1B
Malicious:	false
Preview:	@ECHO OFF..SETLOCAL ENABLEEXTENSIONS....REM ------------------------------------------------------------..REM delete latest backup..REM ------------------------------------------------------------..rmdir /S /Q ..\_latest....exit..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOfFatalError_LPV5.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.317983857336911
Encrypted:	false
SSDEEP:	6:w5EMJNxMGOyXFrW5WZMcEWcycFIvA1GqVJMwZVMpTsnkJIJ+1S2Vcl:w5EMXxXOyVrW5WZMcE1y0IcqTskG4Sfl
MD5:	B18579A6A1D73835A638971F351140B4
SHA1:	A84E29B48083B075FC6BC2B9E1F9700E648BE84B
SHA-256:	4DF3F8E341004A4A4B06DC2C1189ADF2969AF231DD4DB667E2235C83A8968E38
SHA-512:	9CD8D28DECAF505826B074FDF5EF41172389DE0C93A8974714DA562CAED9AB3506A2643B9C6769C0FD6C698B1786C87347CB6C7D725CBBB9B0405756A653C525
Malicious:	false
Preview:	It failed in allocating a memory necessary for the running...Please allocate an empty memory by the method such as quit other applications..or increasing a physical memory, and restart Live Player V5.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOfFatalError_VMV.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	4.305809813655651
Encrypted:	false
SSDEEP:	6:w5EMJNxMGOyXFrW5WZMcEWcycFIvA1GqVJMwTQTsnkJIJ+1Sq+s:w5EMXxXOyVrW5WZMcE1y0I3TskG4Sq
MD5:	446D5EA4B21086BCB46122F2BA5C1854
SHA1:	326D0FB4592676825418DFCAEBD531D72A99E6EC
SHA-256:	38BF8519390E5F6D4832726B02BD8E58427AFBFE2D625AEB42EECCECEE534B2A
SHA-512:	8AF339E820CEC3A1CF88DC6DFA2ED4A23C8666A0C5B425DE6641BE2B0BE76027F25495774E0EC2ABDFED586DC65B08B7ED2691F25DD1FA0A8592178E19F9FD13
Malicious:	false
Preview:	It failed in allocating a memory necessary for the running...Please allocate an empty memory by the method such as quit other applications ..or increasing a physical memory, and restart VDR Maintenance Viewer.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOfInvalidJREVersion_LPV5.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.460399365244328
Encrypted:	false
SSDEEP:	3:SXKVKwQzgKGWuKCFQZdlIXV5GQ9rAXVgKuJCVLOQFJEmKxUL4:S0+zIWXHblkHSXcCVxP4
MD5:	BE816084311BB68552900A9342B6CF6B
SHA1:	209167C831134C9FB593CC248C823048492E654D
SHA-256:	36D7B2270E4FD3FC3F6E32089929D854425044D12B501649FC82A63BC70E5114
SHA-512:	FDAEE278AEC06C1BF1BD17CBE0EAF813C45D8FAA071A8E1BD2999591064F0FBE8E022F0FCBDDEF4E374112D4507B9D14F6F5CB01E1ACDC45DB5AF3A992DAF1AD
Malicious:	false
Preview:	Error occurred during starting up, because JRE version is invalid...(Supported JRE version is 1.7 or later)..Please install a JRE later than 1.7.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOfInvalidJREVersion_VMV.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.460399365244328
Encrypted:	false
SSDEEP:	3:SXKVKwQzgKGWuKCFQZdlIXV5GQ9rAXVgKuJCVLOQFJEmKxUL4:S0+zIWXHblkHSXcCVxP4
MD5:	BE816084311BB68552900A9342B6CF6B
SHA1:	209167C831134C9FB593CC248C823048492E654D
SHA-256:	36D7B2270E4FD3FC3F6E32089929D854425044D12B501649FC82A63BC70E5114
SHA-512:	FDAEE278AEC06C1BF1BD17CBE0EAF813C45D8FAA071A8E1BD2999591064F0FBE8E022F0FCBDDEF4E374112D4507B9D14F6F5CB01E1ACDC45DB5AF3A992DAF1AD
Malicious:	false
Preview:	Error occurred during starting up, because JRE version is invalid...(Supported JRE version is 1.7 or later)..Please install a JRE later than 1.7.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOnStartingUp_LPV5.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.54641866126203
Encrypted:	false
SSDEEP:	3:SXKVKwQzgKGWuKCFQZdlIW3RhgOBLZlX7ERMDDV3xEc0oJCVLOQLn:S0+zIWXHbleOBLZhbCcRYVxL
MD5:	913E80B4EDE93D8F437DE6722E16CC68
SHA1:	858CEA17D3659B3F6D7891597462542516DB7535
SHA-256:	021E6E83FA416330B0A951C530FCC9560C2427A1BBAA7604376AC529C048D0B9
SHA-512:	6ECC9D93A1CA1AD62F6561BD8015FB0F7B209765534940DF8112B0FDD979A9472B6457EFB66C0933F2582A55C46D4DB888D662E96D4E72A447496640575509CE
Malicious:	false
Preview:	Error occurred during starting up, because JRE has not installed...("JRE" is foundation software to start up Live Player V5)..Please install a JRE.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOnStartingUp_VMV.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.489934819189806
Encrypted:	false
SSDEEP:	3:SXKVKwQzgKGWuKCFQZdlIW3RhgOBLZlX7ERMDDV/dA0y1JCVLOQLn:S0+zIWXHbleOBLZhjdD+CVxL
MD5:	982FCEFC9B84EFEF75FB81B7B7DB2E1B
SHA1:	2B2507AAF509883B764B36A41B65742A03B35E6F
SHA-256:	3F89F3B895CE6404B23AC134F5BAF3BFE743D5AF01208A21A1AB006C7FF646CD
SHA-512:	46A3344E011DFE49B1DB9ECC4F75399823D0C6D9E9879163B48A93ECDC46F4E7D172170F2A376600AF8639FA7BA23BB5E667335228FF880A3C9240D80283877A
Malicious:	false
Preview:	Error occurred during starting up, because JRE has not installed...("JRE" is foundation software to start up VDR Maintenance Viewer)..Please install a JRE.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ShowErrorDialog.vbs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	486
Entropy (8bit):	4.9144007171521285
Encrypted:	false
SSDEEP:	12:StpqbvWdwb24BURBSCPfl0Dxb//foKHBz4nKgs0g3aHrqms0g3aHAW:cqbASuT10t5HFd3M43MH
MD5:	8F64CDE5953656472AF7DBABEB328126
SHA1:	89BB49EB6815590D0FC84E7CD05059B9E926EF92
SHA-256:	9D16AE3A0B161CB9800959BB853B380F49639D8DB9BC64AEB53D602AA01E0B38
SHA-512:	A1B2F75F4385A06815C836E03DD052EDFD82F1500105A0D25E925012D15878DFC22A170F53890D43E068710FF495B2983F01E7CB6DED203B3D4337C81B52B29D
Malicious:	false
Preview:	Option Explicit..Dim fs, su, suStr..Set fs = WScript.CreateObject("Scripting.FileSystemObject")....On Error Resume Next..Set su = fs.OpenTextFile(WScript.Arguments.Item( 0 ))..If Err.Number = 0 Then.. Err.Clear.. suStr = su.ReadAll.. If Err.Number = 0 Then....MsgBox suStr,16,WScript.Arguments.Item( 1 ).. Else....MsgBox "Error occurred during proccessing.", 16, "Error".. End If.. su.Close..Else.. MsgBox "Error occurred during proccessing.", 16, "Error"..End If..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message23.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.656577064794492
Encrypted:	false
SSDEEP:	48:g7fwCCPbpS6cXksPB6gOQnacDxKkgtAJX2JJI1X23AfkBKJR+aRUi:7V6ksPkrQac4kgtAJX6JI1X8AfkMJR+q
MD5:	D32142014DD9E5C0628644B0D05622EF
SHA1:	6F0109D3C995D1708DA67BD1C125932C9615D284
SHA-256:	0519593353B968F7F634ABBA6211B445074322F2344FEF05AF147BA964F883DB
SHA-512:	D50C5A89FD5D4A55661D07A0BA99DE11E99F23A1F04E91929A0AF504E6427D183BC227166A4649A310031784ECEED2877A2658768BABE98341BFA2106B997920
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var Longitude1;..var Latitude1;..var Longitude2;..var Latitude2;..var StationType;..var TypeOfShipAndCargoType;..var Spare2;..var Tx_RxMode;..var ReportingInterval;..var QuietTime;..var Spare3;....MessageId = ubin(#bin,0,6);..if (MessageId == 23){.. RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. Longitude1 = bin(#bin,40,18);.. Latitude1 = bin(#bin,58,17);.. Longitude2 = bin(#bin,75,18);.. Latitude2 = bin(#bin,93,17);.. StationType = ubin(#bin,110,4);.. TypeOfShipAndCargoType = ubin(#bin,114,8);.. Spare2 = ubin(#bin,122,22);.. Tx_RxMode = ubin(#bin,144,2);.. ReportingInterval = ubin(#bin,146,4)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message24ab.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	4.653299811783491
Encrypted:	false
SSDEEP:	48:gAK6eaSYL8DxKYeFvbzl08DxKYeFvfETmTGxk8kFE:RK6ea38YYeFvbzu8YYeFvfETmyxk8kFE
MD5:	BEB8FCC7DD17D0FC0B937F5D3E355CD7
SHA1:	D15EBCBBD1E6E012FC3AC2D4F1B8BC8540D45E80
SHA-256:	91E77A991C86BD026871E7EA6091FFD149625F381709811360FEA032E9840EE3
SHA-512:	016705DD0D7394DD71945FEDAEBA2E9974BD74ED5D602D591AA33D12115E8BDD1158FE32E4DB7C055C634FE20248AEDE76D3EA100DF0B7BF4D3A70545E532332
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var PartNumber;....var Name;....var TypeOfShipAndCargoType;..var VendorID;..var CallSign;..var Dimension_ReferenceForPosition;..var ManufacturerID;..var UnitModelCode;..var UnitSerialNumber;....MessageId = ubin(#bin,0,6);....if (MessageId == 24){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. PartNumber = ubin(#bin,38,2);.... if (PartNumber == 0){.. Name = str(#bin,40,120);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("UserID", UserID);.. map("PartNumber", PartNumber);.. map("Name", Name);.. }.. else if (PartNumber == 1){.. TypeOfShipAndCargoType = ubin(#bin,40,8);.. VendorID = str(#bin,48,42);.. CallSign = str(#bin,90,42);.. Dimension_R

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message25.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1942
Entropy (8bit):	4.944196219842957
Encrypted:	false
SSDEEP:	48:g7J1Rh2Nz4ODxUWJ6fCVrODxUWJ6fuoLJlODxUWJ6fgJQ/VMODxUWJ6fgJQq:T4OaWQ2rOaWQ1lOaWQgEMOaWQgD
MD5:	6CBAFD95C614454E3B8E372817EE3FDA
SHA1:	51324E5242866262673C2B6A7F2B1C313EB0401B
SHA-256:	CA3190EC432D04CE92A9F13F238484221F401061BEC8FAED4348AA3C8508EFEA
SHA-512:	0FD452A0A627928CE8B1328E1091FBF822D74E552F81102399D7FF34E4B2D1FD10E521D8FE3E887C808C114746C93DC5CBB28A6F4F630C8900F30EBA5A620DCD
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var DestinationIndicator;..var BinaryDataFlag;..var DestinationID;..var BinaryData;......MessageId = ubin(#bin,0,6);..if (MessageId == 25){.....RepeatIndicator =....ubin(#bin,6,2);...SourceID =......ubin(#bin,8,30);...DestinationIndicator =...ubin(#bin,38,1);...BinaryDataFlag =....ubin(#bin,39,1);.....if (DestinationIndicator == 0) {....if (BinaryDataFlag == 0) {.....BinaryData =....strHex(#bin,40,128);...... map("MessageId", MessageId);.... map("RepeatIndicator", RepeatIndicator);.... map("SourceID", SourceID);.... map("DestinationIndicator", DestinationIndicator);.... map("BinaryDataFlag", BinaryDataFlag);.....map("BinaryData", BinaryData);....}....else if (BinaryDataFlag == 1) {.....BinaryData =....strHex(#bin,40,112);...... map("MessageId", MessageId);.... map("RepeatIndicator", RepeatIndicator);.... map("SourceID", SourceID);.... map("DestinationIndicator", DestinationIndicator);

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message26.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6530
Entropy (8bit):	5.1615921348542635
Encrypted:	false
SSDEEP:	192:kfc4kGCAwx+XxqL1x+mxeB7wx+XxkL1x+mxC:wc4kG7d
MD5:	83FA3A2040435251FE10CF541AAAED24
SHA1:	DDAAB923834F825EB10E58408DE42FC793D3AB41
SHA-256:	31088D56EC40EA27E13DBB1252228B1B2C0BD80EEFEE23900F1E7855B0FA3332
SHA-512:	5DC3F093BE941DFBF62C8BBC79AFA95762E3D24C6F7272263B424A6E8D3CDD9C41BC6E748C0E493E42A738210084EFE7A36663E56CB10CD7BF637E4B1841D9D5
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var DestinationIndicator;..var BinaryDataFlag;..var DestinationID;..var BinaryData;..var BinaryDataAddedBy2ndSlot;..var BinaryDataAddedBy3rdSlot;..var BinaryDataAddedBy4thSlot;..var BinaryDataAddedBy5thSlot;..var CommunicationStateSelectorFlag;..var SyncState;..var SlotTime_Out;..var SubMessage;..var SlotIncrement;..var NumberOfSlots;..var Keep_flag;......MessageId = ubin(#bin,0,6);..if (MessageId == 26){.....RepeatIndicator =....ubin(#bin,6,2);...SourceID =......ubin(#bin,8,30);...DestinationIndicator =...ubin(#bin,38,1);...BinaryDataFlag =....ubin(#bin,39,1);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("DestinationIndicator", DestinationIndicator);.. map("BinaryDataFlag", BinaryDataFlag);.... ...if (DestinationIndicator == 0) {....if (BinaryDataFlag == 0) {.....BinaryData =......strHex(#bin,40,108);.....BinaryDataAddedBy2ndSl

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message27.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1159
Entropy (8bit):	5.206059151715646
Encrypted:	false
SSDEEP:	24:gM8XoGnkD+3v+8mu+YOHZJLNKicOsxK4YbgLaaRDTX2zEk0i:go8MHZvHcDxK4Y0+STX2zEk0i
MD5:	49C18CBF5D067407D73FEC29DA1D2014
SHA1:	72BCF26A725B923E0717D71D703357E368BAADE8
SHA-256:	6037FD2028119CC82B40116AFE7077841D9C21DC257AB4B385BDD3DACA81E7B6
SHA-512:	9BAAAD149EFB3B0F01854DF7FFC51E5C9543FAA449554DB2D96B8DCF6AF2A389E77824DBF248C0DFC925CB585AD0B0086E9AC6EF1F40CA59F19294D0FCEC59E2
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var PositionAccuracy;..var RAIM_flag;..var NavigationalStatus;..var Longitude;..var Latitude;..var SOG;..var COG;..var StatusOfCurrentGNSSPosition;..var Spare;......MessageId = ubin(#bin,0,6);..if (MessageId == 27){...RepeatIndicator =....ubin(#bin,6,2);...UserID =......ubin(#bin,8,30);...PositionAccuracy = ....ubin(#bin,38,1);...RAIM_flag = .....ubin(#bin,39,1);...NavigationalStatus = ...ubin(#bin,40,4);...Longitude = .....bin(#bin,44,18);...Latitude = ......bin(#bin,62,17);...SOG = .......ubin(#bin,79,6);...COG = .......ubin(#bin,85,9);...StatusOfCurrentGNSSPosition = .ubin(#bin,94,1);.. Spare =.......ubin(#bin,95,1);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("UserID", UserID);.. map("PositionAccuracy", PositionAccuracy);.. map("RAIM_flag", RAIM_flag);.. map("NavigationalStatus", NavigationalStatus);.. map("Longitude", Longitude);.. map("Latitud

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table15.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3805
Entropy (8bit):	4.611276851317889
Encrypted:	false
SSDEEP:	96:8TWfTcP0xdBIx16c44+8EYSTX0kxuw8c0MxdXBmNvcP0xdBIxbVxc44+8EYSTX02:W6n2xIc44+8EYSTX0kUw8c0MxdAd2xTl
MD5:	FB828325901EDFDA51D2D6CFBC7E579A
SHA1:	857758D7AE99B8BAF71BE50619C2F2539BCA8E97
SHA-256:	93320F89392E46FB99D1E68D6B3973B50CB6288CB8C657018D61B8872C0FF310
SHA-512:	7BA29D5397DF04099AA91CF62B11B6E2DB2EF07E0EBDDFBDF5190DD290075991C71572F1817376EB5324673079D34F320EDD8B190EEEB973B890108DA0DD7DEC
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var NavigationalStatus;..var RateOfTurn;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var SpecialManoeuvreIndicator;..var Spare;..var RAIM_flag;..var SyncState;....var SlotTime_Out;..var SubMessage;....var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);..if (MessageId == 1 \|\|.. MessageId == 2){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. NavigationalStatus = ubin(#bin,38,4);.. RateOfTurn = bin(#bin,42,8);.. SOG = ubin(#bin,50,10);.. PositionAccuracy = ubin(#bin,60,1);.. Longitude = bin(#bin,61,28);.. Latitude = bin(#bin,89,27);.. COG = ubin(#bin,116,12);.. TrueHeading =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table16.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2270
Entropy (8bit):	4.808604794064066
Encrypted:	false
SSDEEP:	48:gfo/v+2LZlUSYjt0hJ2cuyopDfkvLcDxK4s8ikMp2MB9hiYSTX2z5ihTxs28s2By:HtLZlUl0h4cux16c44s8ikMp2MbgYSTL
MD5:	A1D955F86AF7F9DFB8181637A6F190E5
SHA1:	5C1BEFFE36E0AEFAC0E04C00547F9CC9F0A47E9B
SHA-256:	4AF3F2DB153A21F033070AAFB8CA9BFDD271B9A7F9F6DC5FD6AD2866B668D245
SHA-512:	8BF98FC5EE65B830B2CAD718BEB2983F19F6E540E8891CD12EB9AC90961A5B9B4ADC1FE8D07A00FA442CFFDD38BD8E7A27BBD8198F7521486D2029B61A69D8A7
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var UTCYear;..var UTCMonth;..var UTCDay;..var UTCHour;..var UTCMinute;..var UTCSecond;..var PositionAccuracy;..var Longitude;..var Latitude;..var TypeOfElectronicPositionFixingDevice;..var TransmissionControlForLongrangeBroadcastMessage;..var Spare;..var RAIM_flag;..var SyncState;..var SlotTime_Out;..var SubMessage;....MessageId = ubin(#bin,0,6);..if (MessageId == 4 \|\|.. MessageId == 11){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. UTCYear = ubin(#bin,38,14);.. UTCMonth = ubin(#bin,52,4);.. UTCDay = ubin(#bin,56,5);.. UTCHour = ubin(#bin,61,5);.. UTCMinute = ubin(#bin,66,6);.. UTCSecond = ubin(#bin,72,6);.. PositionAccuracy = ubin(#bin,78,1);.. Longitude =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table17.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1838
Entropy (8bit):	4.853870663306694
Encrypted:	false
SSDEEP:	48:gYIJPSYIIFRNWcDxK4c+F/TGyfkM5ihTE34JNoYi:xI9PzEc44c+F/yyfkM5ihTEoMYi
MD5:	02F63704CA632C50D822FAF180EFCD6D
SHA1:	B7422C9D1901B320C4BFDD9B030F3F3ABA4FD9A0
SHA-256:	F0E63E4ADDF7B88234A05D3885D30BA935867E6E062E6353F91D3E8075530512
SHA-512:	4354FE2B5012EF1E43D03E98A82C943450AB1325FF7282E619475138D15A61A5AEE3074F0AB9933C74EBF6E078229FAE8A9879E5C46F6D8D8ADC63A07B3AE0DA
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var AISVersionIndicator;..var IMONumber;..var CallSign;..var Name;..var TypeOfShipAndCargoType;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var ETA;..var MaximumPresentStaticDraught;..var Destination;..var DTE;..var Spare;....MessageId = ubin(#bin,0,6);..if (MessageId == 5){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. AISVersionIndicator = ubin(#bin,38,2);.. IMONumber = ubin(#bin,40,30);.. CallSign = str(#bin,70,42);.. Name = str(#bin,112,120);.. TypeOfShipAndCargoType = ubin(#bin,232,8);.. Dimension_ReferenceForPosition = ubin(#bin,240,30);.. TypeOfElectronicPositionFixingDevice = ubin(#bin,270,4);.. ETA = ubin(#bin,274,20);.. MaximumPresentStaticDraught = ubin(#bin

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table19.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	4.733545938429769
Encrypted:	false
SSDEEP:	24:gMiHrGpW+5HAGm516G/dBS6z4NWr5I6NQcOsxKkLvaF/JQ3acIDYT/WV6x6aF/3y:g7LQHf+S6z4Er5dOcDxKkLvaF/JQ3acA
MD5:	EBB74D32511FC192E9515B34BDE27BCF
SHA1:	B30B8F09959AE516993B1A91A9B39D73A5059E8B
SHA-256:	A1110A7CA10FAA20FA25FF05C5094CE00258F2951C77AD55111BA6EC241BEB9B
SHA-512:	F6C3F5687F6C849F74AD5A6D18BB13DC02D77D4B89F198E86763113C1ED65F63DFC673891FD0FF769164D61CD7F8C74A2E5EB8B8660D41ED0069CC8D241EF7B8
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var SequenceNumber;..var DestinationID;..var RetransmitFlag;..var Spare;..var DAC;..var FunctionIdentifier;..var AcknowledgedRequiredFlag;..var TextSequenceNumber;..var ApplicationData;....MessageId = ubin(#bin,0,6);..if (MessageId == 6 ){.. RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. SequenceNumber = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. RetransmitFlag = ubin(#bin,70,1);.. Spare = ubin(#bin,71,1);.. DAC = ubin(#bin,72,10);.. FunctionIdentifier = ubin(#bin,82,6);.. AcknowledgedRequiredFlag = ubin(#bin,88,1);.. TextSequenceNumber = ubin(#bin,89,11);.. ApplicationData = str(#bin,100,906);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndic

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table21.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1515
Entropy (8bit):	4.698432684936653
Encrypted:	false
SSDEEP:	24:gMiHHpyVrZVpVrGzpyrRpLr5CBS6DSW2jKktI+xXgLfcOsxKkcJ/qLo7JyRLnYJx:g7pq1RIgDfkS6Dl2jdtI+xXgLfcDxKk6
MD5:	0D164D701ED7031A70593F2654DC0A31
SHA1:	DA5EDBF15FE4F07C29425F0BF45ECF62CB874C78
SHA-256:	E7C741C774C132F2DC691EB54C23C9786F721508676B2DCFF65F56924B5AF49C
SHA-512:	4A7F5E9726E3152B3AB6B16D4925F9D751F1FF0EE7157EC96709D184B919C910DE58875B99933EB5E4482049530FCF9D66B35ABC32FE45E6CAE7A72BE3B95FCD
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var DestinationID1;..var SequenceNumberForID1;..var DestinationID2;..var SequenceNumberForID2;..var DestinationID3;..var SequenceNumberForID3;..var DestinationID4;..var SequenceNumberForID4;....MessageId = ubin(#bin,0,6);..if (MessageId == 7 \|\|.. MessageId == 13){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. DestinationID1 = ubin(#bin,40,30);.. SequenceNumberForID1 = ubin(#bin,70,2);.. DestinationID2 = ubin(#bin,72,30);.. SequenceNumberForID2 = ubin(#bin,102,2);.. DestinationID3 = ubin(#bin,104,30);.. SequenceNumberForID3 = ubin(#bin,134,2);.. DestinationID4 = ubin(#bin,136,30);.. SequenceNumberForID4 = ubin(#bin,166,2);.... map("MessageId", Messa

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table22.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	4.755640824837969
Encrypted:	false
SSDEEP:	24:gMiHHAGm516G/IS64MyWMe6ncOsxKkcIDYT/WV6x6aF/3y:g7NflS6zyWqncDxKkcIDk/W4EaF/3y
MD5:	8DFD0E9E102C6545B0EEEF75FB84C533
SHA1:	67CE065E9AE30CDE1EFF24B81E035914B2392D81
SHA-256:	8479E9D60F5BA54DE40E609F2315F1B125ADCB8C9A325B875AD14E71391B7910
SHA-512:	ACD1414C7FF670AEAF560AE55AB6871D0E310B8E2DA823AC90229E39ACD5795081D3A1734151161545E44FDBA76F9BBE2BC084EA75BDF422126D9F769AB66819
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var DAC;..var FunctionIdentifier;..var AcknowledgedRequiredFlag;..var TextSequenceNumber;..var ApplicationData;....MessageId = ubin(#bin,0,6);..if (MessageId == 8 ){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. DAC = ubin(#bin,40,10);.. FunctionIdentifier = ubin(#bin,50,6); .. AcknowledgedRequiredFlag = ubin(#bin,56,1);.. TextSequenceNumber = ubin(#bin,57,11);.. ApplicationData = str(#bin,68,936);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare", Spare);.. map("DAC", DAC);.. map("FunctionIdentifier", FunctionIdentifier);.. map("AcknowledgedRequiredFlag", AcknowledgedRequiredFlag);.. map("TextSequen

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table23.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	4.630450415113706
Encrypted:	false
SSDEEP:	48:gEAxbZXSYMtdBhRDttcDxK4YEYSTX2zkwuJYu0O0fyoUvyMxtXBmNSFTyoUSi6MW:2xbZXudBhRDttc44YEYSTX0kwuJYu0OT
MD5:	7C6D3706CF486BC3A68D0F9E6876CB8E
SHA1:	A16C9B5403495221DC78AA6068ED8F68A1A2C300
SHA-256:	67B60CF4A60AD08CE16DB988D7C0569C84D992FF0FDE707F5B5BEEB0033B062C
SHA-512:	64440A3139D8E8BB6507AB49C8DEDA87233302F802A580D3C8C62EA8511E16DCD72A3A8FBC24A54909604D2B51A3C6C772E2769BD4774784CC1128BCD7016A01
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var Altitude_GNSS;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TimeStamp;..var AltitudeSensor;..var Spare;..var DTE;..var AssignedModeFlag;..var RAIM_flag;..var CommunicationStateSelectorFlag;..var SyncState;..var SlotTime_Out;..var SubMessage;..var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);..if (MessageId == 9){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. Altitude_GNSS = ubin(#bin,38,12);.. SOG = ubin(#bin,50,10);.. PositionAccuracy = ubin(#bin,60,1);.. Longitude = bin(#bin,61,28);.. Latitude = bin(#bin,89,27);.. COG = ubin(#bin,116,12);.. TimeStamp = ubin(#bin,128,6);.. AltitudeSensor =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table24.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	668
Entropy (8bit):	4.488552652178458
Encrypted:	false
SSDEEP:	12:TK31xMiHUpW+SAuSsPzcV5NWJP1cX+sx8/k1iJW51JBKV:gMiHUpW+SfS6c7NWJP1cOsxKkgJQ3BKV
MD5:	CEB1D9852B3CE681B48BE3F31CDA2661
SHA1:	3CD95E79245A2D6D7F05036A4E0FB9D9F4876191
SHA-256:	5FE3505C1167FA704A5A5942F721807E4ABFE5F0CF43C51AC1DDFB444E8567D6
SHA-512:	E06D92A490C304025264E77771A5FF61BFC44734628B86080764D84F518881020107F5AE5B7DA28547C2C6A284C908A402631B85FB7D5ADF7FE41DB59F31B666
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationID;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 10){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. Spare2 = ubin(#bin,70,2);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare1", Spare1);.. map("DestinationID", DestinationID);.. map("Spare2", Spare2);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table25.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.671076875893976
Encrypted:	false
SSDEEP:	24:gMiHrGpW+5HX9S6z4NWrvScOsxKkLvaF/JQ3acDz3i:g7LQd9S6z4ErvScDxKkLvaF/JQ3acDzy
MD5:	73496C60D3431A20685EDDE4FBD88748
SHA1:	1F04A3E7FE04A57A8D508DB7E0AF167171CBBC74
SHA-256:	F1AFE5FA585384C9A609345ECA1CA7FF4C3E32FB1AB8AC3E8098792DEFDE7B3F
SHA-512:	A8E17CF73160A99276A40C925615ABE8F2E4765DF859683AEB352A59A347B1B16A2F41AB67DD44462DEFCD2E13E14A6CE5C0704FFC0191BD3BAA44AD8B623DE0
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var SequenceNumber;..var DestinationID;..var RetransmitFlag;..var Spare;..var SafetyRelatedText;....MessageId = ubin(#bin,0,6);..if (MessageId == 12){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. SequenceNumber = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. RetransmitFlag = ubin(#bin,70,1);.. Spare = ubin(#bin,71,1);.. SafetyRelatedText = str(#bin,72,936);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("SequenceNumber", SequenceNumber);.. map("DestinationID", DestinationID);.. map("RetransmitFlag", RetransmitFlag);.. map("Spare", Spare);.. map("SafetyRelatedText", SafetyRelatedText);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table26.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.6431236091809724
Encrypted:	false
SSDEEP:	12:TK31xMiHu+yEFpSsPzsEbKcX+sx8/kcDDaESEM9:gMiHHXFpS6lbKcOsxKkcDz3i
MD5:	A28F2261023D79C75CCC9E5D8B69219F
SHA1:	E899D7CACCAE32DE98672A562D186E4F797D6DF5
SHA-256:	3A006C6F9E484EE9FB6E2E7CC515C5FD05A16C33E7915CAB069FED4E4299E4D4
SHA-512:	4A847D84EE2622FD463C17E049D0B6344EB6C25C83494D1378EB77A19421CC62862A9EBC8941B1F58D4D4B1DC667AD32DEF6C6F821FE8E8E3D3C93B2935DAC90
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var SafetyRelatedText;....MessageId = ubin(#bin,0,6);..if (MessageId == 14){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. SafetyRelatedText = str(#bin,40,966);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare", Spare);.. map("SafetyRelatedText", SafetyRelatedText);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table27.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	4.582404421318364
Encrypted:	false
SSDEEP:	48:g7GuSPGS6c7lh9YtVBcDxKkgJ/q2kBKJkEcJyR80/g:QXBc4kgc2kMJkEcy80/g
MD5:	AEC39D3C44EF9A4AD85EAF88B3BC0AE4
SHA1:	E58692F76F4A77D30F2DE391F6E7C83127966A5A
SHA-256:	0C48F29A146F847A20B3EF8229D792A667B1CAACB76E918863BFB8ED2C084982
SHA-512:	E2CFABF3DC560A478EC50217DE1FEF8A89BE7CD5EFF4B62FF092C592E3DBC2BC2E0CA811F6AE403B65FFD221838086E83D9EED2985F0209D5C27CD5BA683915C
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationID1;..var MessageID1_1;..var SlotOffset1_1;..var Spare2;..var MessageID1_2;..var SlotOffset1_2;..var Spare3;..var DestinationID2;..var MessageID2_1;..var SlotOffset2_1;..var Spare4;....MessageId = ubin(#bin,0,6);..if (MessageId == 15){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationID1 = ubin(#bin,40,30);.. MessageID1_1 = ubin(#bin,70,6);.. SlotOffset1_1 = ubin(#bin,76,12);.. Spare2 = ubin(#bin,88,2);.. MessageID1_2 = ubin(#bin,90,6);.. SlotOffset1_2 = ubin(#bin,96,12);.. Spare3 = ubin(#bin,108,2);.. DestinationID2 = ubin(#bin,110,30);.. MessageID2_1 = ubin(#bin,

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table28.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	4.497603067977456
Encrypted:	false
SSDEEP:	24:gMiHUpcyOpS6067SFS6c7CWn5k8C/cOsxKkgJvasQFJiBgeBKV:g7Gm+pFS6c7Vn5TC/cDxKkgJvasQFJi0
MD5:	F1966811115749C980CFB828B6A4AC80
SHA1:	C8984EC1925F7978D26AAB2F4E8CD3FD6DD3F4C8
SHA-256:	78B25ACB86E64B319EE08B74A73CD5BAC8B1266C84DE9B0C618EC4D46400F852
SHA-512:	156583344A3C172B3F4963FA06EA147707929C8353CC592B21464421F75C7A35E125A48D21DB3F7360AFE81CCE3484D16E3D9C42B2E0620688DA31811FC3120B
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationIDA;..var OffsetA;..var IncrementA;..var DestinationIDB;..var OffsetB;..var IncrementB;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 16){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationIDA = ubin(#bin,40,30);.. OffsetA = ubin(#bin,70,12);.. IncrementA = ubin(#bin,82,10);.. DestinationIDB = ubin(#bin,92,30);.. OffsetB = ubin(#bin,122,12);.. IncrementB = ubin(#bin,134,10);.. Spare2 = ubin(#bin,144,4);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare1", Spare1);.. map("DestinationIDA", DestinationI

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table29.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4969
Entropy (8bit):	4.620754023544724
Encrypted:	false
SSDEEP:	96:MdhXTQRgAbc4kgSTX0MJ4cGJLvaF/sVucik2kqc2cPE4TQQcgcIMoQcEQ/okswgS:M4aYc4kgSTX0i4cGJLvaJswcik2kqc2y
MD5:	0B5E6497C3FD19E9C225DD1F17CA61A4
SHA1:	019383E0EEFFA13E92F6BD8202A16D1E1BB77F95
SHA-256:	41FD761636E41A962EC81481CCC7BD0497ED57425920D79F9DBB9F0C1CE66C8B
SHA-512:	9F93F732D6A7F55614664E68EEAF482541F8FA93C42C645008FE8180B67A58C53DBAEC460779B755D502ADC8692C0E78F4D928977E7E237B8C926EF242B8B6C7
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var Longitude;..var Latitude;..var Spare2;..var MessageType;..var StationID;..var ZCount;..var SequenceNumber;..var N;..var Health;..var DGNSSDataWord1;..var DGNSSDataWord2;..var DGNSSDataWord3;..var DGNSSDataWord4;..var DGNSSDataWord5;..var DGNSSDataWord6;..var DGNSSDataWord7;..var DGNSSDataWord8;..var DGNSSDataWord9;..var DGNSSDataWord10;..var DGNSSDataWord11;..var DGNSSDataWord12;..var DGNSSDataWord13;..var DGNSSDataWord14;..var DGNSSDataWord15;..var DGNSSDataWord16;..var DGNSSDataWord17;..var DGNSSDataWord18;..var DGNSSDataWord19;..var DGNSSDataWord20;..var DGNSSDataWord21;..var DGNSSDataWord22;..var DGNSSDataWord23;..var DGNSSDataWord24;..var DGNSSDataWord25;..var DGNSSDataWord26;..var DGNSSDataWord27;..var DGNSSDataWord28;..var DGNSSDataWord29;....MessageId = ubin(#bin,0,6);..if (MessageId == 17){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ub

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table31.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5586
Entropy (8bit):	4.639847403164306
Encrypted:	false
SSDEEP:	96:882eWJa8sIwyrJxla8YYXcvk4SDXUExuQdcvUmG8sOtUMMxtXBmNE8sIwyrJxr4o:8FepnyrJxY8YYXcvk4SDXUE0QdcvUmGS
MD5:	A800676ACE24CC656B3012AA31519226
SHA1:	7FA9DBB6BE0A959B84E7BA5FB6EA4CB8B4903946
SHA-256:	D3C4C79BBD7D429B97459CCC3A7F956CD9B50D27E937746F85C4ADBD3F2FE7ED
SHA-512:	8463A21491ED0B44D583DD7685D3B39BF24727DCED9B903918B92CE8728BDA8623C444E863880DB2DD363B175332F29E98F904DD7F5DEFEC0CE2614D6A5A501C
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var ReservedForRegionalOrLocalApplications;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var ReservedForRegionalApplications;..var ClassB_UnitFlag;..var ClassB_DisplayFlag;..var ClassB_DSCFlag;..var ClassB_BandFlag;..var ClassB_Message22Flag;..var ModeFlag;..var RAIM_flag;..var CommunicationStateSelectorFlag;..var SyncState;....var SlotTime_Out;..var SubMessage;....var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);....if (MessageId == 18){.. CommunicationStateSelectorFlag = ubin(#bin,148,1);.. if (CommunicationStateSelectorFlag == 0){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. ReservedForRegionalOrLocalApplications = ubin(#bin,38,8);.. SOG = ubin(#bin,46,10);.. PositionAccuracy =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table32.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2373
Entropy (8bit):	4.890773121214861
Encrypted:	false
SSDEEP:	48:gy0TA26InQSY4t0f0sIVxmyZVjsNcDxK4I0/0/EYSTX2zkxQBwdc/yfkM5ihT0YM:8826InQsqMsoxmyZVANc44Xc/EYSTX00
MD5:	AF38DCCA9DA67BE2101A1A1D242EDD3D
SHA1:	C3B003134DAFA46025E1701912749CC865664198
SHA-256:	A66FC035B313B7CF3AF1F2195D8A07AC342571D5642A47588A42B0DF32091351
SHA-512:	2861FB240EA10F75F026F963F2564E36B7ABFA9B9629E41BEE642F6DA1F3187C41F42842EAF0F6EA731197D7E84C666809B4D5456DD416B1F54E21EB01F254E1
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var ReservedForRegionalOrLocalApplications;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var ReservedForRegionalApplications;..var Name;..var TypeOfShipAndCargoType;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var RAIM_flag;..var DTE;..var AssignedModeFlag;....MessageId = ubin(#bin,0,6);..if (MessageId == 19){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. ReservedForRegionalOrLocalApplications = ubin(#bin,38,8);.. SOG = ubin(#bin,46,10);.. PositionAccuracy = ubin(#bin,56,1);.. Longitude = bin(#bin,57,28);.. Latitude = bin(#bin,85,27);.. COG = ubin(#bin,112,12);.. TrueHeading = ubin(#bin,124,9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table33.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	4.595677246392144
Encrypted:	false
SSDEEP:	48:g7yTG4T0eS6cnBRn9ovG+64bcDxKcgAclek8Zk4H1+40ro0cKiHSBKV:7TrTruBfMG+Rc4cgAclek8Zk4H1+40r4
MD5:	39832F29DDF54ED5059462922C4FDE5E
SHA1:	00F8777F4245EAFCB7F9ED04FC1F582CA143F931
SHA-256:	8DE6916A690FEFA550B5DDB020F2563BEDEE3FE4F7D6C64F68B45473B54E5D4F
SHA-512:	7641DE369F3C6A184093F1E4C45F37FEF1C3EF5B6EAD896E079150906498604A03C38B2F2E8BE26A01491E9903E8D697CD0F776F3F8D217DDE8B6BB5098C32A2
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceStationID;..var Spare1;..var OffsetNumber1;..var NumberOfSlots1;..var Time_Out1;..var Increment1;..var OffsetNumber2;..var NumberOfSlots2;..var Time_Out2;..var Increment2;..var OffsetNumber3;..var NumberOfSlots3;..var Time_Out3;..var Increment3;..var OffsetNumber4;..var NumberOfSlots4;..var Time_Out4;..var Increment4;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 20){.... RepeatIndicator = ubin(#bin,6,2);.. SourceStationID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. OffsetNumber1 = ubin(#bin,40,12);.. NumberOfSlots1 = ubin(#bin,52,4);.. Time_Out1 = ubin(#bin,56,3);.. Increment1 = ubin(#bin,59,11);.. OffsetNumber2 = ubin(#bin,70,12);.. NumberOfSlots2 = ubin(#bin,82,4);.. Time_Out2 = ubin(

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table34.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	4.964166837499702
Encrypted:	false
SSDEEP:	48:gbl8K0/iBSBrJ52aOt0+uKTcDxKKa4+XgYSTX2zM5ihTwrYI0/0/0Tgu0Oa:nJ/iB+J52aOq+uKTc4Ka4+XgYSTX0M5n
MD5:	72BFCDBC7EA7B24D02FDA64464E0002F
SHA1:	2FA21ABA2D8B137F63E0AC2048E4AB780370A3CF
SHA-256:	AA8690C692294B7B1AC7328FE556185DB3916FD14D9ECCB63ADB1565DF7E6041
SHA-512:	8A5E63A1D49FCE018DF4B70CC83F4AFEAA2110B6EBEF2723C564E0FD860740422258C6AAAB0913388B624F617B57867C0BD45A5D3A0806E07B7A101AB69E598B
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var ID;..var TypeOfAids_To_Navigation;..var NameOfAids_To_Navigation;..var PositionAccuracy;..var Longitude;..var Latitude;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var TimeStamp;..var Off_PositionIndicator;..var ReservedForRegionalOrLocalApplications;..var RAIM_flag;..var Virtual_AtoN_flag;..var AssignedModeFlag;..var NameOfAidToNavigationExtension;..var Spare;....MessageId = ubin(#bin,0,6);..if (MessageId == 21){.... RepeatIndicator = ubin(#bin,6,2);.. ID = ubin(#bin,8,30);.. TypeOfAids_To_Navigation = ubin(#bin,38,5);.. NameOfAids_To_Navigation = str(#bin,43,120);.. PositionAccuracy = ubin(#bin,163,1);.. Longitude = bin(#bin,164,28);.. Latitude = bin(#bin,192,27);.. Dimension_ReferenceForPosition = ubin(#bin,219,30);.. TypeOfElectronicPositionFixi

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_table35.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1979
Entropy (8bit):	4.694496363970113
Encrypted:	false
SSDEEP:	48:gc4+w7qr8QSZcZzoEiFRHcDxKcgPINP2R+a/tAJX2JJI1X23ae4P74PP4xQBKV:FQqRdzoEiFtc4cgANeR+a/tAJX6JI1XZ
MD5:	C201FB59451BC2AAAB451928DD56115F
SHA1:	0087F499E34D8489358842710527F5509FDFAD6A
SHA-256:	810219C0FB0683E606355DA8EE806FC2464204F7382531B4A7E965601BC8282A
SHA-512:	8F1BBCD9731C1F8864ACB4C2D506D334DF2A97E9DAFBC9A7E1204039B1297EBEFACB21740F2D6A22AC535603171665E33064C0577B047EABD21B253B048088F3
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var StationID;..var Spare1;..var ChannelA;..var ChannelB;..var Tx_RxMode;..var Power;..var Longitude1;..var Latitude1;..var Longitude2;..var Latitude2;..var AddressedOrBroadcastMessageIndicator;..var ChannelABandwidth;..var ChannelBBandwidth;..var TransitionalZoneSize;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 22){.... RepeatIndicator = ubin(#bin,6,2);.. StationID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. ChannelA = ubin(#bin,40,12);.. ChannelB = ubin(#bin,52,12);.. Tx_RxMode = ubin(#bin,64,4);.. Power = ubin(#bin,68,1);.. Longitude1 = bin(#bin,69,18);.. Latitude1 = bin(#bin,87,17);.. Longitude2 = bin(#bin,104,18);.. Latitude2 = bin(#bin,1

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_message23.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.65722864227426
Encrypted:	false
SSDEEP:	48:K7fwCCPbpS6cXksPB6gOQnacDxKkgtAJX2JJI1X23AfkBKJR+aRUi:9V6ksPkrQac4kgtAJX6JI1X8AfkMJR+q
MD5:	E377A25E90FDFD43310B953A74D79AAE
SHA1:	A2E36874D6EF7EE01418D0E6BE0D840D0A34DBC4
SHA-256:	15E4B1E1A5A66737D042334F4EAEDC955BFE4AD636B692CE59950B89E6C7AF20
SHA-512:	64C997D5F7E8E233F12D1C2D62AFE4AC26BA4E75B2F33A04A664ECF6B50D222C03ABB182846711C367ABAB22D8BEEDCF78774285A43092EA56A5120C807C5F3C
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var Longitude1;..var Latitude1;..var Longitude2;..var Latitude2;..var StationType;..var TypeOfShipAndCargoType;..var Spare2;..var Tx_RxMode;..var ReportingInterval;..var QuietTime;..var Spare3;....MessageId = ubin(#bin,0,6);..if (MessageId == 23){.. RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. Longitude1 = bin(#bin,40,18);.. Latitude1 = bin(#bin,58,17);.. Longitude2 = bin(#bin,75,18);.. Latitude2 = bin(#bin,93,17);.. StationType = ubin(#bin,110,4);.. TypeOfShipAndCargoType = ubin(#bin,114,8);.. Spare2 = ubin(#bin,122,22);.. Tx_RxMode = ubin(#bin,144,2);.. ReportingInterval = ubin(#bin,146,4)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_message24ab.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1764
Entropy (8bit):	4.641806635168766
Encrypted:	false
SSDEEP:	48:KAK6eaSYL8DxKYeFvbzl08DxKYeFvfETmTGxk8kFE:jK6ea38YYeFvbzu8YYeFvfETmyxk8kFE
MD5:	67F142757376FBA905ED6F41F5C93B4F
SHA1:	10C4E2A99321B2DCC3FD8C9AA5EE2481FB8A7F0C
SHA-256:	CB8B63B022B1784CECBB55190E61F1308363E02BA682A761D0A1C0C05A50A444
SHA-512:	A0EF26B8FFB6AAB5516B9AD28C218CD1C8CDCE443E183081B11D8A06208AFEA17C735287665EB7B05C3F8F3324161205A5796D67C65C2A3BAA97E4381D53359D
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var PartNumber;....var Name;....var TypeOfShipAndCargoType;..var VendorID;..var CallSign;..var Dimension_ReferenceForPosition;..var ManufacturerID;..var UnitModelCode;..var UnitSerialNumber;....MessageId = ubin(#bin,0,6);....if (MessageId == 24){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. PartNumber = ubin(#bin,38,2);.... if (PartNumber == 0){.. Name = str(#bin,40,120);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("UserID", UserID);.. map("PartNumber", PartNumber);.. map("Name", Name);.. }.. else if (PartNumber == 1){.. TypeOfShipAndCargoType = ubin(#bin,40,8);.. VendorID = str(#bin,48,42);.. CallSign = str(#bin,90,42);.. Dimension_R

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_message25.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1942
Entropy (8bit):	4.9467532755605905
Encrypted:	false
SSDEEP:	48:K7J1Rh2Nz4ODxUWJ6fCVrODxUWJ6fuoLJlODxUWJ6fgJQ/VMODxUWJ6fgJQq:l4OaWQ2rOaWQ1lOaWQgEMOaWQgD
MD5:	59EEDB441F4DDFC98A78681D93E8ECD9
SHA1:	9CE970EBE9D0D878DCC6DD0315551722C5C1C039
SHA-256:	C8044BDA04233DCAAC2B40A4371D3AC61229123430ACBABEE1BBECE53DEA4A76
SHA-512:	974B96352B853B7A34BE5A618ED25B3FCDA8CDF6B24DB15C1CFE4EBC49F65DC4DAE1C20C3EB56D90757C9C6F0E8494305D919E763D5ADB1BF421FB5EC3AC7F20
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var DestinationIndicator;..var BinaryDataFlag;..var DestinationID;..var BinaryData;......MessageId = ubin(#bin,0,6);..if (MessageId == 25){.....RepeatIndicator =....ubin(#bin,6,2);...SourceID =......ubin(#bin,8,30);...DestinationIndicator =...ubin(#bin,38,1);...BinaryDataFlag =....ubin(#bin,39,1);.....if (DestinationIndicator == 0) {....if (BinaryDataFlag == 0) {.....BinaryData =....strHex(#bin,40,128);...... map("MessageId", MessageId);.... map("RepeatIndicator", RepeatIndicator);.... map("SourceID", SourceID);.... map("DestinationIndicator", DestinationIndicator);.... map("BinaryDataFlag", BinaryDataFlag);.....map("BinaryData", BinaryData);....}....else if (BinaryDataFlag == 1) {.....BinaryData =....strHex(#bin,40,112);...... map("MessageId", MessageId);.... map("RepeatIndicator", RepeatIndicator);.... map("SourceID", SourceID);.... map("DestinationIndicator", DestinationIndicator);

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_message26.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6530
Entropy (8bit):	5.1615127233447256
Encrypted:	false
SSDEEP:	192:mfc4kGCAwx+XxqL1x+mxeB7wx+XxkL1x+mxC:+c4kG7d
MD5:	A915C6861C7ABCDCE70573880F4F3F2A
SHA1:	993FBA37CC0FBA1B9AE2381036480F7B13DE4AC9
SHA-256:	60ECB0E990DD32A7F0E6DB3CFA98E5B71EC9DB9B54E4DFE28B2153C9F5CAE88A
SHA-512:	9C78B1C4BABDA7747BD64BF866ADDACD516208DA409DDEDCE015A96545C7858B518B73875E6D73A161E0871B344927DC2A5D1ADC0F25836300BEBC61180ED1B0
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var DestinationIndicator;..var BinaryDataFlag;..var DestinationID;..var BinaryData;..var BinaryDataAddedBy2ndSlot;..var BinaryDataAddedBy3rdSlot;..var BinaryDataAddedBy4thSlot;..var BinaryDataAddedBy5thSlot;..var CommunicationStateSelectorFlag;..var SyncState;..var SlotTime_Out;..var SubMessage;..var SlotIncrement;..var NumberOfSlots;..var Keep_flag;......MessageId = ubin(#bin,0,6);..if (MessageId == 26){.....RepeatIndicator =....ubin(#bin,6,2);...SourceID =......ubin(#bin,8,30);...DestinationIndicator =...ubin(#bin,38,1);...BinaryDataFlag =....ubin(#bin,39,1);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("DestinationIndicator", DestinationIndicator);.. map("BinaryDataFlag", BinaryDataFlag);.... ...if (DestinationIndicator == 0) {....if (BinaryDataFlag == 0) {.....BinaryData =......strHex(#bin,40,108);.....BinaryDataAddedBy2ndSl

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_message27.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1159
Entropy (8bit):	5.205717296330583
Encrypted:	false
SSDEEP:	24:KM8XoGnkD+3v+8mu+YOHZJLNKicOsxK4YbgLaaRDTX2zEk0i:Ko8MHZvHcDxK4Y0+STX2zEk0i
MD5:	85DF7DEED13B2E2A4376B2AD6C131B1D
SHA1:	6B36A48779C01658AF8E240EE1F32D8BB3594D39
SHA-256:	C68B981D53C834ABA1C3C8E6AD379259B2994B3C1E40B0CA972F4307B0336185
SHA-512:	0EC16B8DC7B16F44E2A62EE464313CBB02956C6F67485B70322BE6B05C5C71C8A7944906F7B74BBC3C5F5457B07DC808BC78030D85BF251AD2D46556F2A5D7D5
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var PositionAccuracy;..var RAIM_flag;..var NavigationalStatus;..var Longitude;..var Latitude;..var SOG;..var COG;..var StatusOfCurrentGNSSPosition;..var Spare;......MessageId = ubin(#bin,0,6);..if (MessageId == 27){...RepeatIndicator =....ubin(#bin,6,2);...UserID =......ubin(#bin,8,30);...PositionAccuracy = ....ubin(#bin,38,1);...RAIM_flag = .....ubin(#bin,39,1);...NavigationalStatus = ...ubin(#bin,40,4);...Longitude = .....bin(#bin,44,18);...Latitude = ......bin(#bin,62,17);...SOG = .......ubin(#bin,79,6);...COG = .......ubin(#bin,85,9);...StatusOfCurrentGNSSPosition = .ubin(#bin,94,1);.. Spare =.......ubin(#bin,95,1);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("UserID", UserID);.. map("PositionAccuracy", PositionAccuracy);.. map("RAIM_flag", RAIM_flag);.. map("NavigationalStatus", NavigationalStatus);.. map("Longitude", Longitude);.. map("Latitud

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table15.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3805
Entropy (8bit):	4.6112502300957185
Encrypted:	false
SSDEEP:	96:KTWfTcP0xdBIx16c44+8EYSTX0kxuw8c0MxdXBmNvcP0xdBIxbVxc44+8EYSTX02:o6n2xIc44+8EYSTX0kUw8c0MxdAd2xTl
MD5:	08A27D7DAB316E88B8983F53967B5341
SHA1:	2A4F12A483E5E96A8E8A067BCF4D49F566EEB9A5
SHA-256:	C98467BC48919E9808BF3F70DA3187CF5D91D3B63012ADCCDFC7EDBD4FB5E246
SHA-512:	20202D926A44AE7B0C64ACEF17A195C9D3FE211822E0A47E41BAB3241667D9B34DBA35231F403D12D6C821AEF7E4A5AE4D2606A09DD6B5A47CF94B1FF2716AE5
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var NavigationalStatus;..var RateOfTurn;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var SpecialManoeuvreIndicator;..var Spare;..var RAIM_flag;..var SyncState;....var SlotTime_Out;..var SubMessage;....var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);..if (MessageId == 1 \|\|.. MessageId == 2){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. NavigationalStatus = ubin(#bin,38,4);.. RateOfTurn = bin(#bin,42,8);.. SOG = ubin(#bin,50,10);.. PositionAccuracy = ubin(#bin,60,1);.. Longitude = bin(#bin,61,28);.. Latitude = bin(#bin,89,27);.. COG = ubin(#bin,116,12);.. TrueHeading =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table16.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2270
Entropy (8bit):	4.809327791805813
Encrypted:	false
SSDEEP:	48:Kfo/v+2LZlUSYjt0hJ2cuyopDfkvLcDxK4s8ikMp2MB9hiYSTX2z5ihTxs28s2By:ttLZlUl0h4cux16c44s8ikMp2MbgYSTL
MD5:	8D8B7DFA75A9CB9532D13D4C1AE1704F
SHA1:	A50076A9017CA67951293FA30260A9CED748D6DD
SHA-256:	78958DA440A256FFAAC5B87B1A54001CB471CA08F1E96A923E22011C6F7B63B7
SHA-512:	EDD0D8CD3019990877C36FB8A2FBC8430586B582E52A0DE94AB7EE368DEE57AFC3094CB2CF27D9FDBB83ADBD0D81AF0DE4CF2F1DF5520EEC89FC6F4FA38D2C09
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var UTCYear;..var UTCMonth;..var UTCDay;..var UTCHour;..var UTCMinute;..var UTCSecond;..var PositionAccuracy;..var Longitude;..var Latitude;..var TypeOfElectronicPositionFixingDevice;..var TransmissionControlForLongrangeBroadcastMessage;..var Spare;..var RAIM_flag;..var SyncState;..var SlotTime_Out;..var SubMessage;....MessageId = ubin(#bin,0,6);..if (MessageId == 4 \|\|.. MessageId == 11){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. UTCYear = ubin(#bin,38,14);.. UTCMonth = ubin(#bin,52,4);.. UTCDay = ubin(#bin,56,5);.. UTCHour = ubin(#bin,61,5);.. UTCMinute = ubin(#bin,66,6);.. UTCSecond = ubin(#bin,72,6);.. PositionAccuracy = ubin(#bin,78,1);.. Longitude =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table17.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1838
Entropy (8bit):	4.853931101960552
Encrypted:	false
SSDEEP:	48:KYIJPSYIIFRNWcDxK4c+F/TGyfkM5ihTE34JNoYi:fI9PzEc44c+F/yyfkM5ihTEoMYi
MD5:	292243A99DBFEA030E07AC41B06EAA3B
SHA1:	0593054762979355BB5E9C7045F159B450476C56
SHA-256:	45ED8601C3580033614AA92B7CAA4A6DEB8FADFB1C9BCCC37AB469AA991C8019
SHA-512:	B2AC1F95B52AA509CE3428E4B1BF85FA410997DB20C850F8DA5790C9606F9E347A16A2A3975ACE559EC57424A3FBF38343746995316F2574A0DF89C52F3AB8FB
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var AISVersionIndicator;..var IMONumber;..var CallSign;..var Name;..var TypeOfShipAndCargoType;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var ETA;..var MaximumPresentStaticDraught;..var Destination;..var DTE;..var Spare;....MessageId = ubin(#bin,0,6);..if (MessageId == 5){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. AISVersionIndicator = ubin(#bin,38,2);.. IMONumber = ubin(#bin,40,30);.. CallSign = str(#bin,70,42);.. Name = str(#bin,112,120);.. TypeOfShipAndCargoType = ubin(#bin,232,8);.. Dimension_ReferenceForPosition = ubin(#bin,240,30);.. TypeOfElectronicPositionFixingDevice = ubin(#bin,270,4);.. ETA = ubin(#bin,274,20);.. MaximumPresentStaticDraught = ubin(#bin

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table19.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	4.7362638022136645
Encrypted:	false
SSDEEP:	24:KMiHrGpW+5HAGm516G/dBS6z4NWr5I6NQcOsxKkLvaF/JQ3acIDYT/WV6x6aF/3y:K7LQHf+S6z4Er5dOcDxKkLvaF/JQ3acA
MD5:	A4AC9A0128F2B41237A8E46BC91ACD30
SHA1:	3E711BFE84B4FCD9E43F9341B87D1E33F32905A6
SHA-256:	86CA1226C781E7F196880151F31E06470F5DE2BF2B2D99E6CCDA10C213D65E7C
SHA-512:	B6F9E79DEC0A45112D9C558CF4ED9146802D4FF88A59FFE7375449111FE261696A5E99B3ED9FA24E89B34663ECC6EEDB1553F8030B5ED6055EF5E69452386838
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var SequenceNumber;..var DestinationID;..var RetransmitFlag;..var Spare;..var DAC;..var FunctionIdentifier;..var AcknowledgedRequiredFlag;..var TextSequenceNumber;..var ApplicationData;....MessageId = ubin(#bin,0,6);..if (MessageId == 6 ){.. RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. SequenceNumber = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. RetransmitFlag = ubin(#bin,70,1);.. Spare = ubin(#bin,71,1);.. DAC = ubin(#bin,72,10);.. FunctionIdentifier = ubin(#bin,82,6);.. AcknowledgedRequiredFlag = ubin(#bin,88,1);.. TextSequenceNumber = ubin(#bin,89,11);.. ApplicationData = str(#bin,100,906);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndic

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table21.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1515
Entropy (8bit):	4.7011664865538645
Encrypted:	false
SSDEEP:	24:KMiHHpyVrZVpVrGzpyrRpLr5CBS6DSW2jKktI+xXgLfcOsxKkcJ/qLo7JyRLnYJx:K7pq1RIgDfkS6Dl2jdtI+xXgLfcDxKk6
MD5:	9F24D79BA524A0B7D161E4B41D5120AB
SHA1:	05BAE64B9FBBD4B302C80C71E88E01DE5DF32450
SHA-256:	E359725B51E29462D44C5C254EAD20ACD896975313B983BE473B6952C240AF5D
SHA-512:	CA6C2F517FDD16236FFCD4BC03696C1FCE863928F08F611FA0FF53BADD0BE3CAD810117AE1970590C881C454B9F5B710E3F69F62E4E2BA0E0973C85EC1EA16EB
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var DestinationID1;..var SequenceNumberForID1;..var DestinationID2;..var SequenceNumberForID2;..var DestinationID3;..var SequenceNumberForID3;..var DestinationID4;..var SequenceNumberForID4;....MessageId = ubin(#bin,0,6);..if (MessageId == 7 \|\|.. MessageId == 13){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. DestinationID1 = ubin(#bin,40,30);.. SequenceNumberForID1 = ubin(#bin,70,2);.. DestinationID2 = ubin(#bin,72,30);.. SequenceNumberForID2 = ubin(#bin,102,2);.. DestinationID3 = ubin(#bin,104,30);.. SequenceNumberForID3 = ubin(#bin,134,2);.. DestinationID4 = ubin(#bin,136,30);.. SequenceNumberForID4 = ubin(#bin,166,2);.... map("MessageId", Messa

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table22.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	4.7592453854016386
Encrypted:	false
SSDEEP:	24:KMiHHAGm516G/IS64MyWMe6ncOsxKkcIDYT/WV6x6aF/3y:K7NflS6zyWqncDxKkcIDk/W4EaF/3y
MD5:	E77346A17E0060A09283AF49EED157F1
SHA1:	C4E46B68D2AE3DA48C8E0B7CFF4DEA81B155ECAE
SHA-256:	03D2FA8A2DDAAA84A77F6B0663F4E3363A0C46A72BD2D9A5B62B7EA3FD231797
SHA-512:	C584376BF07508813754C6D5ED59BDE4E31850C5A64D6F20CAC2D7D6440FC3FF417D1CE1EFDF9A37A8AD76368488ABFEE3015BE91E5CFE27D3DEF4977907ABCD
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var DAC;..var FunctionIdentifier;..var AcknowledgedRequiredFlag;..var TextSequenceNumber;..var ApplicationData;....MessageId = ubin(#bin,0,6);..if (MessageId == 8 ){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. DAC = ubin(#bin,40,10);.. FunctionIdentifier = ubin(#bin,50,6); .. AcknowledgedRequiredFlag = ubin(#bin,56,1);.. TextSequenceNumber = ubin(#bin,57,11);.. ApplicationData = str(#bin,68,936);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare", Spare);.. map("DAC", DAC);.. map("FunctionIdentifier", FunctionIdentifier);.. map("AcknowledgedRequiredFlag", AcknowledgedRequiredFlag);.. map("TextSequen

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table23.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	4.630482052007689
Encrypted:	false
SSDEEP:	48:KEAxbZXSYMtdBhRDttcDxK4YEYSTX2zkwuJYu0O0fyoUvyMxtXBmNSFTyoUSi6MW:AxbZXudBhRDttc44YEYSTX0kwuJYu0OT
MD5:	5FA0B3A565F825CFFD9BF4B61893276E
SHA1:	BF4B382123A2741DDC8448752161DC3E75104FE7
SHA-256:	FB541F6EE8B8AF9A5377180209FCE05896C29E6E5E8A2A7EA518F7753C1E7CB7
SHA-512:	CCD6C0B6C05E48AC580B323BFF6DD2A89D877FCA0C76F24711500337AB6FDE7F0A8C2CC4F128C12458BD53F29D3E011A944AA1F95379CB40C3B0803DE2E4D094
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var Altitude_GNSS;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TimeStamp;..var AltitudeSensor;..var Spare;..var DTE;..var AssignedModeFlag;..var RAIM_flag;..var CommunicationStateSelectorFlag;..var SyncState;..var SlotTime_Out;..var SubMessage;..var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);..if (MessageId == 9){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. Altitude_GNSS = ubin(#bin,38,12);.. SOG = ubin(#bin,50,10);.. PositionAccuracy = ubin(#bin,60,1);.. Longitude = bin(#bin,61,28);.. Latitude = bin(#bin,89,27);.. COG = ubin(#bin,116,12);.. TimeStamp = ubin(#bin,128,6);.. AltitudeSensor =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table24.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	668
Entropy (8bit):	4.494391176923802
Encrypted:	false
SSDEEP:	12:TU31xMiHUpW+SAuSsPzcV5NWJP1cX+sx8/k1iJW51JBKV:KMiHUpW+SfS6c7NWJP1cOsxKkgJQ3BKV
MD5:	827E3F4AD5498C8C386643B83BE84FD9
SHA1:	169859EE10901AFE16690E3307BEE8FAD34C2BB4
SHA-256:	6914BAA4D6DBC7FF753C395D37256BFEB0155056008BD3AE77AC5E5262ABE670
SHA-512:	348376F8A1A5BD30F365C094AB5807AA2D4384391EFE8DF5F5B6B8ACB5EBAE31EFB77A4DFA3577B4E66044802E1DB804538DE664A099FCFD1ADEBF156F346221
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationID;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 10){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. Spare2 = ubin(#bin,70,2);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare1", Spare1);.. map("DestinationID", DestinationID);.. map("Spare2", Spare2);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table25.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.675230373795883
Encrypted:	false
SSDEEP:	24:KMiHrGpW+5HX9S6z4NWrvScOsxKkLvaF/JQ3acDz3i:K7LQd9S6z4ErvScDxKkLvaF/JQ3acDzy
MD5:	0ECC8274AE502CC175012918C9E074DD
SHA1:	E608C6ED9C1213720646F8B8D609E2C3E28E3FFE
SHA-256:	1E9364FF1692E6E964E8E5C4DF5287450A103D73673DF533FCEAC3FD0F626AC9
SHA-512:	D59C6FE37A8ACE1F89D34795F682AB164B8E82736C09826B2D7CACDEECB784FCA306D00F8CA4A985F6261CCE89188D53A9EADB260524F9E453D4BC56A3F3F2D0
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var SequenceNumber;..var DestinationID;..var RetransmitFlag;..var Spare;..var SafetyRelatedText;....MessageId = ubin(#bin,0,6);..if (MessageId == 12){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. SequenceNumber = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. RetransmitFlag = ubin(#bin,70,1);.. Spare = ubin(#bin,71,1);.. SafetyRelatedText = str(#bin,72,936);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("SequenceNumber", SequenceNumber);.. map("DestinationID", DestinationID);.. map("RetransmitFlag", RetransmitFlag);.. map("Spare", Spare);.. map("SafetyRelatedText", SafetyRelatedText);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table26.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.649836405273726
Encrypted:	false
SSDEEP:	12:TU31xMiHu+yEFpSsPzsEbKcX+sx8/kcDDaESEM9:KMiHHXFpS6lbKcOsxKkcDz3i
MD5:	876F56F0ADEB0AE293A3ACEA76BFF33C
SHA1:	5C7C99F1107070DC424E187F6EACB025AAA51106
SHA-256:	A74B508C93E6EEECFB3104DCCB6D7E886400D7670A6389C9E6E5D60C4EFCDA3B
SHA-512:	E7DEFACF18B36F948F3BAFBDC8FC732E080076460B0EEAE67536C25D73E4FA88388A0414FC3799A799653EFEBA9EA6473800355CD49E3847C0BC5F209D2B5F98
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var SafetyRelatedText;....MessageId = ubin(#bin,0,6);..if (MessageId == 14){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. SafetyRelatedText = str(#bin,40,966);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare", Spare);.. map("SafetyRelatedText", SafetyRelatedText);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table27.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	4.58269262036734
Encrypted:	false
SSDEEP:	48:K7GuSPGS6c7lh9YtVBcDxKkgJ/q2kBKJkEcJyR80/g:WXBc4kgc2kMJkEcy80/g
MD5:	55730594AEB619252754C447E5E8010C
SHA1:	4974469F00CB2F2AA9ACE609C50F10649641B423
SHA-256:	BDE724937067176B94557BA1AB9F09AB72191B5F9C9363A908EB61A33FBA46F8
SHA-512:	86BECC2379323115BE82E0C0F143ABF01861386B0700E7A90357EB52A8560640593BCFC80BD77C22753FC4B6836503936151F317E0DCF6474EFBDE9A2DB92869
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationID1;..var MessageID1_1;..var SlotOffset1_1;..var Spare2;..var MessageID1_2;..var SlotOffset1_2;..var Spare3;..var DestinationID2;..var MessageID2_1;..var SlotOffset2_1;..var Spare4;....MessageId = ubin(#bin,0,6);..if (MessageId == 15){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationID1 = ubin(#bin,40,30);.. MessageID1_1 = ubin(#bin,70,6);.. SlotOffset1_1 = ubin(#bin,76,12);.. Spare2 = ubin(#bin,88,2);.. MessageID1_2 = ubin(#bin,90,6);.. SlotOffset1_2 = ubin(#bin,96,12);.. Spare3 = ubin(#bin,108,2);.. DestinationID2 = ubin(#bin,110,30);.. MessageID2_1 = ubin(#bin,

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table28.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	4.49708436189082
Encrypted:	false
SSDEEP:	24:KMiHUpcyOpS6067SFS6c7CWn5k8C/cOsxKkgJvasQFJiBgeBKV:K7Gm+pFS6c7Vn5TC/cDxKkgJvasQFJi0
MD5:	5F3D4F2F8CF723893A1B9BE92757CFC5
SHA1:	4DFBF5B54084E052626503968E59D278E01E7100
SHA-256:	9E03AA69D2566E355E1E94EB1AE323CBDB2C35C5DAC9F60D55EC4AC2CE4338CD
SHA-512:	EA699C1A8AFAB06A2145706A97B5DAF81AEEF16658AF2716D1569CDBDEE0D75F1B7E87C4DB8B2CDA8C21318E4D14205C9A7822CCCE26B7E45DF4658C1A2442B8
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationIDA;..var OffsetA;..var IncrementA;..var DestinationIDB;..var OffsetB;..var IncrementB;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 16){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationIDA = ubin(#bin,40,30);.. OffsetA = ubin(#bin,70,12);.. IncrementA = ubin(#bin,82,10);.. DestinationIDB = ubin(#bin,92,30);.. OffsetB = ubin(#bin,122,12);.. IncrementB = ubin(#bin,134,10);.. Spare2 = ubin(#bin,144,4);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare1", Spare1);.. map("DestinationIDA", DestinationI

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table29.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4969
Entropy (8bit):	4.621697866558589
Encrypted:	false
SSDEEP:	96:mdhXTQRgAbc4kgSTX0MJ4cGJLvaF/sVucik2kqc2cPE4TQQcgcIMoQcEQ/okswgS:m4aYc4kgSTX0i4cGJLvaJswcik2kqc2y
MD5:	6C551F89800A1B5F2818FEB92BAD1129
SHA1:	D446EA1576FF981951CFA621F13673B5CEFEB8A0
SHA-256:	4F790FC6E2E3FB08EFA4728A871232D6A4BF6B685616E80BE2602A880EDDECDD
SHA-512:	20C8659577692821FC0F321A145BB056FFC12E73D2FFE306FC7235EBFA1FC0B1D53B0362B0BABCB6BEE4D92A162BDED006AC81B7D25DEC27E0EBBE423BDB0505
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var Longitude;..var Latitude;..var Spare2;..var MessageType;..var StationID;..var ZCount;..var SequenceNumber;..var N;..var Health;..var DGNSSDataWord1;..var DGNSSDataWord2;..var DGNSSDataWord3;..var DGNSSDataWord4;..var DGNSSDataWord5;..var DGNSSDataWord6;..var DGNSSDataWord7;..var DGNSSDataWord8;..var DGNSSDataWord9;..var DGNSSDataWord10;..var DGNSSDataWord11;..var DGNSSDataWord12;..var DGNSSDataWord13;..var DGNSSDataWord14;..var DGNSSDataWord15;..var DGNSSDataWord16;..var DGNSSDataWord17;..var DGNSSDataWord18;..var DGNSSDataWord19;..var DGNSSDataWord20;..var DGNSSDataWord21;..var DGNSSDataWord22;..var DGNSSDataWord23;..var DGNSSDataWord24;..var DGNSSDataWord25;..var DGNSSDataWord26;..var DGNSSDataWord27;..var DGNSSDataWord28;..var DGNSSDataWord29;....MessageId = ubin(#bin,0,6);..if (MessageId == 17){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ub

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table31.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5586
Entropy (8bit):	4.639872418726296
Encrypted:	false
SSDEEP:	96:G82eWJa8sIwyrJxla8YYXcvk4SDXUExuQdcvUmG8sOtUMMxtXBmNE8sIwyrJxr4o:GFepnyrJxY8YYXcvk4SDXUE0QdcvUmGS
MD5:	F86CB804C7E51DEAFA614D07A5B5F71B
SHA1:	98D7346554402971F6C34BD0B38D0CEF3439304F
SHA-256:	6D80DD72D8D50974DFF95CBC0F41E39F4069B68AC6B6F91D7C1523CBF8510F22
SHA-512:	4DBE448D29357F6AD2BEBCDD3FF8CE543362940776A022A87C2A75F2D243065055EBA9F5DED5D54870E574CE80BC437E71C7C8648D6A453FC0CB8774C236D312
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var ReservedForRegionalOrLocalApplications;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var ReservedForRegionalApplications;..var ClassB_UnitFlag;..var ClassB_DisplayFlag;..var ClassB_DSCFlag;..var ClassB_BandFlag;..var ClassB_Message22Flag;..var ModeFlag;..var RAIM_flag;..var CommunicationStateSelectorFlag;..var SyncState;....var SlotTime_Out;..var SubMessage;....var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);....if (MessageId == 18){.. CommunicationStateSelectorFlag = ubin(#bin,148,1);.. if (CommunicationStateSelectorFlag == 0){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. ReservedForRegionalOrLocalApplications = ubin(#bin,38,8);.. SOG = ubin(#bin,46,10);.. PositionAccuracy =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table32.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2373
Entropy (8bit):	4.890519075109663
Encrypted:	false
SSDEEP:	48:Ky0TA26InQSY4t0f0sIVxmyZVjsNcDxK4I0/0/EYSTX2zkxQBwdc/yfkM5ihT0YM:G826InQsqMsoxmyZVANc44Xc/EYSTX00
MD5:	6F3A69729D46573B6CA788F3A10890F8
SHA1:	089BBBEAC94FC5CA31367F119098CA977E399744
SHA-256:	7F471E0C9262FF6DF6D4A85662DD215E0C04445ACC628D993048F2394BF78372
SHA-512:	C9D62AFFAA8A80DB41AC4AEF56A300A4355EBAE5EBCD1B68E7FF17296BDF2FEAAE9C51299A5F04972745958AB63316D14E22B93110FE9BED4D3C3ABA541A6393
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var ReservedForRegionalOrLocalApplications;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var ReservedForRegionalApplications;..var Name;..var TypeOfShipAndCargoType;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var RAIM_flag;..var DTE;..var AssignedModeFlag;....MessageId = ubin(#bin,0,6);..if (MessageId == 19){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. ReservedForRegionalOrLocalApplications = ubin(#bin,38,8);.. SOG = ubin(#bin,46,10);.. PositionAccuracy = ubin(#bin,56,1);.. Longitude = bin(#bin,57,28);.. Latitude = bin(#bin,85,27);.. COG = ubin(#bin,112,12);.. TrueHeading = ubin(#bin,124,9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table33.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	4.594361313478769
Encrypted:	false
SSDEEP:	48:K7yTG4T0eS6cnBRn9ovG+64bcDxKcgAclek8Zk4H1+40ro0cKiHSBKV:RTrTruBfMG+Rc4cgAclek8Zk4H1+40r4
MD5:	353090A0521C1AAA648A3DDA352D504A
SHA1:	A1F9BBCD78D412E408D47BEF437CCFACDD39AA20
SHA-256:	2A7A59E3FE0648CE922C4482CA20FF6EEFC30025C0A98FE3527C28481368CBED
SHA-512:	9172EACC3DFA5E6CDE4CD1F37F2EEF453468723BC063A13D1FA9A54B504BE68BE4B493583548B6947746E8630E65DD896789B37E3A8B9F7BDE30AAB18BDA47C9
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceStationID;..var Spare1;..var OffsetNumber1;..var NumberOfSlots1;..var Time_Out1;..var Increment1;..var OffsetNumber2;..var NumberOfSlots2;..var Time_Out2;..var Increment2;..var OffsetNumber3;..var NumberOfSlots3;..var Time_Out3;..var Increment3;..var OffsetNumber4;..var NumberOfSlots4;..var Time_Out4;..var Increment4;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 20){.... RepeatIndicator = ubin(#bin,6,2);.. SourceStationID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. OffsetNumber1 = ubin(#bin,40,12);.. NumberOfSlots1 = ubin(#bin,52,4);.. Time_Out1 = ubin(#bin,56,3);.. Increment1 = ubin(#bin,59,11);.. OffsetNumber2 = ubin(#bin,70,12);.. NumberOfSlots2 = ubin(#bin,82,4);.. Time_Out2 = ubin(

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table34.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	4.963806832412181
Encrypted:	false
SSDEEP:	48:Kbl8K0/iBSBrJ52aOt0+uKTcDxKKa4+XgYSTX2zM5ihTwrYI0/0/0Tgu0Oa:ZJ/iB+J52aOq+uKTc4Ka4+XgYSTX0M5n
MD5:	A4301C435AB0957C052AEBC900E5EDA7
SHA1:	9222D178AFD897173586D87393E28CBDF683678D
SHA-256:	838BFD687CDFF728A4115EEA3DD320AD79487979D91B8F9B6B040C46E0D6F562
SHA-512:	3C85E1EF1715F97714A03B984366DF4E6C2393814CE4B81E7CF207BB5395B11266E0A4AF7691DDDB7AD1726403D21D21CC37E9640C7004F67523B0683687F4CC
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var ID;..var TypeOfAids_To_Navigation;..var NameOfAids_To_Navigation;..var PositionAccuracy;..var Longitude;..var Latitude;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var TimeStamp;..var Off_PositionIndicator;..var ReservedForRegionalOrLocalApplications;..var RAIM_flag;..var Virtual_AtoN_flag;..var AssignedModeFlag;..var NameOfAidToNavigationExtension;..var Spare;....MessageId = ubin(#bin,0,6);..if (MessageId == 21){.... RepeatIndicator = ubin(#bin,6,2);.. ID = ubin(#bin,8,30);.. TypeOfAids_To_Navigation = ubin(#bin,38,5);.. NameOfAids_To_Navigation = str(#bin,43,120);.. PositionAccuracy = ubin(#bin,163,1);.. Longitude = bin(#bin,164,28);.. Latitude = bin(#bin,192,27);.. Dimension_ReferenceForPosition = ubin(#bin,219,30);.. TypeOfElectronicPositionFixi

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDO_table35.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1979
Entropy (8bit):	4.695298593428696
Encrypted:	false
SSDEEP:	48:Kc4+w7qr8QSZcZzoEiFRHcDxKcgPINP2R+a/tAJX2JJI1X23ae4P74PP4xQBKV:LQqRdzoEiFtc4cgANeR+a/tAJX6JI1XZ
MD5:	7ADC81684CE93D9EA5098B5764555AB3
SHA1:	9958A4832FB1C281EA3D5D283D1F679A3C76D27E
SHA-256:	9DF448B3006705A04D8A35A95B958EFC817BDCFF20D963BB660E63565E621BEC
SHA-512:	60126FD888AC9B57601383D72B623EE00868C3BBE8355D4F5376760FA82155654A1FFDC56D6A968AA62DD6F1AD64A45F5D69EAA1EFD716240A5B4A0F3EB92C27
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var StationID;..var Spare1;..var ChannelA;..var ChannelB;..var Tx_RxMode;..var Power;..var Longitude1;..var Latitude1;..var Longitude2;..var Latitude2;..var AddressedOrBroadcastMessageIndicator;..var ChannelABandwidth;..var ChannelBBandwidth;..var TransitionalZoneSize;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 22){.... RepeatIndicator = ubin(#bin,6,2);.. StationID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. ChannelA = ubin(#bin,40,12);.. ChannelB = ubin(#bin,52,12);.. Tx_RxMode = ubin(#bin,64,4);.. Power = ubin(#bin,68,1);.. Longitude1 = bin(#bin,69,18);.. Latitude1 = bin(#bin,87,17);.. Longitude2 = bin(#bin,104,18);.. Latitude2 = bin(#bin,1

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\decoder.map (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	4.3315941590307405
Encrypted:	false
SSDEEP:	24:CGF/ESfZ21C/zAGEuXlO7ydvG2pfrFBL578tIFoNS:CGF/ESfc1C/zAGEuXlO7ydvG2pf5BL5R
MD5:	65A5197B2A22BCB71A67C509DB96A955
SHA1:	A0BC652D915EE6447BF6CD00414DA7A7A87B2A72
SHA-256:	C853BC916807319BA9CE1759594B0BE7BC5BCF0939913E08E397598DDBB70086
SHA-512:	D7977BB15486FBD52044655AD24625F7DFC1A693D381A5072E34CBE6D65E8D26CF7707BD145F2C403CBCA5B430B6C6A0F0F5C2BB84C8C5612EDAFCD6E7104B0B
Malicious:	false
Preview:	#####################################################..0,0:0:0\|VDM_table15..0,0:0:0\|VDM_table16..0,0:0:0\|VDM_table17..0,0:0:0\|VDM_table19..0,0:0:0\|VDM_table21..0,0:0:0\|VDM_table22..0,0:0:0\|VDM_table23..0,0:0:0\|VDM_table24..0,0:0:0\|VDM_table25..0,0:0:0\|VDM_table26..0,0:0:0\|VDM_table27..0,0:0:0\|VDM_table28..0,0:0:0\|VDM_table29..0,0:0:0\|VDM_table31..0,0:0:0\|VDM_table32..0,0:0:0\|VDM_table33..0,0:0:0\|VDM_table34..0,0:0:0\|VDM_table35..0,0:0:0\|VDM_message23..0,0:0:0\|VDM_message24ab..0,0:0:0\|VDM_message25..0,0:0:0\|VDM_message26..0,0:0:0\|VDM_message27..0,0:0:0\|VDO_table15..0,0:0:0\|VDO_table16..0,0:0:0\|VDO_table17..0,0:0:0\|VDO_table19..0,0:0:0\|VDO_table21..0,0:0:0\|VDO_table22..0,0:0:0\|VDO_table23..0,0:0:0\|VDO_table24..0,0:0:0\|VDO_table25..0,0:0:0\|VDO_table26..0,0:0:0\|VDO_table27..0,0:0:0\|VDO_table28..0,0:0:0\|VDO_table29..0,0:0:0\|VDO_table31..0,0:0:0\|VDO_table32..0,0:0:0\|VDO_table33..0,0:0:0\|VDO_table34..0,0:0:0\|VDO_table35..0,0:0:0\|VDO_message23..0,0:0:0\|VDO_message24ab..0,0:0:0\|VDO_message25..0

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-0TT6K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	4.49708436189082
Encrypted:	false
SSDEEP:	24:KMiHUpcyOpS6067SFS6c7CWn5k8C/cOsxKkgJvasQFJiBgeBKV:K7Gm+pFS6c7Vn5TC/cDxKkgJvasQFJi0
MD5:	5F3D4F2F8CF723893A1B9BE92757CFC5
SHA1:	4DFBF5B54084E052626503968E59D278E01E7100
SHA-256:	9E03AA69D2566E355E1E94EB1AE323CBDB2C35C5DAC9F60D55EC4AC2CE4338CD
SHA-512:	EA699C1A8AFAB06A2145706A97B5DAF81AEEF16658AF2716D1569CDBDEE0D75F1B7E87C4DB8B2CDA8C21318E4D14205C9A7822CCCE26B7E45DF4658C1A2442B8
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationIDA;..var OffsetA;..var IncrementA;..var DestinationIDB;..var OffsetB;..var IncrementB;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 16){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationIDA = ubin(#bin,40,30);.. OffsetA = ubin(#bin,70,12);.. IncrementA = ubin(#bin,82,10);.. DestinationIDB = ubin(#bin,92,30);.. OffsetB = ubin(#bin,122,12);.. IncrementB = ubin(#bin,134,10);.. Spare2 = ubin(#bin,144,4);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare1", Spare1);.. map("DestinationIDA", DestinationI

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-1EIPD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1515
Entropy (8bit):	4.7011664865538645
Encrypted:	false
SSDEEP:	24:KMiHHpyVrZVpVrGzpyrRpLr5CBS6DSW2jKktI+xXgLfcOsxKkcJ/qLo7JyRLnYJx:K7pq1RIgDfkS6Dl2jdtI+xXgLfcDxKk6
MD5:	9F24D79BA524A0B7D161E4B41D5120AB
SHA1:	05BAE64B9FBBD4B302C80C71E88E01DE5DF32450
SHA-256:	E359725B51E29462D44C5C254EAD20ACD896975313B983BE473B6952C240AF5D
SHA-512:	CA6C2F517FDD16236FFCD4BC03696C1FCE863928F08F611FA0FF53BADD0BE3CAD810117AE1970590C881C454B9F5B710E3F69F62E4E2BA0E0973C85EC1EA16EB
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var DestinationID1;..var SequenceNumberForID1;..var DestinationID2;..var SequenceNumberForID2;..var DestinationID3;..var SequenceNumberForID3;..var DestinationID4;..var SequenceNumberForID4;....MessageId = ubin(#bin,0,6);..if (MessageId == 7 \|\|.. MessageId == 13){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. DestinationID1 = ubin(#bin,40,30);.. SequenceNumberForID1 = ubin(#bin,70,2);.. DestinationID2 = ubin(#bin,72,30);.. SequenceNumberForID2 = ubin(#bin,102,2);.. DestinationID3 = ubin(#bin,104,30);.. SequenceNumberForID3 = ubin(#bin,134,2);.. DestinationID4 = ubin(#bin,136,30);.. SequenceNumberForID4 = ubin(#bin,166,2);.... map("MessageId", Messa

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-1SQ44.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	4.964166837499702
Encrypted:	false
SSDEEP:	48:gbl8K0/iBSBrJ52aOt0+uKTcDxKKa4+XgYSTX2zM5ihTwrYI0/0/0Tgu0Oa:nJ/iB+J52aOq+uKTc4Ka4+XgYSTX0M5n
MD5:	72BFCDBC7EA7B24D02FDA64464E0002F
SHA1:	2FA21ABA2D8B137F63E0AC2048E4AB780370A3CF
SHA-256:	AA8690C692294B7B1AC7328FE556185DB3916FD14D9ECCB63ADB1565DF7E6041
SHA-512:	8A5E63A1D49FCE018DF4B70CC83F4AFEAA2110B6EBEF2723C564E0FD860740422258C6AAAB0913388B624F617B57867C0BD45A5D3A0806E07B7A101AB69E598B
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var ID;..var TypeOfAids_To_Navigation;..var NameOfAids_To_Navigation;..var PositionAccuracy;..var Longitude;..var Latitude;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var TimeStamp;..var Off_PositionIndicator;..var ReservedForRegionalOrLocalApplications;..var RAIM_flag;..var Virtual_AtoN_flag;..var AssignedModeFlag;..var NameOfAidToNavigationExtension;..var Spare;....MessageId = ubin(#bin,0,6);..if (MessageId == 21){.... RepeatIndicator = ubin(#bin,6,2);.. ID = ubin(#bin,8,30);.. TypeOfAids_To_Navigation = ubin(#bin,38,5);.. NameOfAids_To_Navigation = str(#bin,43,120);.. PositionAccuracy = ubin(#bin,163,1);.. Longitude = bin(#bin,164,28);.. Latitude = bin(#bin,192,27);.. Dimension_ReferenceForPosition = ubin(#bin,219,30);.. TypeOfElectronicPositionFixi

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-2DEHI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1942
Entropy (8bit):	4.9467532755605905
Encrypted:	false
SSDEEP:	48:K7J1Rh2Nz4ODxUWJ6fCVrODxUWJ6fuoLJlODxUWJ6fgJQ/VMODxUWJ6fgJQq:l4OaWQ2rOaWQ1lOaWQgEMOaWQgD
MD5:	59EEDB441F4DDFC98A78681D93E8ECD9
SHA1:	9CE970EBE9D0D878DCC6DD0315551722C5C1C039
SHA-256:	C8044BDA04233DCAAC2B40A4371D3AC61229123430ACBABEE1BBECE53DEA4A76
SHA-512:	974B96352B853B7A34BE5A618ED25B3FCDA8CDF6B24DB15C1CFE4EBC49F65DC4DAE1C20C3EB56D90757C9C6F0E8494305D919E763D5ADB1BF421FB5EC3AC7F20
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var DestinationIndicator;..var BinaryDataFlag;..var DestinationID;..var BinaryData;......MessageId = ubin(#bin,0,6);..if (MessageId == 25){.....RepeatIndicator =....ubin(#bin,6,2);...SourceID =......ubin(#bin,8,30);...DestinationIndicator =...ubin(#bin,38,1);...BinaryDataFlag =....ubin(#bin,39,1);.....if (DestinationIndicator == 0) {....if (BinaryDataFlag == 0) {.....BinaryData =....strHex(#bin,40,128);...... map("MessageId", MessageId);.... map("RepeatIndicator", RepeatIndicator);.... map("SourceID", SourceID);.... map("DestinationIndicator", DestinationIndicator);.... map("BinaryDataFlag", BinaryDataFlag);.....map("BinaryData", BinaryData);....}....else if (BinaryDataFlag == 1) {.....BinaryData =....strHex(#bin,40,112);...... map("MessageId", MessageId);.... map("RepeatIndicator", RepeatIndicator);.... map("SourceID", SourceID);.... map("DestinationIndicator", DestinationIndicator);

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-3C1VA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	4.594361313478769
Encrypted:	false
SSDEEP:	48:K7yTG4T0eS6cnBRn9ovG+64bcDxKcgAclek8Zk4H1+40ro0cKiHSBKV:RTrTruBfMG+Rc4cgAclek8Zk4H1+40r4
MD5:	353090A0521C1AAA648A3DDA352D504A
SHA1:	A1F9BBCD78D412E408D47BEF437CCFACDD39AA20
SHA-256:	2A7A59E3FE0648CE922C4482CA20FF6EEFC30025C0A98FE3527C28481368CBED
SHA-512:	9172EACC3DFA5E6CDE4CD1F37F2EEF453468723BC063A13D1FA9A54B504BE68BE4B493583548B6947746E8630E65DD896789B37E3A8B9F7BDE30AAB18BDA47C9
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceStationID;..var Spare1;..var OffsetNumber1;..var NumberOfSlots1;..var Time_Out1;..var Increment1;..var OffsetNumber2;..var NumberOfSlots2;..var Time_Out2;..var Increment2;..var OffsetNumber3;..var NumberOfSlots3;..var Time_Out3;..var Increment3;..var OffsetNumber4;..var NumberOfSlots4;..var Time_Out4;..var Increment4;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 20){.... RepeatIndicator = ubin(#bin,6,2);.. SourceStationID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. OffsetNumber1 = ubin(#bin,40,12);.. NumberOfSlots1 = ubin(#bin,52,4);.. Time_Out1 = ubin(#bin,56,3);.. Increment1 = ubin(#bin,59,11);.. OffsetNumber2 = ubin(#bin,70,12);.. NumberOfSlots2 = ubin(#bin,82,4);.. Time_Out2 = ubin(

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-3ITGJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	668
Entropy (8bit):	4.494391176923802
Encrypted:	false
SSDEEP:	12:TU31xMiHUpW+SAuSsPzcV5NWJP1cX+sx8/k1iJW51JBKV:KMiHUpW+SfS6c7NWJP1cOsxKkgJQ3BKV
MD5:	827E3F4AD5498C8C386643B83BE84FD9
SHA1:	169859EE10901AFE16690E3307BEE8FAD34C2BB4
SHA-256:	6914BAA4D6DBC7FF753C395D37256BFEB0155056008BD3AE77AC5E5262ABE670
SHA-512:	348376F8A1A5BD30F365C094AB5807AA2D4384391EFE8DF5F5B6B8ACB5EBAE31EFB77A4DFA3577B4E66044802E1DB804538DE664A099FCFD1ADEBF156F346221
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationID;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 10){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. Spare2 = ubin(#bin,70,2);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare1", Spare1);.. map("DestinationID", DestinationID);.. map("Spare2", Spare2);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-4853N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1515
Entropy (8bit):	4.698432684936653
Encrypted:	false
SSDEEP:	24:gMiHHpyVrZVpVrGzpyrRpLr5CBS6DSW2jKktI+xXgLfcOsxKkcJ/qLo7JyRLnYJx:g7pq1RIgDfkS6Dl2jdtI+xXgLfcDxKk6
MD5:	0D164D701ED7031A70593F2654DC0A31
SHA1:	DA5EDBF15FE4F07C29425F0BF45ECF62CB874C78
SHA-256:	E7C741C774C132F2DC691EB54C23C9786F721508676B2DCFF65F56924B5AF49C
SHA-512:	4A7F5E9726E3152B3AB6B16D4925F9D751F1FF0EE7157EC96709D184B919C910DE58875B99933EB5E4482049530FCF9D66B35ABC32FE45E6CAE7A72BE3B95FCD
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var DestinationID1;..var SequenceNumberForID1;..var DestinationID2;..var SequenceNumberForID2;..var DestinationID3;..var SequenceNumberForID3;..var DestinationID4;..var SequenceNumberForID4;....MessageId = ubin(#bin,0,6);..if (MessageId == 7 \|\|.. MessageId == 13){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. DestinationID1 = ubin(#bin,40,30);.. SequenceNumberForID1 = ubin(#bin,70,2);.. DestinationID2 = ubin(#bin,72,30);.. SequenceNumberForID2 = ubin(#bin,102,2);.. DestinationID3 = ubin(#bin,104,30);.. SequenceNumberForID3 = ubin(#bin,134,2);.. DestinationID4 = ubin(#bin,136,30);.. SequenceNumberForID4 = ubin(#bin,166,2);.... map("MessageId", Messa

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-4CFJ7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1838
Entropy (8bit):	4.853870663306694
Encrypted:	false
SSDEEP:	48:gYIJPSYIIFRNWcDxK4c+F/TGyfkM5ihTE34JNoYi:xI9PzEc44c+F/yyfkM5ihTEoMYi
MD5:	02F63704CA632C50D822FAF180EFCD6D
SHA1:	B7422C9D1901B320C4BFDD9B030F3F3ABA4FD9A0
SHA-256:	F0E63E4ADDF7B88234A05D3885D30BA935867E6E062E6353F91D3E8075530512
SHA-512:	4354FE2B5012EF1E43D03E98A82C943450AB1325FF7282E619475138D15A61A5AEE3074F0AB9933C74EBF6E078229FAE8A9879E5C46F6D8D8ADC63A07B3AE0DA
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var AISVersionIndicator;..var IMONumber;..var CallSign;..var Name;..var TypeOfShipAndCargoType;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var ETA;..var MaximumPresentStaticDraught;..var Destination;..var DTE;..var Spare;....MessageId = ubin(#bin,0,6);..if (MessageId == 5){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. AISVersionIndicator = ubin(#bin,38,2);.. IMONumber = ubin(#bin,40,30);.. CallSign = str(#bin,70,42);.. Name = str(#bin,112,120);.. TypeOfShipAndCargoType = ubin(#bin,232,8);.. Dimension_ReferenceForPosition = ubin(#bin,240,30);.. TypeOfElectronicPositionFixingDevice = ubin(#bin,270,4);.. ETA = ubin(#bin,274,20);.. MaximumPresentStaticDraught = ubin(#bin

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-5F28J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2373
Entropy (8bit):	4.890773121214861
Encrypted:	false
SSDEEP:	48:gy0TA26InQSY4t0f0sIVxmyZVjsNcDxK4I0/0/EYSTX2zkxQBwdc/yfkM5ihT0YM:8826InQsqMsoxmyZVANc44Xc/EYSTX00
MD5:	AF38DCCA9DA67BE2101A1A1D242EDD3D
SHA1:	C3B003134DAFA46025E1701912749CC865664198
SHA-256:	A66FC035B313B7CF3AF1F2195D8A07AC342571D5642A47588A42B0DF32091351
SHA-512:	2861FB240EA10F75F026F963F2564E36B7ABFA9B9629E41BEE642F6DA1F3187C41F42842EAF0F6EA731197D7E84C666809B4D5456DD416B1F54E21EB01F254E1
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var ReservedForRegionalOrLocalApplications;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var ReservedForRegionalApplications;..var Name;..var TypeOfShipAndCargoType;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var RAIM_flag;..var DTE;..var AssignedModeFlag;....MessageId = ubin(#bin,0,6);..if (MessageId == 19){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. ReservedForRegionalOrLocalApplications = ubin(#bin,38,8);.. SOG = ubin(#bin,46,10);.. PositionAccuracy = ubin(#bin,56,1);.. Longitude = bin(#bin,57,28);.. Latitude = bin(#bin,85,27);.. COG = ubin(#bin,112,12);.. TrueHeading = ubin(#bin,124,9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-5IQE6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	668
Entropy (8bit):	4.488552652178458
Encrypted:	false
SSDEEP:	12:TK31xMiHUpW+SAuSsPzcV5NWJP1cX+sx8/k1iJW51JBKV:gMiHUpW+SfS6c7NWJP1cOsxKkgJQ3BKV
MD5:	CEB1D9852B3CE681B48BE3F31CDA2661
SHA1:	3CD95E79245A2D6D7F05036A4E0FB9D9F4876191
SHA-256:	5FE3505C1167FA704A5A5942F721807E4ABFE5F0CF43C51AC1DDFB444E8567D6
SHA-512:	E06D92A490C304025264E77771A5FF61BFC44734628B86080764D84F518881020107F5AE5B7DA28547C2C6A284C908A402631B85FB7D5ADF7FE41DB59F31B666
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationID;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 10){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. Spare2 = ubin(#bin,70,2);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare1", Spare1);.. map("DestinationID", DestinationID);.. map("Spare2", Spare2);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-6B13P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1979
Entropy (8bit):	4.694496363970113
Encrypted:	false
SSDEEP:	48:gc4+w7qr8QSZcZzoEiFRHcDxKcgPINP2R+a/tAJX2JJI1X23ae4P74PP4xQBKV:FQqRdzoEiFtc4cgANeR+a/tAJX6JI1XZ
MD5:	C201FB59451BC2AAAB451928DD56115F
SHA1:	0087F499E34D8489358842710527F5509FDFAD6A
SHA-256:	810219C0FB0683E606355DA8EE806FC2464204F7382531B4A7E965601BC8282A
SHA-512:	8F1BBCD9731C1F8864ACB4C2D506D334DF2A97E9DAFBC9A7E1204039B1297EBEFACB21740F2D6A22AC535603171665E33064C0577B047EABD21B253B048088F3
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var StationID;..var Spare1;..var ChannelA;..var ChannelB;..var Tx_RxMode;..var Power;..var Longitude1;..var Latitude1;..var Longitude2;..var Latitude2;..var AddressedOrBroadcastMessageIndicator;..var ChannelABandwidth;..var ChannelBBandwidth;..var TransitionalZoneSize;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 22){.... RepeatIndicator = ubin(#bin,6,2);.. StationID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. ChannelA = ubin(#bin,40,12);.. ChannelB = ubin(#bin,52,12);.. Tx_RxMode = ubin(#bin,64,4);.. Power = ubin(#bin,68,1);.. Longitude1 = bin(#bin,69,18);.. Latitude1 = bin(#bin,87,17);.. Longitude2 = bin(#bin,104,18);.. Latitude2 = bin(#bin,1

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-7VOLM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1159
Entropy (8bit):	5.205717296330583
Encrypted:	false
SSDEEP:	24:KM8XoGnkD+3v+8mu+YOHZJLNKicOsxK4YbgLaaRDTX2zEk0i:Ko8MHZvHcDxK4Y0+STX2zEk0i
MD5:	85DF7DEED13B2E2A4376B2AD6C131B1D
SHA1:	6B36A48779C01658AF8E240EE1F32D8BB3594D39
SHA-256:	C68B981D53C834ABA1C3C8E6AD379259B2994B3C1E40B0CA972F4307B0336185
SHA-512:	0EC16B8DC7B16F44E2A62EE464313CBB02956C6F67485B70322BE6B05C5C71C8A7944906F7B74BBC3C5F5457B07DC808BC78030D85BF251AD2D46556F2A5D7D5
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var PositionAccuracy;..var RAIM_flag;..var NavigationalStatus;..var Longitude;..var Latitude;..var SOG;..var COG;..var StatusOfCurrentGNSSPosition;..var Spare;......MessageId = ubin(#bin,0,6);..if (MessageId == 27){...RepeatIndicator =....ubin(#bin,6,2);...UserID =......ubin(#bin,8,30);...PositionAccuracy = ....ubin(#bin,38,1);...RAIM_flag = .....ubin(#bin,39,1);...NavigationalStatus = ...ubin(#bin,40,4);...Longitude = .....bin(#bin,44,18);...Latitude = ......bin(#bin,62,17);...SOG = .......ubin(#bin,79,6);...COG = .......ubin(#bin,85,9);...StatusOfCurrentGNSSPosition = .ubin(#bin,94,1);.. Spare =.......ubin(#bin,95,1);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("UserID", UserID);.. map("PositionAccuracy", PositionAccuracy);.. map("RAIM_flag", RAIM_flag);.. map("NavigationalStatus", NavigationalStatus);.. map("Longitude", Longitude);.. map("Latitud

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-8DMCS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.6431236091809724
Encrypted:	false
SSDEEP:	12:TK31xMiHu+yEFpSsPzsEbKcX+sx8/kcDDaESEM9:gMiHHXFpS6lbKcOsxKkcDz3i
MD5:	A28F2261023D79C75CCC9E5D8B69219F
SHA1:	E899D7CACCAE32DE98672A562D186E4F797D6DF5
SHA-256:	3A006C6F9E484EE9FB6E2E7CC515C5FD05A16C33E7915CAB069FED4E4299E4D4
SHA-512:	4A847D84EE2622FD463C17E049D0B6344EB6C25C83494D1378EB77A19421CC62862A9EBC8941B1F58D4D4B1DC667AD32DEF6C6F821FE8E8E3D3C93B2935DAC90
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var SafetyRelatedText;....MessageId = ubin(#bin,0,6);..if (MessageId == 14){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. SafetyRelatedText = str(#bin,40,966);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare", Spare);.. map("SafetyRelatedText", SafetyRelatedText);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-8DQ2M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.675230373795883
Encrypted:	false
SSDEEP:	24:KMiHrGpW+5HX9S6z4NWrvScOsxKkLvaF/JQ3acDz3i:K7LQd9S6z4ErvScDxKkLvaF/JQ3acDzy
MD5:	0ECC8274AE502CC175012918C9E074DD
SHA1:	E608C6ED9C1213720646F8B8D609E2C3E28E3FFE
SHA-256:	1E9364FF1692E6E964E8E5C4DF5287450A103D73673DF533FCEAC3FD0F626AC9
SHA-512:	D59C6FE37A8ACE1F89D34795F682AB164B8E82736C09826B2D7CACDEECB784FCA306D00F8CA4A985F6261CCE89188D53A9EADB260524F9E453D4BC56A3F3F2D0
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var SequenceNumber;..var DestinationID;..var RetransmitFlag;..var Spare;..var SafetyRelatedText;....MessageId = ubin(#bin,0,6);..if (MessageId == 12){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. SequenceNumber = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. RetransmitFlag = ubin(#bin,70,1);.. Spare = ubin(#bin,71,1);.. SafetyRelatedText = str(#bin,72,936);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("SequenceNumber", SequenceNumber);.. map("DestinationID", DestinationID);.. map("RetransmitFlag", RetransmitFlag);.. map("Spare", Spare);.. map("SafetyRelatedText", SafetyRelatedText);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-913H2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3805
Entropy (8bit):	4.611276851317889
Encrypted:	false
SSDEEP:	96:8TWfTcP0xdBIx16c44+8EYSTX0kxuw8c0MxdXBmNvcP0xdBIxbVxc44+8EYSTX02:W6n2xIc44+8EYSTX0kUw8c0MxdAd2xTl
MD5:	FB828325901EDFDA51D2D6CFBC7E579A
SHA1:	857758D7AE99B8BAF71BE50619C2F2539BCA8E97
SHA-256:	93320F89392E46FB99D1E68D6B3973B50CB6288CB8C657018D61B8872C0FF310
SHA-512:	7BA29D5397DF04099AA91CF62B11B6E2DB2EF07E0EBDDFBDF5190DD290075991C71572F1817376EB5324673079D34F320EDD8B190EEEB973B890108DA0DD7DEC
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var NavigationalStatus;..var RateOfTurn;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var SpecialManoeuvreIndicator;..var Spare;..var RAIM_flag;..var SyncState;....var SlotTime_Out;..var SubMessage;....var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);..if (MessageId == 1 \|\|.. MessageId == 2){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. NavigationalStatus = ubin(#bin,38,4);.. RateOfTurn = bin(#bin,42,8);.. SOG = ubin(#bin,50,10);.. PositionAccuracy = ubin(#bin,60,1);.. Longitude = bin(#bin,61,28);.. Latitude = bin(#bin,89,27);.. COG = ubin(#bin,116,12);.. TrueHeading =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-9MQEV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	4.7592453854016386
Encrypted:	false
SSDEEP:	24:KMiHHAGm516G/IS64MyWMe6ncOsxKkcIDYT/WV6x6aF/3y:K7NflS6zyWqncDxKkcIDk/W4EaF/3y
MD5:	E77346A17E0060A09283AF49EED157F1
SHA1:	C4E46B68D2AE3DA48C8E0B7CFF4DEA81B155ECAE
SHA-256:	03D2FA8A2DDAAA84A77F6B0663F4E3363A0C46A72BD2D9A5B62B7EA3FD231797
SHA-512:	C584376BF07508813754C6D5ED59BDE4E31850C5A64D6F20CAC2D7D6440FC3FF417D1CE1EFDF9A37A8AD76368488ABFEE3015BE91E5CFE27D3DEF4977907ABCD
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var DAC;..var FunctionIdentifier;..var AcknowledgedRequiredFlag;..var TextSequenceNumber;..var ApplicationData;....MessageId = ubin(#bin,0,6);..if (MessageId == 8 ){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. DAC = ubin(#bin,40,10);.. FunctionIdentifier = ubin(#bin,50,6); .. AcknowledgedRequiredFlag = ubin(#bin,56,1);.. TextSequenceNumber = ubin(#bin,57,11);.. ApplicationData = str(#bin,68,936);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare", Spare);.. map("DAC", DAC);.. map("FunctionIdentifier", FunctionIdentifier);.. map("AcknowledgedRequiredFlag", AcknowledgedRequiredFlag);.. map("TextSequen

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-A7N31.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	4.630482052007689
Encrypted:	false
SSDEEP:	48:KEAxbZXSYMtdBhRDttcDxK4YEYSTX2zkwuJYu0O0fyoUvyMxtXBmNSFTyoUSi6MW:AxbZXudBhRDttc44YEYSTX0kwuJYu0OT
MD5:	5FA0B3A565F825CFFD9BF4B61893276E
SHA1:	BF4B382123A2741DDC8448752161DC3E75104FE7
SHA-256:	FB541F6EE8B8AF9A5377180209FCE05896C29E6E5E8A2A7EA518F7753C1E7CB7
SHA-512:	CCD6C0B6C05E48AC580B323BFF6DD2A89D877FCA0C76F24711500337AB6FDE7F0A8C2CC4F128C12458BD53F29D3E011A944AA1F95379CB40C3B0803DE2E4D094
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var Altitude_GNSS;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TimeStamp;..var AltitudeSensor;..var Spare;..var DTE;..var AssignedModeFlag;..var RAIM_flag;..var CommunicationStateSelectorFlag;..var SyncState;..var SlotTime_Out;..var SubMessage;..var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);..if (MessageId == 9){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. Altitude_GNSS = ubin(#bin,38,12);.. SOG = ubin(#bin,50,10);.. PositionAccuracy = ubin(#bin,60,1);.. Longitude = bin(#bin,61,28);.. Latitude = bin(#bin,89,27);.. COG = ubin(#bin,116,12);.. TimeStamp = ubin(#bin,128,6);.. AltitudeSensor =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-B3B9I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2373
Entropy (8bit):	4.890519075109663
Encrypted:	false
SSDEEP:	48:Ky0TA26InQSY4t0f0sIVxmyZVjsNcDxK4I0/0/EYSTX2zkxQBwdc/yfkM5ihT0YM:G826InQsqMsoxmyZVANc44Xc/EYSTX00
MD5:	6F3A69729D46573B6CA788F3A10890F8
SHA1:	089BBBEAC94FC5CA31367F119098CA977E399744
SHA-256:	7F471E0C9262FF6DF6D4A85662DD215E0C04445ACC628D993048F2394BF78372
SHA-512:	C9D62AFFAA8A80DB41AC4AEF56A300A4355EBAE5EBCD1B68E7FF17296BDF2FEAAE9C51299A5F04972745958AB63316D14E22B93110FE9BED4D3C3ABA541A6393
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var ReservedForRegionalOrLocalApplications;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var ReservedForRegionalApplications;..var Name;..var TypeOfShipAndCargoType;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var RAIM_flag;..var DTE;..var AssignedModeFlag;....MessageId = ubin(#bin,0,6);..if (MessageId == 19){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. ReservedForRegionalOrLocalApplications = ubin(#bin,38,8);.. SOG = ubin(#bin,46,10);.. PositionAccuracy = ubin(#bin,56,1);.. Longitude = bin(#bin,57,28);.. Latitude = bin(#bin,85,27);.. COG = ubin(#bin,112,12);.. TrueHeading = ubin(#bin,124,9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-B6D0K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5586
Entropy (8bit):	4.639847403164306
Encrypted:	false
SSDEEP:	96:882eWJa8sIwyrJxla8YYXcvk4SDXUExuQdcvUmG8sOtUMMxtXBmNE8sIwyrJxr4o:8FepnyrJxY8YYXcvk4SDXUE0QdcvUmGS
MD5:	A800676ACE24CC656B3012AA31519226
SHA1:	7FA9DBB6BE0A959B84E7BA5FB6EA4CB8B4903946
SHA-256:	D3C4C79BBD7D429B97459CCC3A7F956CD9B50D27E937746F85C4ADBD3F2FE7ED
SHA-512:	8463A21491ED0B44D583DD7685D3B39BF24727DCED9B903918B92CE8728BDA8623C444E863880DB2DD363B175332F29E98F904DD7F5DEFEC0CE2614D6A5A501C
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var ReservedForRegionalOrLocalApplications;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var ReservedForRegionalApplications;..var ClassB_UnitFlag;..var ClassB_DisplayFlag;..var ClassB_DSCFlag;..var ClassB_BandFlag;..var ClassB_Message22Flag;..var ModeFlag;..var RAIM_flag;..var CommunicationStateSelectorFlag;..var SyncState;....var SlotTime_Out;..var SubMessage;....var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);....if (MessageId == 18){.. CommunicationStateSelectorFlag = ubin(#bin,148,1);.. if (CommunicationStateSelectorFlag == 0){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. ReservedForRegionalOrLocalApplications = ubin(#bin,38,8);.. SOG = ubin(#bin,46,10);.. PositionAccuracy =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-BJAAT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	4.497603067977456
Encrypted:	false
SSDEEP:	24:gMiHUpcyOpS6067SFS6c7CWn5k8C/cOsxKkgJvasQFJiBgeBKV:g7Gm+pFS6c7Vn5TC/cDxKkgJvasQFJi0
MD5:	F1966811115749C980CFB828B6A4AC80
SHA1:	C8984EC1925F7978D26AAB2F4E8CD3FD6DD3F4C8
SHA-256:	78B25ACB86E64B319EE08B74A73CD5BAC8B1266C84DE9B0C618EC4D46400F852
SHA-512:	156583344A3C172B3F4963FA06EA147707929C8353CC592B21464421F75C7A35E125A48D21DB3F7360AFE81CCE3484D16E3D9C42B2E0620688DA31811FC3120B
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationIDA;..var OffsetA;..var IncrementA;..var DestinationIDB;..var OffsetB;..var IncrementB;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 16){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationIDA = ubin(#bin,40,30);.. OffsetA = ubin(#bin,70,12);.. IncrementA = ubin(#bin,82,10);.. DestinationIDB = ubin(#bin,92,30);.. OffsetB = ubin(#bin,122,12);.. IncrementB = ubin(#bin,134,10);.. Spare2 = ubin(#bin,144,4);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare1", Spare1);.. map("DestinationIDA", DestinationI

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-D3I6D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1045
Entropy (8bit):	4.3315941590307405
Encrypted:	false
SSDEEP:	24:CGF/ESfZ21C/zAGEuXlO7ydvG2pfrFBL578tIFoNS:CGF/ESfc1C/zAGEuXlO7ydvG2pf5BL5R
MD5:	65A5197B2A22BCB71A67C509DB96A955
SHA1:	A0BC652D915EE6447BF6CD00414DA7A7A87B2A72
SHA-256:	C853BC916807319BA9CE1759594B0BE7BC5BCF0939913E08E397598DDBB70086
SHA-512:	D7977BB15486FBD52044655AD24625F7DFC1A693D381A5072E34CBE6D65E8D26CF7707BD145F2C403CBCA5B430B6C6A0F0F5C2BB84C8C5612EDAFCD6E7104B0B
Malicious:	false
Preview:	#####################################################..0,0:0:0\|VDM_table15..0,0:0:0\|VDM_table16..0,0:0:0\|VDM_table17..0,0:0:0\|VDM_table19..0,0:0:0\|VDM_table21..0,0:0:0\|VDM_table22..0,0:0:0\|VDM_table23..0,0:0:0\|VDM_table24..0,0:0:0\|VDM_table25..0,0:0:0\|VDM_table26..0,0:0:0\|VDM_table27..0,0:0:0\|VDM_table28..0,0:0:0\|VDM_table29..0,0:0:0\|VDM_table31..0,0:0:0\|VDM_table32..0,0:0:0\|VDM_table33..0,0:0:0\|VDM_table34..0,0:0:0\|VDM_table35..0,0:0:0\|VDM_message23..0,0:0:0\|VDM_message24ab..0,0:0:0\|VDM_message25..0,0:0:0\|VDM_message26..0,0:0:0\|VDM_message27..0,0:0:0\|VDO_table15..0,0:0:0\|VDO_table16..0,0:0:0\|VDO_table17..0,0:0:0\|VDO_table19..0,0:0:0\|VDO_table21..0,0:0:0\|VDO_table22..0,0:0:0\|VDO_table23..0,0:0:0\|VDO_table24..0,0:0:0\|VDO_table25..0,0:0:0\|VDO_table26..0,0:0:0\|VDO_table27..0,0:0:0\|VDO_table28..0,0:0:0\|VDO_table29..0,0:0:0\|VDO_table31..0,0:0:0\|VDO_table32..0,0:0:0\|VDO_table33..0,0:0:0\|VDO_table34..0,0:0:0\|VDO_table35..0,0:0:0\|VDO_message23..0,0:0:0\|VDO_message24ab..0,0:0:0\|VDO_message25..0

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-DI4AG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4969
Entropy (8bit):	4.620754023544724
Encrypted:	false
SSDEEP:	96:MdhXTQRgAbc4kgSTX0MJ4cGJLvaF/sVucik2kqc2cPE4TQQcgcIMoQcEQ/okswgS:M4aYc4kgSTX0i4cGJLvaJswcik2kqc2y
MD5:	0B5E6497C3FD19E9C225DD1F17CA61A4
SHA1:	019383E0EEFFA13E92F6BD8202A16D1E1BB77F95
SHA-256:	41FD761636E41A962EC81481CCC7BD0497ED57425920D79F9DBB9F0C1CE66C8B
SHA-512:	9F93F732D6A7F55614664E68EEAF482541F8FA93C42C645008FE8180B67A58C53DBAEC460779B755D502ADC8692C0E78F4D928977E7E237B8C926EF242B8B6C7
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var Longitude;..var Latitude;..var Spare2;..var MessageType;..var StationID;..var ZCount;..var SequenceNumber;..var N;..var Health;..var DGNSSDataWord1;..var DGNSSDataWord2;..var DGNSSDataWord3;..var DGNSSDataWord4;..var DGNSSDataWord5;..var DGNSSDataWord6;..var DGNSSDataWord7;..var DGNSSDataWord8;..var DGNSSDataWord9;..var DGNSSDataWord10;..var DGNSSDataWord11;..var DGNSSDataWord12;..var DGNSSDataWord13;..var DGNSSDataWord14;..var DGNSSDataWord15;..var DGNSSDataWord16;..var DGNSSDataWord17;..var DGNSSDataWord18;..var DGNSSDataWord19;..var DGNSSDataWord20;..var DGNSSDataWord21;..var DGNSSDataWord22;..var DGNSSDataWord23;..var DGNSSDataWord24;..var DGNSSDataWord25;..var DGNSSDataWord26;..var DGNSSDataWord27;..var DGNSSDataWord28;..var DGNSSDataWord29;....MessageId = ubin(#bin,0,6);..if (MessageId == 17){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ub

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-DOV4D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.649836405273726
Encrypted:	false
SSDEEP:	12:TU31xMiHu+yEFpSsPzsEbKcX+sx8/kcDDaESEM9:KMiHHXFpS6lbKcOsxKkcDz3i
MD5:	876F56F0ADEB0AE293A3ACEA76BFF33C
SHA1:	5C7C99F1107070DC424E187F6EACB025AAA51106
SHA-256:	A74B508C93E6EEECFB3104DCCB6D7E886400D7670A6389C9E6E5D60C4EFCDA3B
SHA-512:	E7DEFACF18B36F948F3BAFBDC8FC732E080076460B0EEAE67536C25D73E4FA88388A0414FC3799A799653EFEBA9EA6473800355CD49E3847C0BC5F209D2B5F98
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var SafetyRelatedText;....MessageId = ubin(#bin,0,6);..if (MessageId == 14){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. SafetyRelatedText = str(#bin,40,966);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare", Spare);.. map("SafetyRelatedText", SafetyRelatedText);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-E3OQ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6530
Entropy (8bit):	5.1615127233447256
Encrypted:	false
SSDEEP:	192:mfc4kGCAwx+XxqL1x+mxeB7wx+XxkL1x+mxC:+c4kG7d
MD5:	A915C6861C7ABCDCE70573880F4F3F2A
SHA1:	993FBA37CC0FBA1B9AE2381036480F7B13DE4AC9
SHA-256:	60ECB0E990DD32A7F0E6DB3CFA98E5B71EC9DB9B54E4DFE28B2153C9F5CAE88A
SHA-512:	9C78B1C4BABDA7747BD64BF866ADDACD516208DA409DDEDCE015A96545C7858B518B73875E6D73A161E0871B344927DC2A5D1ADC0F25836300BEBC61180ED1B0
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var DestinationIndicator;..var BinaryDataFlag;..var DestinationID;..var BinaryData;..var BinaryDataAddedBy2ndSlot;..var BinaryDataAddedBy3rdSlot;..var BinaryDataAddedBy4thSlot;..var BinaryDataAddedBy5thSlot;..var CommunicationStateSelectorFlag;..var SyncState;..var SlotTime_Out;..var SubMessage;..var SlotIncrement;..var NumberOfSlots;..var Keep_flag;......MessageId = ubin(#bin,0,6);..if (MessageId == 26){.....RepeatIndicator =....ubin(#bin,6,2);...SourceID =......ubin(#bin,8,30);...DestinationIndicator =...ubin(#bin,38,1);...BinaryDataFlag =....ubin(#bin,39,1);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("DestinationIndicator", DestinationIndicator);.. map("BinaryDataFlag", BinaryDataFlag);.... ...if (DestinationIndicator == 0) {....if (BinaryDataFlag == 0) {.....BinaryData =......strHex(#bin,40,108);.....BinaryDataAddedBy2ndSl

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-FCIGH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1979
Entropy (8bit):	4.695298593428696
Encrypted:	false
SSDEEP:	48:Kc4+w7qr8QSZcZzoEiFRHcDxKcgPINP2R+a/tAJX2JJI1X23ae4P74PP4xQBKV:LQqRdzoEiFtc4cgANeR+a/tAJX6JI1XZ
MD5:	7ADC81684CE93D9EA5098B5764555AB3
SHA1:	9958A4832FB1C281EA3D5D283D1F679A3C76D27E
SHA-256:	9DF448B3006705A04D8A35A95B958EFC817BDCFF20D963BB660E63565E621BEC
SHA-512:	60126FD888AC9B57601383D72B623EE00868C3BBE8355D4F5376760FA82155654A1FFDC56D6A968AA62DD6F1AD64A45F5D69EAA1EFD716240A5B4A0F3EB92C27
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var StationID;..var Spare1;..var ChannelA;..var ChannelB;..var Tx_RxMode;..var Power;..var Longitude1;..var Latitude1;..var Longitude2;..var Latitude2;..var AddressedOrBroadcastMessageIndicator;..var ChannelABandwidth;..var ChannelBBandwidth;..var TransitionalZoneSize;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 22){.... RepeatIndicator = ubin(#bin,6,2);.. StationID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. ChannelA = ubin(#bin,40,12);.. ChannelB = ubin(#bin,52,12);.. Tx_RxMode = ubin(#bin,64,4);.. Power = ubin(#bin,68,1);.. Longitude1 = bin(#bin,69,18);.. Latitude1 = bin(#bin,87,17);.. Longitude2 = bin(#bin,104,18);.. Latitude2 = bin(#bin,1

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-GN33A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	4.630450415113706
Encrypted:	false
SSDEEP:	48:gEAxbZXSYMtdBhRDttcDxK4YEYSTX2zkwuJYu0O0fyoUvyMxtXBmNSFTyoUSi6MW:2xbZXudBhRDttc44YEYSTX0kwuJYu0OT
MD5:	7C6D3706CF486BC3A68D0F9E6876CB8E
SHA1:	A16C9B5403495221DC78AA6068ED8F68A1A2C300
SHA-256:	67B60CF4A60AD08CE16DB988D7C0569C84D992FF0FDE707F5B5BEEB0033B062C
SHA-512:	64440A3139D8E8BB6507AB49C8DEDA87233302F802A580D3C8C62EA8511E16DCD72A3A8FBC24A54909604D2B51A3C6C772E2769BD4774784CC1128BCD7016A01
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var Altitude_GNSS;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TimeStamp;..var AltitudeSensor;..var Spare;..var DTE;..var AssignedModeFlag;..var RAIM_flag;..var CommunicationStateSelectorFlag;..var SyncState;..var SlotTime_Out;..var SubMessage;..var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);..if (MessageId == 9){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. Altitude_GNSS = ubin(#bin,38,12);.. SOG = ubin(#bin,50,10);.. PositionAccuracy = ubin(#bin,60,1);.. Longitude = bin(#bin,61,28);.. Latitude = bin(#bin,89,27);.. COG = ubin(#bin,116,12);.. TimeStamp = ubin(#bin,128,6);.. AltitudeSensor =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-IA28P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	4.755640824837969
Encrypted:	false
SSDEEP:	24:gMiHHAGm516G/IS64MyWMe6ncOsxKkcIDYT/WV6x6aF/3y:g7NflS6zyWqncDxKkcIDk/W4EaF/3y
MD5:	8DFD0E9E102C6545B0EEEF75FB84C533
SHA1:	67CE065E9AE30CDE1EFF24B81E035914B2392D81
SHA-256:	8479E9D60F5BA54DE40E609F2315F1B125ADCB8C9A325B875AD14E71391B7910
SHA-512:	ACD1414C7FF670AEAF560AE55AB6871D0E310B8E2DA823AC90229E39ACD5795081D3A1734151161545E44FDBA76F9BBE2BC084EA75BDF422126D9F769AB66819
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare;..var DAC;..var FunctionIdentifier;..var AcknowledgedRequiredFlag;..var TextSequenceNumber;..var ApplicationData;....MessageId = ubin(#bin,0,6);..if (MessageId == 8 ){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare = ubin(#bin,38,2);.. DAC = ubin(#bin,40,10);.. FunctionIdentifier = ubin(#bin,50,6); .. AcknowledgedRequiredFlag = ubin(#bin,56,1);.. TextSequenceNumber = ubin(#bin,57,11);.. ApplicationData = str(#bin,68,936);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("Spare", Spare);.. map("DAC", DAC);.. map("FunctionIdentifier", FunctionIdentifier);.. map("AcknowledgedRequiredFlag", AcknowledgedRequiredFlag);.. map("TextSequen

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-ILA79.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.65722864227426
Encrypted:	false
SSDEEP:	48:K7fwCCPbpS6cXksPB6gOQnacDxKkgtAJX2JJI1X23AfkBKJR+aRUi:9V6ksPkrQac4kgtAJX6JI1X8AfkMJR+q
MD5:	E377A25E90FDFD43310B953A74D79AAE
SHA1:	A2E36874D6EF7EE01418D0E6BE0D840D0A34DBC4
SHA-256:	15E4B1E1A5A66737D042334F4EAEDC955BFE4AD636B692CE59950B89E6C7AF20
SHA-512:	64C997D5F7E8E233F12D1C2D62AFE4AC26BA4E75B2F33A04A664ECF6B50D222C03ABB182846711C367ABAB22D8BEEDCF78774285A43092EA56A5120C807C5F3C
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var Longitude1;..var Latitude1;..var Longitude2;..var Latitude2;..var StationType;..var TypeOfShipAndCargoType;..var Spare2;..var Tx_RxMode;..var ReportingInterval;..var QuietTime;..var Spare3;....MessageId = ubin(#bin,0,6);..if (MessageId == 23){.. RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. Longitude1 = bin(#bin,40,18);.. Latitude1 = bin(#bin,58,17);.. Longitude2 = bin(#bin,75,18);.. Latitude2 = bin(#bin,93,17);.. StationType = ubin(#bin,110,4);.. TypeOfShipAndCargoType = ubin(#bin,114,8);.. Spare2 = ubin(#bin,122,22);.. Tx_RxMode = ubin(#bin,144,2);.. ReportingInterval = ubin(#bin,146,4)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-J1TVQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6530
Entropy (8bit):	5.1615921348542635
Encrypted:	false
SSDEEP:	192:kfc4kGCAwx+XxqL1x+mxeB7wx+XxkL1x+mxC:wc4kG7d
MD5:	83FA3A2040435251FE10CF541AAAED24
SHA1:	DDAAB923834F825EB10E58408DE42FC793D3AB41
SHA-256:	31088D56EC40EA27E13DBB1252228B1B2C0BD80EEFEE23900F1E7855B0FA3332
SHA-512:	5DC3F093BE941DFBF62C8BBC79AFA95762E3D24C6F7272263B424A6E8D3CDD9C41BC6E748C0E493E42A738210084EFE7A36663E56CB10CD7BF637E4B1841D9D5
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var DestinationIndicator;..var BinaryDataFlag;..var DestinationID;..var BinaryData;..var BinaryDataAddedBy2ndSlot;..var BinaryDataAddedBy3rdSlot;..var BinaryDataAddedBy4thSlot;..var BinaryDataAddedBy5thSlot;..var CommunicationStateSelectorFlag;..var SyncState;..var SlotTime_Out;..var SubMessage;..var SlotIncrement;..var NumberOfSlots;..var Keep_flag;......MessageId = ubin(#bin,0,6);..if (MessageId == 26){.....RepeatIndicator =....ubin(#bin,6,2);...SourceID =......ubin(#bin,8,30);...DestinationIndicator =...ubin(#bin,38,1);...BinaryDataFlag =....ubin(#bin,39,1);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("DestinationIndicator", DestinationIndicator);.. map("BinaryDataFlag", BinaryDataFlag);.... ...if (DestinationIndicator == 0) {....if (BinaryDataFlag == 0) {.....BinaryData =......strHex(#bin,40,108);.....BinaryDataAddedBy2ndSl

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-J567J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2270
Entropy (8bit):	4.809327791805813
Encrypted:	false
SSDEEP:	48:Kfo/v+2LZlUSYjt0hJ2cuyopDfkvLcDxK4s8ikMp2MB9hiYSTX2z5ihTxs28s2By:ttLZlUl0h4cux16c44s8ikMp2MbgYSTL
MD5:	8D8B7DFA75A9CB9532D13D4C1AE1704F
SHA1:	A50076A9017CA67951293FA30260A9CED748D6DD
SHA-256:	78958DA440A256FFAAC5B87B1A54001CB471CA08F1E96A923E22011C6F7B63B7
SHA-512:	EDD0D8CD3019990877C36FB8A2FBC8430586B582E52A0DE94AB7EE368DEE57AFC3094CB2CF27D9FDBB83ADBD0D81AF0DE4CF2F1DF5520EEC89FC6F4FA38D2C09
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var UTCYear;..var UTCMonth;..var UTCDay;..var UTCHour;..var UTCMinute;..var UTCSecond;..var PositionAccuracy;..var Longitude;..var Latitude;..var TypeOfElectronicPositionFixingDevice;..var TransmissionControlForLongrangeBroadcastMessage;..var Spare;..var RAIM_flag;..var SyncState;..var SlotTime_Out;..var SubMessage;....MessageId = ubin(#bin,0,6);..if (MessageId == 4 \|\|.. MessageId == 11){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. UTCYear = ubin(#bin,38,14);.. UTCMonth = ubin(#bin,52,4);.. UTCDay = ubin(#bin,56,5);.. UTCHour = ubin(#bin,61,5);.. UTCMinute = ubin(#bin,66,6);.. UTCSecond = ubin(#bin,72,6);.. PositionAccuracy = ubin(#bin,78,1);.. Longitude =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-J6NSL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.656577064794492
Encrypted:	false
SSDEEP:	48:g7fwCCPbpS6cXksPB6gOQnacDxKkgtAJX2JJI1X23AfkBKJR+aRUi:7V6ksPkrQac4kgtAJX6JI1X8AfkMJR+q
MD5:	D32142014DD9E5C0628644B0D05622EF
SHA1:	6F0109D3C995D1708DA67BD1C125932C9615D284
SHA-256:	0519593353B968F7F634ABBA6211B445074322F2344FEF05AF147BA964F883DB
SHA-512:	D50C5A89FD5D4A55661D07A0BA99DE11E99F23A1F04E91929A0AF504E6427D183BC227166A4649A310031784ECEED2877A2658768BABE98341BFA2106B997920
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var Longitude1;..var Latitude1;..var Longitude2;..var Latitude2;..var StationType;..var TypeOfShipAndCargoType;..var Spare2;..var Tx_RxMode;..var ReportingInterval;..var QuietTime;..var Spare3;....MessageId = ubin(#bin,0,6);..if (MessageId == 23){.. RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. Longitude1 = bin(#bin,40,18);.. Latitude1 = bin(#bin,58,17);.. Longitude2 = bin(#bin,75,18);.. Latitude2 = bin(#bin,93,17);.. StationType = ubin(#bin,110,4);.. TypeOfShipAndCargoType = ubin(#bin,114,8);.. Spare2 = ubin(#bin,122,22);.. Tx_RxMode = ubin(#bin,144,2);.. ReportingInterval = ubin(#bin,146,4)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-KD8OM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5586
Entropy (8bit):	4.639872418726296
Encrypted:	false
SSDEEP:	96:G82eWJa8sIwyrJxla8YYXcvk4SDXUExuQdcvUmG8sOtUMMxtXBmNE8sIwyrJxr4o:GFepnyrJxY8YYXcvk4SDXUE0QdcvUmGS
MD5:	F86CB804C7E51DEAFA614D07A5B5F71B
SHA1:	98D7346554402971F6C34BD0B38D0CEF3439304F
SHA-256:	6D80DD72D8D50974DFF95CBC0F41E39F4069B68AC6B6F91D7C1523CBF8510F22
SHA-512:	4DBE448D29357F6AD2BEBCDD3FF8CE543362940776A022A87C2A75F2D243065055EBA9F5DED5D54870E574CE80BC437E71C7C8648D6A453FC0CB8774C236D312
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var ReservedForRegionalOrLocalApplications;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var ReservedForRegionalApplications;..var ClassB_UnitFlag;..var ClassB_DisplayFlag;..var ClassB_DSCFlag;..var ClassB_BandFlag;..var ClassB_Message22Flag;..var ModeFlag;..var RAIM_flag;..var CommunicationStateSelectorFlag;..var SyncState;....var SlotTime_Out;..var SubMessage;....var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);....if (MessageId == 18){.. CommunicationStateSelectorFlag = ubin(#bin,148,1);.. if (CommunicationStateSelectorFlag == 0){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. ReservedForRegionalOrLocalApplications = ubin(#bin,38,8);.. SOG = ubin(#bin,46,10);.. PositionAccuracy =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-L8A6R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	4.582404421318364
Encrypted:	false
SSDEEP:	48:g7GuSPGS6c7lh9YtVBcDxKkgJ/q2kBKJkEcJyR80/g:QXBc4kgc2kMJkEcy80/g
MD5:	AEC39D3C44EF9A4AD85EAF88B3BC0AE4
SHA1:	E58692F76F4A77D30F2DE391F6E7C83127966A5A
SHA-256:	0C48F29A146F847A20B3EF8229D792A667B1CAACB76E918863BFB8ED2C084982
SHA-512:	E2CFABF3DC560A478EC50217DE1FEF8A89BE7CD5EFF4B62FF092C592E3DBC2BC2E0CA811F6AE403B65FFD221838086E83D9EED2985F0209D5C27CD5BA683915C
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationID1;..var MessageID1_1;..var SlotOffset1_1;..var Spare2;..var MessageID1_2;..var SlotOffset1_2;..var Spare3;..var DestinationID2;..var MessageID2_1;..var SlotOffset2_1;..var Spare4;....MessageId = ubin(#bin,0,6);..if (MessageId == 15){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationID1 = ubin(#bin,40,30);.. MessageID1_1 = ubin(#bin,70,6);.. SlotOffset1_1 = ubin(#bin,76,12);.. Spare2 = ubin(#bin,88,2);.. MessageID1_2 = ubin(#bin,90,6);.. SlotOffset1_2 = ubin(#bin,96,12);.. Spare3 = ubin(#bin,108,2);.. DestinationID2 = ubin(#bin,110,30);.. MessageID2_1 = ubin(#bin,

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-MTB2O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	4.733545938429769
Encrypted:	false
SSDEEP:	24:gMiHrGpW+5HAGm516G/dBS6z4NWr5I6NQcOsxKkLvaF/JQ3acIDYT/WV6x6aF/3y:g7LQHf+S6z4Er5dOcDxKkLvaF/JQ3acA
MD5:	EBB74D32511FC192E9515B34BDE27BCF
SHA1:	B30B8F09959AE516993B1A91A9B39D73A5059E8B
SHA-256:	A1110A7CA10FAA20FA25FF05C5094CE00258F2951C77AD55111BA6EC241BEB9B
SHA-512:	F6C3F5687F6C849F74AD5A6D18BB13DC02D77D4B89F198E86763113C1ED65F63DFC673891FD0FF769164D61CD7F8C74A2E5EB8B8660D41ED0069CC8D241EF7B8
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var SequenceNumber;..var DestinationID;..var RetransmitFlag;..var Spare;..var DAC;..var FunctionIdentifier;..var AcknowledgedRequiredFlag;..var TextSequenceNumber;..var ApplicationData;....MessageId = ubin(#bin,0,6);..if (MessageId == 6 ){.. RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. SequenceNumber = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. RetransmitFlag = ubin(#bin,70,1);.. Spare = ubin(#bin,71,1);.. DAC = ubin(#bin,72,10);.. FunctionIdentifier = ubin(#bin,82,6);.. AcknowledgedRequiredFlag = ubin(#bin,88,1);.. TextSequenceNumber = ubin(#bin,89,11);.. ApplicationData = str(#bin,100,906);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndic

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-O2UM4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3805
Entropy (8bit):	4.6112502300957185
Encrypted:	false
SSDEEP:	96:KTWfTcP0xdBIx16c44+8EYSTX0kxuw8c0MxdXBmNvcP0xdBIxbVxc44+8EYSTX02:o6n2xIc44+8EYSTX0kUw8c0MxdAd2xTl
MD5:	08A27D7DAB316E88B8983F53967B5341
SHA1:	2A4F12A483E5E96A8E8A067BCF4D49F566EEB9A5
SHA-256:	C98467BC48919E9808BF3F70DA3187CF5D91D3B63012ADCCDFC7EDBD4FB5E246
SHA-512:	20202D926A44AE7B0C64ACEF17A195C9D3FE211822E0A47E41BAB3241667D9B34DBA35231F403D12D6C821AEF7E4A5AE4D2606A09DD6B5A47CF94B1FF2716AE5
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var NavigationalStatus;..var RateOfTurn;..var SOG;..var PositionAccuracy;..var Longitude;..var Latitude;..var COG;..var TrueHeading;..var TimeStamp;..var SpecialManoeuvreIndicator;..var Spare;..var RAIM_flag;..var SyncState;....var SlotTime_Out;..var SubMessage;....var SlotIncrement;..var NumberOfSlots;..var Keep_flag;....MessageId = ubin(#bin,0,6);..if (MessageId == 1 \|\|.. MessageId == 2){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. NavigationalStatus = ubin(#bin,38,4);.. RateOfTurn = bin(#bin,42,8);.. SOG = ubin(#bin,50,10);.. PositionAccuracy = ubin(#bin,60,1);.. Longitude = bin(#bin,61,28);.. Latitude = bin(#bin,89,27);.. COG = ubin(#bin,116,12);.. TrueHeading =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-OAHQH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	4.7362638022136645
Encrypted:	false
SSDEEP:	24:KMiHrGpW+5HAGm516G/dBS6z4NWr5I6NQcOsxKkLvaF/JQ3acIDYT/WV6x6aF/3y:K7LQHf+S6z4Er5dOcDxKkLvaF/JQ3acA
MD5:	A4AC9A0128F2B41237A8E46BC91ACD30
SHA1:	3E711BFE84B4FCD9E43F9341B87D1E33F32905A6
SHA-256:	86CA1226C781E7F196880151F31E06470F5DE2BF2B2D99E6CCDA10C213D65E7C
SHA-512:	B6F9E79DEC0A45112D9C558CF4ED9146802D4FF88A59FFE7375449111FE261696A5E99B3ED9FA24E89B34663ECC6EEDB1553F8030B5ED6055EF5E69452386838
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var SequenceNumber;..var DestinationID;..var RetransmitFlag;..var Spare;..var DAC;..var FunctionIdentifier;..var AcknowledgedRequiredFlag;..var TextSequenceNumber;..var ApplicationData;....MessageId = ubin(#bin,0,6);..if (MessageId == 6 ){.. RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. SequenceNumber = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. RetransmitFlag = ubin(#bin,70,1);.. Spare = ubin(#bin,71,1);.. DAC = ubin(#bin,72,10);.. FunctionIdentifier = ubin(#bin,82,6);.. AcknowledgedRequiredFlag = ubin(#bin,88,1);.. TextSequenceNumber = ubin(#bin,89,11);.. ApplicationData = str(#bin,100,906);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndic

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-P3BMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1159
Entropy (8bit):	5.206059151715646
Encrypted:	false
SSDEEP:	24:gM8XoGnkD+3v+8mu+YOHZJLNKicOsxK4YbgLaaRDTX2zEk0i:go8MHZvHcDxK4Y0+STX2zEk0i
MD5:	49C18CBF5D067407D73FEC29DA1D2014
SHA1:	72BCF26A725B923E0717D71D703357E368BAADE8
SHA-256:	6037FD2028119CC82B40116AFE7077841D9C21DC257AB4B385BDD3DACA81E7B6
SHA-512:	9BAAAD149EFB3B0F01854DF7FFC51E5C9543FAA449554DB2D96B8DCF6AF2A389E77824DBF248C0DFC925CB585AD0B0086E9AC6EF1F40CA59F19294D0FCEC59E2
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var PositionAccuracy;..var RAIM_flag;..var NavigationalStatus;..var Longitude;..var Latitude;..var SOG;..var COG;..var StatusOfCurrentGNSSPosition;..var Spare;......MessageId = ubin(#bin,0,6);..if (MessageId == 27){...RepeatIndicator =....ubin(#bin,6,2);...UserID =......ubin(#bin,8,30);...PositionAccuracy = ....ubin(#bin,38,1);...RAIM_flag = .....ubin(#bin,39,1);...NavigationalStatus = ...ubin(#bin,40,4);...Longitude = .....bin(#bin,44,18);...Latitude = ......bin(#bin,62,17);...SOG = .......ubin(#bin,79,6);...COG = .......ubin(#bin,85,9);...StatusOfCurrentGNSSPosition = .ubin(#bin,94,1);.. Spare =.......ubin(#bin,95,1);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("UserID", UserID);.. map("PositionAccuracy", PositionAccuracy);.. map("RAIM_flag", RAIM_flag);.. map("NavigationalStatus", NavigationalStatus);.. map("Longitude", Longitude);.. map("Latitud

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-R6P4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1942
Entropy (8bit):	4.944196219842957
Encrypted:	false
SSDEEP:	48:g7J1Rh2Nz4ODxUWJ6fCVrODxUWJ6fuoLJlODxUWJ6fgJQ/VMODxUWJ6fgJQq:T4OaWQ2rOaWQ1lOaWQgEMOaWQgD
MD5:	6CBAFD95C614454E3B8E372817EE3FDA
SHA1:	51324E5242866262673C2B6A7F2B1C313EB0401B
SHA-256:	CA3190EC432D04CE92A9F13F238484221F401061BEC8FAED4348AA3C8508EFEA
SHA-512:	0FD452A0A627928CE8B1328E1091FBF822D74E552F81102399D7FF34E4B2D1FD10E521D8FE3E887C808C114746C93DC5CBB28A6F4F630C8900F30EBA5A620DCD
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var DestinationIndicator;..var BinaryDataFlag;..var DestinationID;..var BinaryData;......MessageId = ubin(#bin,0,6);..if (MessageId == 25){.....RepeatIndicator =....ubin(#bin,6,2);...SourceID =......ubin(#bin,8,30);...DestinationIndicator =...ubin(#bin,38,1);...BinaryDataFlag =....ubin(#bin,39,1);.....if (DestinationIndicator == 0) {....if (BinaryDataFlag == 0) {.....BinaryData =....strHex(#bin,40,128);...... map("MessageId", MessageId);.... map("RepeatIndicator", RepeatIndicator);.... map("SourceID", SourceID);.... map("DestinationIndicator", DestinationIndicator);.... map("BinaryDataFlag", BinaryDataFlag);.....map("BinaryData", BinaryData);....}....else if (BinaryDataFlag == 1) {.....BinaryData =....strHex(#bin,40,112);...... map("MessageId", MessageId);.... map("RepeatIndicator", RepeatIndicator);.... map("SourceID", SourceID);.... map("DestinationIndicator", DestinationIndicator);

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-RGN3U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.671076875893976
Encrypted:	false
SSDEEP:	24:gMiHrGpW+5HX9S6z4NWrvScOsxKkLvaF/JQ3acDz3i:g7LQd9S6z4ErvScDxKkLvaF/JQ3acDzy
MD5:	73496C60D3431A20685EDDE4FBD88748
SHA1:	1F04A3E7FE04A57A8D508DB7E0AF167171CBBC74
SHA-256:	F1AFE5FA585384C9A609345ECA1CA7FF4C3E32FB1AB8AC3E8098792DEFDE7B3F
SHA-512:	A8E17CF73160A99276A40C925615ABE8F2E4765DF859683AEB352A59A347B1B16A2F41AB67DD44462DEFCD2E13E14A6CE5C0704FFC0191BD3BAA44AD8B623DE0
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceID;..var SequenceNumber;..var DestinationID;..var RetransmitFlag;..var Spare;..var SafetyRelatedText;....MessageId = ubin(#bin,0,6);..if (MessageId == 12){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. SequenceNumber = ubin(#bin,38,2);.. DestinationID = ubin(#bin,40,30);.. RetransmitFlag = ubin(#bin,70,1);.. Spare = ubin(#bin,71,1);.. SafetyRelatedText = str(#bin,72,936);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("SourceID", SourceID);.. map("SequenceNumber", SequenceNumber);.. map("DestinationID", DestinationID);.. map("RetransmitFlag", RetransmitFlag);.. map("Spare", Spare);.. map("SafetyRelatedText", SafetyRelatedText);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-RNFH8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	4.58269262036734
Encrypted:	false
SSDEEP:	48:K7GuSPGS6c7lh9YtVBcDxKkgJ/q2kBKJkEcJyR80/g:WXBc4kgc2kMJkEcy80/g
MD5:	55730594AEB619252754C447E5E8010C
SHA1:	4974469F00CB2F2AA9ACE609C50F10649641B423
SHA-256:	BDE724937067176B94557BA1AB9F09AB72191B5F9C9363A908EB61A33FBA46F8
SHA-512:	86BECC2379323115BE82E0C0F143ABF01861386B0700E7A90357EB52A8560640593BCFC80BD77C22753FC4B6836503936151F317E0DCF6474EFBDE9A2DB92869
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var DestinationID1;..var MessageID1_1;..var SlotOffset1_1;..var Spare2;..var MessageID1_2;..var SlotOffset1_2;..var Spare3;..var DestinationID2;..var MessageID2_1;..var SlotOffset2_1;..var Spare4;....MessageId = ubin(#bin,0,6);..if (MessageId == 15){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. DestinationID1 = ubin(#bin,40,30);.. MessageID1_1 = ubin(#bin,70,6);.. SlotOffset1_1 = ubin(#bin,76,12);.. Spare2 = ubin(#bin,88,2);.. MessageID1_2 = ubin(#bin,90,6);.. SlotOffset1_2 = ubin(#bin,96,12);.. Spare3 = ubin(#bin,108,2);.. DestinationID2 = ubin(#bin,110,30);.. MessageID2_1 = ubin(#bin,

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-S33B7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1838
Entropy (8bit):	4.853931101960552
Encrypted:	false
SSDEEP:	48:KYIJPSYIIFRNWcDxK4c+F/TGyfkM5ihTE34JNoYi:fI9PzEc44c+F/yyfkM5ihTEoMYi
MD5:	292243A99DBFEA030E07AC41B06EAA3B
SHA1:	0593054762979355BB5E9C7045F159B450476C56
SHA-256:	45ED8601C3580033614AA92B7CAA4A6DEB8FADFB1C9BCCC37AB469AA991C8019
SHA-512:	B2AC1F95B52AA509CE3428E4B1BF85FA410997DB20C850F8DA5790C9606F9E347A16A2A3975ACE559EC57424A3FBF38343746995316F2574A0DF89C52F3AB8FB
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var AISVersionIndicator;..var IMONumber;..var CallSign;..var Name;..var TypeOfShipAndCargoType;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var ETA;..var MaximumPresentStaticDraught;..var Destination;..var DTE;..var Spare;....MessageId = ubin(#bin,0,6);..if (MessageId == 5){.... RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. AISVersionIndicator = ubin(#bin,38,2);.. IMONumber = ubin(#bin,40,30);.. CallSign = str(#bin,70,42);.. Name = str(#bin,112,120);.. TypeOfShipAndCargoType = ubin(#bin,232,8);.. Dimension_ReferenceForPosition = ubin(#bin,240,30);.. TypeOfElectronicPositionFixingDevice = ubin(#bin,270,4);.. ETA = ubin(#bin,274,20);.. MaximumPresentStaticDraught = ubin(#bin

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-T0JRO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4969
Entropy (8bit):	4.621697866558589
Encrypted:	false
SSDEEP:	96:mdhXTQRgAbc4kgSTX0MJ4cGJLvaF/sVucik2kqc2cPE4TQQcgcIMoQcEQ/okswgS:m4aYc4kgSTX0i4cGJLvaJswcik2kqc2y
MD5:	6C551F89800A1B5F2818FEB92BAD1129
SHA1:	D446EA1576FF981951CFA621F13673B5CEFEB8A0
SHA-256:	4F790FC6E2E3FB08EFA4728A871232D6A4BF6B685616E80BE2602A880EDDECDD
SHA-512:	20C8659577692821FC0F321A145BB056FFC12E73D2FFE306FC7235EBFA1FC0B1D53B0362B0BABCB6BEE4D92A162BDED006AC81B7D25DEC27E0EBBE423BDB0505
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var SourceID;..var Spare1;..var Longitude;..var Latitude;..var Spare2;..var MessageType;..var StationID;..var ZCount;..var SequenceNumber;..var N;..var Health;..var DGNSSDataWord1;..var DGNSSDataWord2;..var DGNSSDataWord3;..var DGNSSDataWord4;..var DGNSSDataWord5;..var DGNSSDataWord6;..var DGNSSDataWord7;..var DGNSSDataWord8;..var DGNSSDataWord9;..var DGNSSDataWord10;..var DGNSSDataWord11;..var DGNSSDataWord12;..var DGNSSDataWord13;..var DGNSSDataWord14;..var DGNSSDataWord15;..var DGNSSDataWord16;..var DGNSSDataWord17;..var DGNSSDataWord18;..var DGNSSDataWord19;..var DGNSSDataWord20;..var DGNSSDataWord21;..var DGNSSDataWord22;..var DGNSSDataWord23;..var DGNSSDataWord24;..var DGNSSDataWord25;..var DGNSSDataWord26;..var DGNSSDataWord27;..var DGNSSDataWord28;..var DGNSSDataWord29;....MessageId = ubin(#bin,0,6);..if (MessageId == 17){.... RepeatIndicator = ubin(#bin,6,2);.. SourceID = ub

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-U4DIA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	4.963806832412181
Encrypted:	false
SSDEEP:	48:Kbl8K0/iBSBrJ52aOt0+uKTcDxKKa4+XgYSTX2zM5ihTwrYI0/0/0Tgu0Oa:ZJ/iB+J52aOq+uKTc4Ka4+XgYSTX0M5n
MD5:	A4301C435AB0957C052AEBC900E5EDA7
SHA1:	9222D178AFD897173586D87393E28CBDF683678D
SHA-256:	838BFD687CDFF728A4115EEA3DD320AD79487979D91B8F9B6B040C46E0D6F562
SHA-512:	3C85E1EF1715F97714A03B984366DF4E6C2393814CE4B81E7CF207BB5395B11266E0A4AF7691DDDB7AD1726403D21D21CC37E9640C7004F67523B0683687F4CC
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var ID;..var TypeOfAids_To_Navigation;..var NameOfAids_To_Navigation;..var PositionAccuracy;..var Longitude;..var Latitude;..var Dimension_ReferenceForPosition;..var TypeOfElectronicPositionFixingDevice;..var TimeStamp;..var Off_PositionIndicator;..var ReservedForRegionalOrLocalApplications;..var RAIM_flag;..var Virtual_AtoN_flag;..var AssignedModeFlag;..var NameOfAidToNavigationExtension;..var Spare;....MessageId = ubin(#bin,0,6);..if (MessageId == 21){.... RepeatIndicator = ubin(#bin,6,2);.. ID = ubin(#bin,8,30);.. TypeOfAids_To_Navigation = ubin(#bin,38,5);.. NameOfAids_To_Navigation = str(#bin,43,120);.. PositionAccuracy = ubin(#bin,163,1);.. Longitude = bin(#bin,164,28);.. Latitude = bin(#bin,192,27);.. Dimension_ReferenceForPosition = ubin(#bin,219,30);.. TypeOfElectronicPositionFixi

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-U5UJ4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1764
Entropy (8bit):	4.641806635168766
Encrypted:	false
SSDEEP:	48:KAK6eaSYL8DxKYeFvbzl08DxKYeFvfETmTGxk8kFE:jK6ea38YYeFvbzu8YYeFvfETmyxk8kFE
MD5:	67F142757376FBA905ED6F41F5C93B4F
SHA1:	10C4E2A99321B2DCC3FD8C9AA5EE2481FB8A7F0C
SHA-256:	CB8B63B022B1784CECBB55190E61F1308363E02BA682A761D0A1C0C05A50A444
SHA-512:	A0EF26B8FFB6AAB5516B9AD28C218CD1C8CDCE443E183081B11D8A06208AFEA17C735287665EB7B05C3F8F3324161205A5796D67C65C2A3BAA97E4381D53359D
Malicious:	false
Preview:	Search for AIVDO....var MessageId;....var RepeatIndicator;..var UserID;..var PartNumber;....var Name;....var TypeOfShipAndCargoType;..var VendorID;..var CallSign;..var Dimension_ReferenceForPosition;..var ManufacturerID;..var UnitModelCode;..var UnitSerialNumber;....MessageId = ubin(#bin,0,6);....if (MessageId == 24){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. PartNumber = ubin(#bin,38,2);.... if (PartNumber == 0){.. Name = str(#bin,40,120);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("UserID", UserID);.. map("PartNumber", PartNumber);.. map("Name", Name);.. }.. else if (PartNumber == 1){.. TypeOfShipAndCargoType = ubin(#bin,40,8);.. VendorID = str(#bin,48,42);.. CallSign = str(#bin,90,42);.. Dimension_R

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-UC5EK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	4.595677246392144
Encrypted:	false
SSDEEP:	48:g7yTG4T0eS6cnBRn9ovG+64bcDxKcgAclek8Zk4H1+40ro0cKiHSBKV:7TrTruBfMG+Rc4cgAclek8Zk4H1+40r4
MD5:	39832F29DDF54ED5059462922C4FDE5E
SHA1:	00F8777F4245EAFCB7F9ED04FC1F582CA143F931
SHA-256:	8DE6916A690FEFA550B5DDB020F2563BEDEE3FE4F7D6C64F68B45473B54E5D4F
SHA-512:	7641DE369F3C6A184093F1E4C45F37FEF1C3EF5B6EAD896E079150906498604A03C38B2F2E8BE26A01491E9903E8D697CD0F776F3F8D217DDE8B6BB5098C32A2
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var SourceStationID;..var Spare1;..var OffsetNumber1;..var NumberOfSlots1;..var Time_Out1;..var Increment1;..var OffsetNumber2;..var NumberOfSlots2;..var Time_Out2;..var Increment2;..var OffsetNumber3;..var NumberOfSlots3;..var Time_Out3;..var Increment3;..var OffsetNumber4;..var NumberOfSlots4;..var Time_Out4;..var Increment4;..var Spare2;....MessageId = ubin(#bin,0,6);..if (MessageId == 20){.... RepeatIndicator = ubin(#bin,6,2);.. SourceStationID = ubin(#bin,8,30);.. Spare1 = ubin(#bin,38,2);.. OffsetNumber1 = ubin(#bin,40,12);.. NumberOfSlots1 = ubin(#bin,52,4);.. Time_Out1 = ubin(#bin,56,3);.. Increment1 = ubin(#bin,59,11);.. OffsetNumber2 = ubin(#bin,70,12);.. NumberOfSlots2 = ubin(#bin,82,4);.. Time_Out2 = ubin(

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-UV478.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	4.653299811783491
Encrypted:	false
SSDEEP:	48:gAK6eaSYL8DxKYeFvbzl08DxKYeFvfETmTGxk8kFE:RK6ea38YYeFvbzu8YYeFvfETmyxk8kFE
MD5:	BEB8FCC7DD17D0FC0B937F5D3E355CD7
SHA1:	D15EBCBBD1E6E012FC3AC2D4F1B8BC8540D45E80
SHA-256:	91E77A991C86BD026871E7EA6091FFD149625F381709811360FEA032E9840EE3
SHA-512:	016705DD0D7394DD71945FEDAEBA2E9974BD74ED5D602D591AA33D12115E8BDD1158FE32E4DB7C055C634FE20248AEDE76D3EA100DF0B7BF4D3A70545E532332
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var PartNumber;....var Name;....var TypeOfShipAndCargoType;..var VendorID;..var CallSign;..var Dimension_ReferenceForPosition;..var ManufacturerID;..var UnitModelCode;..var UnitSerialNumber;....MessageId = ubin(#bin,0,6);....if (MessageId == 24){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. PartNumber = ubin(#bin,38,2);.... if (PartNumber == 0){.. Name = str(#bin,40,120);.... map("MessageId", MessageId);.. map("RepeatIndicator", RepeatIndicator);.. map("UserID", UserID);.. map("PartNumber", PartNumber);.. map("Name", Name);.. }.. else if (PartNumber == 1){.. TypeOfShipAndCargoType = ubin(#bin,40,8);.. VendorID = str(#bin,48,42);.. CallSign = str(#bin,90,42);.. Dimension_R

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\is-VM2OI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2270
Entropy (8bit):	4.808604794064066
Encrypted:	false
SSDEEP:	48:gfo/v+2LZlUSYjt0hJ2cuyopDfkvLcDxK4s8ikMp2MB9hiYSTX2z5ihTxs28s2By:HtLZlUl0h4cux16c44s8ikMp2MbgYSTL
MD5:	A1D955F86AF7F9DFB8181637A6F190E5
SHA1:	5C1BEFFE36E0AEFAC0E04C00547F9CC9F0A47E9B
SHA-256:	4AF3F2DB153A21F033070AAFB8CA9BFDD271B9A7F9F6DC5FD6AD2866B668D245
SHA-512:	8BF98FC5EE65B830B2CAD718BEB2983F19F6E540E8891CD12EB9AC90961A5B9B4ADC1FE8D07A00FA442CFFDD38BD8E7A27BBD8198F7521486D2029B61A69D8A7
Malicious:	false
Preview:	Search for AIVDM....var MessageId;....var RepeatIndicator;..var UserID;..var UTCYear;..var UTCMonth;..var UTCDay;..var UTCHour;..var UTCMinute;..var UTCSecond;..var PositionAccuracy;..var Longitude;..var Latitude;..var TypeOfElectronicPositionFixingDevice;..var TransmissionControlForLongrangeBroadcastMessage;..var Spare;..var RAIM_flag;..var SyncState;..var SlotTime_Out;..var SubMessage;....MessageId = ubin(#bin,0,6);..if (MessageId == 4 \|\|.. MessageId == 11){.. RepeatIndicator = ubin(#bin,6,2);.. UserID = ubin(#bin,8,30);.. UTCYear = ubin(#bin,38,14);.. UTCMonth = ubin(#bin,52,4);.. UTCDay = ubin(#bin,56,5);.. UTCHour = ubin(#bin,61,5);.. UTCMinute = ubin(#bin,66,6);.. UTCSecond = ubin(#bin,72,6);.. PositionAccuracy = ubin(#bin,78,1);.. Longitude =

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\combine.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	352256
Entropy (8bit):	5.802065785822964
Encrypted:	false
SSDEEP:	6144:K7wMUPVG6p6aH0hgfLt9o8/2Q4/u8EE4evApyT0zQEVIFzhCOvkohG93dBNlHYMr:K75UPVOELSynwGQDf0/L3KpfCFiBV9ZK
MD5:	1669F9908DBDCA5C41F3C3716B69F0F6
SHA1:	65CB7E616D5AF8F7FDD7C42ADFEFD12678A53086
SHA-256:	EAE40AB4DA851C51CA3358A89F5F192F358390C43BD57231D3BE0C53106679ED
SHA-512:	7ECE3BBEECE2B9EB23BA54EAFBEB7014D46C78DA9C811890E9A0C9F7055E8BB44727AD634AB275AC51EF720783C003C0A5CD891FA9347203BE3D804396136488
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|...\|...\|....R.~...[P.k...[P.}...[P.}...Rich\|...........................PE..L....\|.[.................p..........<.............@..........................`.......G....@..................................;..(....@.......................P......p...................................................................H............text....j.......p.................. ..`.rdata..z...........................@..@.rsrc........@.......@..............@..@.reloc.......P.......P..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\ExtractSentenceDataInfo.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	293
Entropy (8bit):	4.525014586331824
Encrypted:	false
SSDEEP:	6:3m+YC0kumLw2p2H+0YG2q8Uhpu60kumLw2p2H+0YG2q8Uhpn:j1Xw2pW//N8UbBXw2pW//N8Ubn
MD5:	033B7E9065C575DA635A0CB9AF2EB4A0
SHA1:	F8B74DADC1B5AFA5874971B55E93990BFA1D70B1
SHA-256:	E1B17DE7A1EC3386392294E420FE615B0E95B22F8AE993329FD92CD97E281B32
SHA-512:	812C59A2549E5C506DE1A929B177B66F639784EBAF8822160C6B67684AF9519A5969E7060ADC60693EBAF934B952735FF2FDC3692DEC6BD224CE9400E935BF5C
Malicious:	false
Preview:	#._.C.A...O.\...p..View=ACM,ACN,ALA,ALC,ALF,ALR,DOR,DPT,DTM,ETL,FIR,GEN,GNS,HBT,HDG,HDT,HSS,HTC,HTD,MWV,PRC,RPM,RSA,TRC,TRD,VBW,VDM,VDO,WAT,XDR,ZDA....#.d...p..Request=ACM,ACN,ALA,ALC,ALF,ALR,DOR,DPT,DTM,ETL,FIR,GEN,GNS,HBT,HDG,HDT,HSS,HTC,HTD,MWV,PRC,RPM,RSA,TRC,TRD,VBW,VDM,VDO,WAT,XDR,ZDA..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\JNIDll.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.8586043469919
Encrypted:	false
SSDEEP:	3:pyeoOpR4YzANYcuGAeTNDYPv3vnwjGkZaum/vnwjGkZkqzVo/vnwjGkL0YMovov:pNBRL5GAkNDIv3vZiCvZihUvZJLovy
MD5:	97673D0F3F41FC7683F3254861ECCD88
SHA1:	E6EAB7BF699EC44AB9A0A5790225A1AD09B30CAC
SHA-256:	41A928CE7E46F7B837B8BA56350E8B5AC16E7C2A59C1F0F1E13CC1B35D86AF18
SHA-512:	E9BD9A69E26C3F7D3E471ADD8C3322C9207A1A273EE63EFAF05C63069E3BA9B08A6AFDC07ED7C9168613106BA2239C9876FC322C33AE7EAC36AEA5B0ABE2485B
Malicious:	false
Preview:	[AUDIO]..;..Format=0..;..TestCh=9..;..RTPNoReceiveTimeThreshold=2000..;..BUFFERING_BUFFER_TIME=10000..;..BUFFERING_BUFFERING_TIME=5000..;..BUFFERING_BSIZE_SMA=10....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\SoftWareLogConfig.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	496
Entropy (8bit):	4.845217196904258
Encrypted:	false
SSDEEP:	12:jtDxhKXsFcNxoDGk5nd86aYrtcgQSRPUZr:jtxFcH8GL6thxZsZr
MD5:	C0582BB0D509E17E929E10B06019817B
SHA1:	506B4FCBA9DC928D9D57D15FB9A5B433EA7A0860
SHA-256:	96F0DB08B88A8AD2F4914F3ECC462BD98A322692D19B198B3B42A94CFBC7215D
SHA-512:	75DA41B0AEBD5A80DBD45E2EC297A3F01FEB92CA503FF11C923C8E56AE47128B4300A0F0CB6C5513EEFE7DEB27251250FBA4996A499F7D29A6A85E2EB1555435
Malicious:	false
Preview:	#._.C.A...O.\...p..View=scadaserv,jbserv,radarserv,audioserv,logger,mmdeliserv,dserv,storageserv,extserv,pduserv,statmon,alarmserv,compserv,storagemaster,longtermserv,fixeddruserv,floatdruserv,userdiskserv,scserv,rapserv,amsserv,serialbroad,moduleserv,vlcupdateserv,dcaserv....#.d...p(.\|.[.g...)..Request=15000,12001,10113,10103,10020,10109,24005,10200,10106,10102,10092,10100,10104,10204,10203,10201,10202,10205,10116,10117,10118,10119,10110,10120,10130....#Detail.d...p(ON\|OFF)..Detail=2,1\|2,0

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\UserAlarmConfig.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	310
Entropy (8bit):	5.8919784671826125
Encrypted:	false
SSDEEP:	6:nJMHgyQZkUUvJVrI2LxNeWM2jM+5N8KXIhADB/xSG2mjMPOLKXIhADB/1Wr4:nJ932vJVRLxLM2uvAd5SGBUOLvAd9u4
MD5:	E79C4648F2E0BBFC08688DB8B6547736
SHA1:	578B54EAC3D84CF622AE4E14ABE041EE38282134
SHA-256:	B621B2A410F4331212E96067A60102EDA4943D8CA9A8CAA5ECB41428BCB8D6E7
SHA-512:	4C12EDE7BC515F7A1629FAB447211B8410E2381CA5E1EBBF1009E8DB68139C4C754A63781E51903BFD45A9BA6FBB38442D711125FBECB994A9AA44A96398AB65
Malicious:	false
Preview:	#..# ...[.U..`.A...[....A...`.B.g.p....N...X...L.[..............# $Id: UserAlarmConfig.ini,v 1.1 2007/10/04 13:26:57 h-adachi Exp $..#....# ...[.U..`.A...[.......`....AlarmDefinitionListDialog.maxAlarmSize=50....# ...[.U..`.A...[..............AlarmDefinitionDialog.maxAlarmNameLength=100....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\audio.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Generic INItialization configuration [Hz]
Category:	dropped
Size (bytes):	418
Entropy (8bit):	4.715922343484061
Encrypted:	false
SSDEEP:	12:7ANNfeqTfzMMZfeqTfATfQRNHWrFAQcUFNqdM/4RNiSh:kL1YE1goRNHGuD8eX
MD5:	A56E7B14AC1DA6FBBE8ABE0900150832
SHA1:	DA899FCABDDEB5DD3A029539396408E57C1D46F0
SHA-256:	261E02EA0B948D4493813D399886BE24B232AEAF6E3E9D4C73CD11559CFC2FEE
SHA-512:	1928D3C57951C688D58F7EA5A3CE69A1753486C33225A617955E2552F7D3F07EE2E2B12F08553D481135189410C833960C429CEEEA582393465396D312093389
Malicious:	false
Preview:	[Audio Settings]....; Wheather secondary buffers are allocated on software memory or not..; If set to 1, secondary buffers are allocated on software memory...; If 0, they are allocated on hardware memory...LocSoftWare=0....; Audio playing frequency[Hz]..PlayFrequency=44100....; Write period[ms]..WritePeriod=100....; Wheather DirectSound is restored or not when DirectSound error was occured..RestoreDirectSound=0....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\configure.xsd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3499
Entropy (8bit):	3.8109413133981853
Encrypted:	false
SSDEEP:	12:MMHdwYqw1laDCDWfjrEtYSqfGfSfGYtffafjpKMofCfGfKfWHCyfjqf6fGfifWH4:JdGw1laDwYnHWIsNemg9pBRsPVcUlHsx
MD5:	2B90076C91D4C836062D461C7C100127
SHA1:	278EC34D0C6F28F5FC6A25D281751B3E610EB58E
SHA-256:	D8960BA6522FA12F20EB2E20E6646B493656DF30049DE51CEDCCBA5DAD5D6D6A
SHA-512:	E076E6F49CA546BC5464C5DBDF6F3C159E05F3663AF135C4C53CE2851AC958F216E9A0974532B8471D2365487C7BCD37586C2999F86F8A84B953952DB91492BA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<xs:schema id="config" xmlns="" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">.. <xs:element name="config" msdata:IsDataSet="true" msdata:Locale="en-US">.. <xs:complexType>.. <xs:choice minOccurs="0" maxOccurs="unbounded">.. <xs:element name="category">.. <xs:complexType>.. <xs:sequence>.. <xs:element name="data" minOccurs="0" maxOccurs="unbounded">.. <xs:complexType>.. <xs:sequence>.. <xs:element name="channel" minOccurs="0" maxOccurs="unbounded">.. <xs:complexType>.. <xs:sequence>.. <xs:element name="parameter" minOccurs="0" maxOccurs="unbounded">.. <xs:complexType>.. <xs:attribute name="id" type="xs:string" />.. <xs:attribute name="name" type

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\is-0GEGJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	5.1123851417888
Encrypted:	false
SSDEEP:	24:2d3vcFaZMiRPHaXsOM1rxXMdqksgsmK9q7sgsO:c3UFKvP6XsOmxXMdBsgsmK9MsgsO
MD5:	F5E5AE9CC45A6AEB783D78DB9CC44DBD
SHA1:	D8404CCF9F2530E7F0B23295476783A377FA55F0
SHA-256:	69DFE8856E5C95ECFFCB7DF2E64C2E223F7266CB4B0509BD05DB18E15A6B78B6
SHA-512:	F27D94067B28D2876B6F8944DDF47CC4A65C915137E97A44FF013BDEDF86D81BE34C642C69716C500D0640AF2112C4B93CBD3E57B71D245EAE9A0479C0EA68D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">....<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>.... <appender name="file" class="org.apache.log4j.RollingFileAppender">.. <param name="File" value="log/maintenance.log" />.. <param name="Append" value="true" />.. <param name="MaxFileSize" value="5MB" />.. <param name="MaxBackupIndex" value="20" />.. <layout class="org.apache.log4j.PatternLayout">.. <param name="ConversionPattern".. value="%d{yyyy/MM/dd HH:mm:ss,SSS} [%-5p] [%t] [%c{2}:%M:L%L] - %m%n"/>.. </layout> .. </appender>.... <appender name="STDOUT" class="org.apache.log4j.ConsoleAppender">.. <layout class="org.apache.log4j.PatternLayout">.. <param name="ConversionPattern".. value="%d{yyyy/MM/dd HH:mm:ss,SSS} [%-5p] [%t] [%c{2}:%M:L%L] - %m%n"/>.. </layout> .. </appender>.... <root>.. <priority value ="info" />.. <appender-ref ref="STDOUT"

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\is-3HGK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	293
Entropy (8bit):	4.525014586331824
Encrypted:	false
SSDEEP:	6:3m+YC0kumLw2p2H+0YG2q8Uhpu60kumLw2p2H+0YG2q8Uhpn:j1Xw2pW//N8UbBXw2pW//N8Ubn
MD5:	033B7E9065C575DA635A0CB9AF2EB4A0
SHA1:	F8B74DADC1B5AFA5874971B55E93990BFA1D70B1
SHA-256:	E1B17DE7A1EC3386392294E420FE615B0E95B22F8AE993329FD92CD97E281B32
SHA-512:	812C59A2549E5C506DE1A929B177B66F639784EBAF8822160C6B67684AF9519A5969E7060ADC60693EBAF934B952735FF2FDC3692DEC6BD224CE9400E935BF5C
Malicious:	false
Preview:	#._.C.A...O.\...p..View=ACM,ACN,ALA,ALC,ALF,ALR,DOR,DPT,DTM,ETL,FIR,GEN,GNS,HBT,HDG,HDT,HSS,HTC,HTD,MWV,PRC,RPM,RSA,TRC,TRD,VBW,VDM,VDO,WAT,XDR,ZDA....#.d...p..Request=ACM,ACN,ALA,ALC,ALF,ALR,DOR,DPT,DTM,ETL,FIR,GEN,GNS,HBT,HDG,HDT,HSS,HTC,HTD,MWV,PRC,RPM,RSA,TRC,TRD,VBW,VDM,VDO,WAT,XDR,ZDA..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\is-9UO91.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.8586043469919
Encrypted:	false
SSDEEP:	3:pyeoOpR4YzANYcuGAeTNDYPv3vnwjGkZaum/vnwjGkZkqzVo/vnwjGkL0YMovov:pNBRL5GAkNDIv3vZiCvZihUvZJLovy
MD5:	97673D0F3F41FC7683F3254861ECCD88
SHA1:	E6EAB7BF699EC44AB9A0A5790225A1AD09B30CAC
SHA-256:	41A928CE7E46F7B837B8BA56350E8B5AC16E7C2A59C1F0F1E13CC1B35D86AF18
SHA-512:	E9BD9A69E26C3F7D3E471ADD8C3322C9207A1A273EE63EFAF05C63069E3BA9B08A6AFDC07ED7C9168613106BA2239C9876FC322C33AE7EAC36AEA5B0ABE2485B
Malicious:	false
Preview:	[AUDIO]..;..Format=0..;..TestCh=9..;..RTPNoReceiveTimeThreshold=2000..;..BUFFERING_BUFFER_TIME=10000..;..BUFFERING_BUFFERING_TIME=5000..;..BUFFERING_BSIZE_SMA=10....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\is-ID74P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	310
Entropy (8bit):	5.8919784671826125
Encrypted:	false
SSDEEP:	6:nJMHgyQZkUUvJVrI2LxNeWM2jM+5N8KXIhADB/xSG2mjMPOLKXIhADB/1Wr4:nJ932vJVRLxLM2uvAd5SGBUOLvAd9u4
MD5:	E79C4648F2E0BBFC08688DB8B6547736
SHA1:	578B54EAC3D84CF622AE4E14ABE041EE38282134
SHA-256:	B621B2A410F4331212E96067A60102EDA4943D8CA9A8CAA5ECB41428BCB8D6E7
SHA-512:	4C12EDE7BC515F7A1629FAB447211B8410E2381CA5E1EBBF1009E8DB68139C4C754A63781E51903BFD45A9BA6FBB38442D711125FBECB994A9AA44A96398AB65
Malicious:	false
Preview:	#..# ...[.U..`.A...[....A...`.B.g.p....N...X...L.[..............# $Id: UserAlarmConfig.ini,v 1.1 2007/10/04 13:26:57 h-adachi Exp $..#....# ...[.U..`.A...[.......`....AlarmDefinitionListDialog.maxAlarmSize=50....# ...[.U..`.A...[..............AlarmDefinitionDialog.maxAlarmNameLength=100....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\is-MUU5T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	496
Entropy (8bit):	4.845217196904258
Encrypted:	false
SSDEEP:	12:jtDxhKXsFcNxoDGk5nd86aYrtcgQSRPUZr:jtxFcH8GL6thxZsZr
MD5:	C0582BB0D509E17E929E10B06019817B
SHA1:	506B4FCBA9DC928D9D57D15FB9A5B433EA7A0860
SHA-256:	96F0DB08B88A8AD2F4914F3ECC462BD98A322692D19B198B3B42A94CFBC7215D
SHA-512:	75DA41B0AEBD5A80DBD45E2EC297A3F01FEB92CA503FF11C923C8E56AE47128B4300A0F0CB6C5513EEFE7DEB27251250FBA4996A499F7D29A6A85E2EB1555435
Malicious:	false
Preview:	#._.C.A...O.\...p..View=scadaserv,jbserv,radarserv,audioserv,logger,mmdeliserv,dserv,storageserv,extserv,pduserv,statmon,alarmserv,compserv,storagemaster,longtermserv,fixeddruserv,floatdruserv,userdiskserv,scserv,rapserv,amsserv,serialbroad,moduleserv,vlcupdateserv,dcaserv....#.d...p(.\|.[.g...)..Request=15000,12001,10113,10103,10020,10109,24005,10200,10106,10102,10092,10100,10104,10204,10203,10201,10202,10205,10116,10117,10118,10119,10110,10120,10130....#Detail.d...p(ON\|OFF)..Detail=2,1\|2,0

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\is-P9VAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1873
Entropy (8bit):	5.081099648233084
Encrypted:	false
SSDEEP:	48:c3UFKvPu4QXsOmxXM2zbcPuSXYdBsgsmK9MsgsrnKI8Bs6l:KUFyBQ8nxc4c5IPKZKIQ
MD5:	63ADAE87090601111C5135DB3FB264A4
SHA1:	C106487D3DD98A617D938CE1C04310E139D560CF
SHA-256:	2EF093C25E49029D036E648F5D972B7B153D600887C94DFF65F55614911FA8DE
SHA-512:	7C533B85C3457B74CB3D7CDC5F35E9AF71E1EB09255CED76C446FAA5A04F0FDC6AA08C0574CC11997EA4916C1A042AF6670873446CA74D1674210EA43C1A68AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">....<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>.... <appender name="file" class="org.apache.log4j.RollingFileAppender">.. <param name="File" value="log/liveplayer.log" />.. <param name="Append" value="true" />.. <param name="MaxFileSize" value="5MB" />.. <param name="MaxBackupIndex" value="20" />.. <layout class="org.apache.log4j.PatternLayout">.. <param name="ConversionPattern".. value="%d{yyyy/MM/dd HH:mm:ss,SSS} [%-5p] [%t] [%c{2}:%M:L%L] - %m%n"/>.. </layout> .. </appender>.... <appender name="STDOUT" class="org.apache.log4j.ConsoleAppender">.. <layout class="org.apache.log4j.PatternLayout">.. <param name="ConversionPattern".. value="%d{yyyy/MM/dd HH:mm:ss,SSS} [%-5p] [%t] [%c{2}:%M:L%L] - %m%n"/>.. </layout> .. </appender>.. .. <appender name="exploration" class="org.apache.log4j.RollingFileAppend

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\is-ST5BN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Generic INItialization configuration [Hz]
Category:	dropped
Size (bytes):	418
Entropy (8bit):	4.715922343484061
Encrypted:	false
SSDEEP:	12:7ANNfeqTfzMMZfeqTfATfQRNHWrFAQcUFNqdM/4RNiSh:kL1YE1goRNHGuD8eX
MD5:	A56E7B14AC1DA6FBBE8ABE0900150832
SHA1:	DA899FCABDDEB5DD3A029539396408E57C1D46F0
SHA-256:	261E02EA0B948D4493813D399886BE24B232AEAF6E3E9D4C73CD11559CFC2FEE
SHA-512:	1928D3C57951C688D58F7EA5A3CE69A1753486C33225A617955E2552F7D3F07EE2E2B12F08553D481135189410C833960C429CEEEA582393465396D312093389
Malicious:	false
Preview:	[Audio Settings]....; Wheather secondary buffers are allocated on software memory or not..; If set to 1, secondary buffers are allocated on software memory...; If 0, they are allocated on hardware memory...LocSoftWare=0....; Audio playing frequency[Hz]..PlayFrequency=44100....; Write period[ms]..WritePeriod=100....; Wheather DirectSound is restored or not when DirectSound error was occured..RestoreDirectSound=0....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\is-VO5R8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3499
Entropy (8bit):	3.8109413133981853
Encrypted:	false
SSDEEP:	12:MMHdwYqw1laDCDWfjrEtYSqfGfSfGYtffafjpKMofCfGfKfWHCyfjqf6fGfifWH4:JdGw1laDwYnHWIsNemg9pBRsPVcUlHsx
MD5:	2B90076C91D4C836062D461C7C100127
SHA1:	278EC34D0C6F28F5FC6A25D281751B3E610EB58E
SHA-256:	D8960BA6522FA12F20EB2E20E6646B493656DF30049DE51CEDCCBA5DAD5D6D6A
SHA-512:	E076E6F49CA546BC5464C5DBDF6F3C159E05F3663AF135C4C53CE2851AC958F216E9A0974532B8471D2365487C7BCD37586C2999F86F8A84B953952DB91492BA
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<xs:schema id="config" xmlns="" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">.. <xs:element name="config" msdata:IsDataSet="true" msdata:Locale="en-US">.. <xs:complexType>.. <xs:choice minOccurs="0" maxOccurs="unbounded">.. <xs:element name="category">.. <xs:complexType>.. <xs:sequence>.. <xs:element name="data" minOccurs="0" maxOccurs="unbounded">.. <xs:complexType>.. <xs:sequence>.. <xs:element name="channel" minOccurs="0" maxOccurs="unbounded">.. <xs:complexType>.. <xs:sequence>.. <xs:element name="parameter" minOccurs="0" maxOccurs="unbounded">.. <xs:complexType>.. <xs:attribute name="id" type="xs:string" />.. <xs:attribute name="name" type

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\log4j_liveplayer.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1873
Entropy (8bit):	5.081099648233084
Encrypted:	false
SSDEEP:	48:c3UFKvPu4QXsOmxXM2zbcPuSXYdBsgsmK9MsgsrnKI8Bs6l:KUFyBQ8nxc4c5IPKZKIQ
MD5:	63ADAE87090601111C5135DB3FB264A4
SHA1:	C106487D3DD98A617D938CE1C04310E139D560CF
SHA-256:	2EF093C25E49029D036E648F5D972B7B153D600887C94DFF65F55614911FA8DE
SHA-512:	7C533B85C3457B74CB3D7CDC5F35E9AF71E1EB09255CED76C446FAA5A04F0FDC6AA08C0574CC11997EA4916C1A042AF6670873446CA74D1674210EA43C1A68AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">....<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>.... <appender name="file" class="org.apache.log4j.RollingFileAppender">.. <param name="File" value="log/liveplayer.log" />.. <param name="Append" value="true" />.. <param name="MaxFileSize" value="5MB" />.. <param name="MaxBackupIndex" value="20" />.. <layout class="org.apache.log4j.PatternLayout">.. <param name="ConversionPattern".. value="%d{yyyy/MM/dd HH:mm:ss,SSS} [%-5p] [%t] [%c{2}:%M:L%L] - %m%n"/>.. </layout> .. </appender>.... <appender name="STDOUT" class="org.apache.log4j.ConsoleAppender">.. <layout class="org.apache.log4j.PatternLayout">.. <param name="ConversionPattern".. value="%d{yyyy/MM/dd HH:mm:ss,SSS} [%-5p] [%t] [%c{2}:%M:L%L] - %m%n"/>.. </layout> .. </appender>.. .. <appender name="exploration" class="org.apache.log4j.RollingFileAppend

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\config\log4j_maintenance.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	5.1123851417888
Encrypted:	false
SSDEEP:	24:2d3vcFaZMiRPHaXsOM1rxXMdqksgsmK9q7sgsO:c3UFKvP6XsOmxXMdBsgsmK9MsgsO
MD5:	F5E5AE9CC45A6AEB783D78DB9CC44DBD
SHA1:	D8404CCF9F2530E7F0B23295476783A377FA55F0
SHA-256:	69DFE8856E5C95ECFFCB7DF2E64C2E223F7266CB4B0509BD05DB18E15A6B78B6
SHA-512:	F27D94067B28D2876B6F8944DDF47CC4A65C915137E97A44FF013BDEDF86D81BE34C642C69716C500D0640AF2112C4B93CBD3E57B71D245EAE9A0479C0EA68D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">....<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>.... <appender name="file" class="org.apache.log4j.RollingFileAppender">.. <param name="File" value="log/maintenance.log" />.. <param name="Append" value="true" />.. <param name="MaxFileSize" value="5MB" />.. <param name="MaxBackupIndex" value="20" />.. <layout class="org.apache.log4j.PatternLayout">.. <param name="ConversionPattern".. value="%d{yyyy/MM/dd HH:mm:ss,SSS} [%-5p] [%t] [%c{2}:%M:L%L] - %m%n"/>.. </layout> .. </appender>.... <appender name="STDOUT" class="org.apache.log4j.ConsoleAppender">.. <layout class="org.apache.log4j.PatternLayout">.. <param name="ConversionPattern".. value="%d{yyyy/MM/dd HH:mm:ss,SSS} [%-5p] [%t] [%c{2}:%M:L%L] - %m%n"/>.. </layout> .. </appender>.... <root>.. <priority value ="info" />.. <appender-ref ref="STDOUT"

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\LiveRemoteSettingRule.xml.gz (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1849
Category:	dropped
Size (bytes):	363
Entropy (8bit):	7.428739607033381
Encrypted:	false
SSDEEP:	6:Xtd203y6yIi6Zhw2LCOJJ9klaBnvOFuf2qyDBIsOVNqtDcoM1inFJguJCp:Xr3y6yIi6ZK2LkQtf2qyDBrOuGxafguA
MD5:	87122475FFC4F9AABC3995E1551B020B
SHA1:	E7E36AE2A9CE3B26D77E9E24FAFE3A504E5259A0
SHA-256:	EBFCEA2F20DFFB8D809B19ACD3954F50836D022BC2617B5B8414E2A68B7C748A
SHA-512:	930613CA6B9FCD13DCC65BF04EF77EBD6740C6E02FBEB304EB5EC1AB563247A8AB9615720DA85F0F47E6410DC33796A635D18751B3C366611E976569CCD02ECD
Malicious:	false
Preview:	...........U]k.0.}.W../......@.....{.isW#i".(...h.).c....s......K.0Vh....1..k.T.......=.d...H.=....Y...'.0e..l:....N{..l..;.y'$y0.m...B.....B..3.....5...+Mn.....$....Pj...\m~.%.BkG....^.q.Z.....A7 DYp..eZ..J.IP.[$x8h...P.......m.Rg<.=.SQ.k..Z.o.s.U1..Sv..%.\.?]?....B8&;.kAYm..\..q....p.u.1...._`...R.KD...............Q8h..9....4.+,.}.$..9...

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\LiveRemoteSettingRuleList.xml.gz (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142
Category:	dropped
Size (bytes):	135
Entropy (8bit):	6.232904109747597
Encrypted:	false
SSDEEP:	3:FttDKtoYT6y3tz+T9gG1Ckro8hycfpdo6YjqUNgRbNladrt:Xt82ktz0eGi80qznI0vaD
MD5:	A0BDBAB3FB9186C5B00331897E743318
SHA1:	53022E32208EB83612A7C943F7542F7147A9661C
SHA-256:	B1B8861B2D6483B6323F46855DCA5DCE7FD8EC967DC7E7A2FA3687D22CFB5982
SHA-512:	9BCD59599D8B725A4F50EBA0D351471C55A7943F447832782051C301AF05ADFD0E63E1418CA8651810A6A20819AA37B29B41176F36ABAC857423A4937187424A
Malicious:	false
Preview:	...............Q(K-*...U2.3PRH.K.O..K.U..q.P....J,KDVf.g.od.....X\l....KJM.+...qI...Z.d.`.....\....$3G..(..'..DI.h.>H......[....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\MediaManagement_HelpDocument.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	4.6929614130817265
Encrypted:	false
SSDEEP:	24:OP2DkciV89DCP2DkciV89Dy2DkciV89DSC2DkciV89DGwIbj2DkciV89DGKC2Dkf:O24bOO24bOW24bOB24bOqwaj24bOqKC/
MD5:	5C9269EC29CBAFF67C05FE98A56FCC94
SHA1:	132C799030DD384ADF01B6FA17326DF16EB86BC1
SHA-256:	D5E804AFF46F364B3BFBD2CBF6359EDB3509998E1C4DF9DE24715891DFBEE4D1
SHA-512:	1C89227112C23E76080B0E1AFCDF7AA3ECFA8491D3D3F0EFDFDE1D6ADD61A9D7C92743713F0F3810A4DEC6B4B63B06D5D78E8953257EAADE41419A01FD1C159B
Malicious:	false
Preview:	Fixed DRU Initialize:..This mode is to delete all data (Operation History, recording data, VDR configuration data) and so you should backup operating history and VDR configuration data.....Float DRU Initialize:..This mode is to delete all data (Operation History, recording data, VDR configuration data) and so you should backup operating history and VDR configuration data.....Long Term Device Creation:..This mode is to make a new Long Term Device for VR-7000 V1.xx..This mode is to delete all data (Operation History, recording data, VDR configuration data) and so you should backup operating history and VDR configuration data.....Long Term Device Initialize:..This mode is to delete all data (Operation History, recording data, VDR configuration data) and so you should backup operating history and VDR configuration data.....User Disk(USB) Creation:..This mode is to make a new User Disk(USB) for VR-7000 V1.xx..This mode is to delete all data (Operation History, recording data, VDR configurat

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\current.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5479069076840855
Encrypted:	false
SSDEEP:	3:D7M6kEmb:M1xb
MD5:	AA01122337415C2ABDFED96DF3B698D8
SHA1:	7B16DA9DD38695D13A79E0B76CBEC2A3B1E559B9
SHA-256:	53B46971A16FF2716CB86C7561416AEB092D18C299207A10EBFC75A724BC5921
SHA-512:	0E1A64ECF88753DCE1FFF1DC4F8C9FB08D3DD250AD7278066EB6AD5987E07F7287EEE3872B58889FA791CE886D4EB006A6A00FB907EEB85F8AA11ACCF9D170C1
Malicious:	false
Preview:	use_save_area=./data/save/current

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\empty_config.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1200418
Entropy (8bit):	4.457764155962315
Encrypted:	false
SSDEEP:	1536:X1mtgbyt80F2vwxtG/AQPKx0jeFIHNmr85SXYVu+lUDqRwv2dTk1O/Ah6LccLGt7:EaA
MD5:	DDC994C447826488D0C14E012D6B1E68
SHA1:	17CB905E26B756CE095247366658B5E09E5AD353
SHA-256:	6B964B6EF677A01D768C28756D0779D432588A75D799887E09B5ECD080D9B665
SHA-512:	6488D0C34FCEA46E3443EB3D2E244B0ED1C7E080EADF2D87D0E0993DC01994DC18B5DEC9B8E4C56375717DE60BACE5F7CFB2342AEEC54E4708D7685C75FB5816
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<config>.. <category id="ImageRecordSetting">.. <data>.. <channel id="1" validity="true">.. <parameter id="1" name="Active" value="true"/>.. <parameter id="2" name="No" value="Radar1"/>.. <parameter id="38" name="Check" value="0"/>.. <parameter id="27" name="Recording method" value="0"/>.. <parameter id="28" name="No.1 Input source" value="1"/>.. <parameter id="29" name="No.2 Input source" value="0"/>.. <parameter id="30" name="No.3 Input source" value="0"/>.. <parameter id="31" name="No.4 Input source" value="0"/>.. <parameter id="39" name="Fixed DRU Recording" value="true"/>.. <parameter id="40" name="Float DRU Recording" value="true"/>.. <parameter id="41" name="Long Term Device Recording" value="true"/>.. <parameter id="46" name="User Disk Recording" value="true"/>.. <parameter id="42" name="Network Output" value="true"/>..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\equipment.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18513
Entropy (8bit):	4.3493132839748805
Encrypted:	false
SSDEEP:	384:7P7IR+d+h+z+Z+pN9Nv3yFw1sRVbdaAZ4BAcn8Mj:7P7IUYkisvTv3yFw1sRVbdaAyicn8Mj
MD5:	19B37A934EAC82C9285AFC46985C599E
SHA1:	784E0C1973CAE492CC51BCB2D00FD2EB7A3CAC6B
SHA-256:	2752DE24F07D23055EF52DC8A9485787A79B552660702E1FC189B9BF01B971E0
SHA-512:	8D5D77F73BE70F584151FA8578CAFA6BA5C6BE37DCD14D54F8DF3425184DF056556FFE381B33088649731F973A24277A13A6C38E8C4118149CFC99A6C2A46433
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<equipment>.. <category id="SPEED LOG">.. <brand id="Furuno">.. <typeNo id="DS-50">.. <dataName id="SPEED LOG" interface="serial">.. <property id="9" value="1"/>.. <property id="8" value="0"/>.. <property id="7" value="8"/>.. <property id="6" value="4800"/>.. <property id="14" value="2"/>.. <property id="5" value="0"/>.. <property id="13" value=""/>.. <property id="4" value="SPEED LOG"/>.. <property id="12" value=""/>.. <property id="11" value="0"/>.. <property id="1" value="true"/>.. <property id="10" value="false"/>.. </dataName>.. </typeNo>.. <typeNo id="DS-30">.. <dataName id="SPEED LOG" interface="serial">.. <property id="9" value="1"/>.. <property id="8" value="0"/>.. <property id="7" value="8"/>.. <property id="6" value="4800"/>.. <pr

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\is-6E14D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5479069076840855
Encrypted:	false
SSDEEP:	3:D7M6kEmb:M1xb
MD5:	AA01122337415C2ABDFED96DF3B698D8
SHA1:	7B16DA9DD38695D13A79E0B76CBEC2A3B1E559B9
SHA-256:	53B46971A16FF2716CB86C7561416AEB092D18C299207A10EBFC75A724BC5921
SHA-512:	0E1A64ECF88753DCE1FFF1DC4F8C9FB08D3DD250AD7278066EB6AD5987E07F7287EEE3872B58889FA791CE886D4EB006A6A00FB907EEB85F8AA11ACCF9D170C1
Malicious:	false
Preview:	use_save_area=./data/save/current

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\is-6UCSN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1200418
Entropy (8bit):	4.457764155962315
Encrypted:	false
SSDEEP:	1536:X1mtgbyt80F2vwxtG/AQPKx0jeFIHNmr85SXYVu+lUDqRwv2dTk1O/Ah6LccLGt7:EaA
MD5:	DDC994C447826488D0C14E012D6B1E68
SHA1:	17CB905E26B756CE095247366658B5E09E5AD353
SHA-256:	6B964B6EF677A01D768C28756D0779D432588A75D799887E09B5ECD080D9B665
SHA-512:	6488D0C34FCEA46E3443EB3D2E244B0ED1C7E080EADF2D87D0E0993DC01994DC18B5DEC9B8E4C56375717DE60BACE5F7CFB2342AEEC54E4708D7685C75FB5816
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<config>.. <category id="ImageRecordSetting">.. <data>.. <channel id="1" validity="true">.. <parameter id="1" name="Active" value="true"/>.. <parameter id="2" name="No" value="Radar1"/>.. <parameter id="38" name="Check" value="0"/>.. <parameter id="27" name="Recording method" value="0"/>.. <parameter id="28" name="No.1 Input source" value="1"/>.. <parameter id="29" name="No.2 Input source" value="0"/>.. <parameter id="30" name="No.3 Input source" value="0"/>.. <parameter id="31" name="No.4 Input source" value="0"/>.. <parameter id="39" name="Fixed DRU Recording" value="true"/>.. <parameter id="40" name="Float DRU Recording" value="true"/>.. <parameter id="41" name="Long Term Device Recording" value="true"/>.. <parameter id="46" name="User Disk Recording" value="true"/>.. <parameter id="42" name="Network Output" value="true"/>..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\is-78QBU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142
Category:	dropped
Size (bytes):	135
Entropy (8bit):	6.232904109747597
Encrypted:	false
SSDEEP:	3:FttDKtoYT6y3tz+T9gG1Ckro8hycfpdo6YjqUNgRbNladrt:Xt82ktz0eGi80qznI0vaD
MD5:	A0BDBAB3FB9186C5B00331897E743318
SHA1:	53022E32208EB83612A7C943F7542F7147A9661C
SHA-256:	B1B8861B2D6483B6323F46855DCA5DCE7FD8EC967DC7E7A2FA3687D22CFB5982
SHA-512:	9BCD59599D8B725A4F50EBA0D351471C55A7943F447832782051C301AF05ADFD0E63E1418CA8651810A6A20819AA37B29B41176F36ABAC857423A4937187424A
Malicious:	false
Preview:	...............Q(K-*...U2.3PRH.K.O..K.U..q.P....J,KDVf.g.od.....X\l....KJM.+...qI...Z.d.`.....\....$3G..(..'..DI.h.>H......[....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\is-GA6TB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1370
Entropy (8bit):	4.6929614130817265
Encrypted:	false
SSDEEP:	24:OP2DkciV89DCP2DkciV89Dy2DkciV89DSC2DkciV89DGwIbj2DkciV89DGKC2Dkf:O24bOO24bOW24bOB24bOqwaj24bOqKC/
MD5:	5C9269EC29CBAFF67C05FE98A56FCC94
SHA1:	132C799030DD384ADF01B6FA17326DF16EB86BC1
SHA-256:	D5E804AFF46F364B3BFBD2CBF6359EDB3509998E1C4DF9DE24715891DFBEE4D1
SHA-512:	1C89227112C23E76080B0E1AFCDF7AA3ECFA8491D3D3F0EFDFDE1D6ADD61A9D7C92743713F0F3810A4DEC6B4B63B06D5D78E8953257EAADE41419A01FD1C159B
Malicious:	false
Preview:	Fixed DRU Initialize:..This mode is to delete all data (Operation History, recording data, VDR configuration data) and so you should backup operating history and VDR configuration data.....Float DRU Initialize:..This mode is to delete all data (Operation History, recording data, VDR configuration data) and so you should backup operating history and VDR configuration data.....Long Term Device Creation:..This mode is to make a new Long Term Device for VR-7000 V1.xx..This mode is to delete all data (Operation History, recording data, VDR configuration data) and so you should backup operating history and VDR configuration data.....Long Term Device Initialize:..This mode is to delete all data (Operation History, recording data, VDR configuration data) and so you should backup operating history and VDR configuration data.....User Disk(USB) Creation:..This mode is to make a new User Disk(USB) for VR-7000 V1.xx..This mode is to delete all data (Operation History, recording data, VDR configurat

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\is-OI9PM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1849
Category:	dropped
Size (bytes):	363
Entropy (8bit):	7.428739607033381
Encrypted:	false
SSDEEP:	6:Xtd203y6yIi6Zhw2LCOJJ9klaBnvOFuf2qyDBIsOVNqtDcoM1inFJguJCp:Xr3y6yIi6ZK2LkQtf2qyDBrOuGxafguA
MD5:	87122475FFC4F9AABC3995E1551B020B
SHA1:	E7E36AE2A9CE3B26D77E9E24FAFE3A504E5259A0
SHA-256:	EBFCEA2F20DFFB8D809B19ACD3954F50836D022BC2617B5B8414E2A68B7C748A
SHA-512:	930613CA6B9FCD13DCC65BF04EF77EBD6740C6E02FBEB304EB5EC1AB563247A8AB9615720DA85F0F47E6410DC33796A635D18751B3C366611E976569CCD02ECD
Malicious:	false
Preview:	...........U]k.0.}.W../......@.....{.isW#i".(...h.).c....s......K.0Vh....1..k.T.......=.d...H.=....Y...'.0e..l:....N{..l..;.y'$y0.m...B.....B..3.....5...+Mn.....$....Pj...\m~.%.BkG....^.q.Z.....A7 DYp..eZ..J.IP.[$x8h...P.......m.Rg<.=.SQ.k..Z.o.s.U1..Sv..%.\.?]?....B8&;.kAYm..\..q....p.u.1...._`...R.KD...............Q8h..9....4.+,.}.$..9...

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\is-VG0PG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18513
Entropy (8bit):	4.3493132839748805
Encrypted:	false
SSDEEP:	384:7P7IR+d+h+z+Z+pN9Nv3yFw1sRVbdaAZ4BAcn8Mj:7P7IUYkisvTv3yFw1sRVbdaAyicn8Mj
MD5:	19B37A934EAC82C9285AFC46985C599E
SHA1:	784E0C1973CAE492CC51BCB2D00FD2EB7A3CAC6B
SHA-256:	2752DE24F07D23055EF52DC8A9485787A79B552660702E1FC189B9BF01B971E0
SHA-512:	8D5D77F73BE70F584151FA8578CAFA6BA5C6BE37DCD14D54F8DF3425184DF056556FFE381B33088649731F973A24277A13A6C38E8C4118149CFC99A6C2A46433
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<equipment>.. <category id="SPEED LOG">.. <brand id="Furuno">.. <typeNo id="DS-50">.. <dataName id="SPEED LOG" interface="serial">.. <property id="9" value="1"/>.. <property id="8" value="0"/>.. <property id="7" value="8"/>.. <property id="6" value="4800"/>.. <property id="14" value="2"/>.. <property id="5" value="0"/>.. <property id="13" value=""/>.. <property id="4" value="SPEED LOG"/>.. <property id="12" value=""/>.. <property id="11" value="0"/>.. <property id="1" value="true"/>.. <property id="10" value="false"/>.. </dataName>.. </typeNo>.. <typeNo id="DS-30">.. <dataName id="SPEED LOG" interface="serial">.. <property id="9" value="1"/>.. <property id="8" value="0"/>.. <property id="7" value="8"/>.. <property id="6" value="4800"/>.. <pr

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\alarm\comment_userAlarm.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2703
Entropy (8bit):	5.879402274914046
Encrypted:	false
SSDEEP:	48:cBP/g5cGeY2sd/eZcGeY2uWcGeY2u3ueQFtRLcGeY2pGUBG:mg5dEJoj3fQFPF8GWG
MD5:	F2FC9559FCB964E24DBDC5F87DCA37BC
SHA1:	B341D31DFC2EBE000B1A91AA1F1E02C0F64056E9
SHA-256:	B4068299F8FC2D0B7CAB3CAEADE09531FE1257A90FFE95A750869EE82F983246
SHA-512:	9DD6567DCD6D61B5FBCF94A4C32C1843181EF64AF627C973F7878E1F6918109D250531CBFCB6E406B47E708D22D9028DB2515D0B382742269D6CAE64B6BC9F16
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>.. ..ope1..ope2.................................................................XML....................................................-->..<UserAlarmList>.. .............XML.......id...............................7....................... -->..<UserAlarm active="true" id="Alarm-A" name="Alarm-A" buzzer="c:/windows/media/tada.wav">...<OccuurrenceCondition alarmType="analog" channel="Analog001" cond1="10" ope1="1" ope2="3" cond2="20" />...<RecoverCondition alarmType="analog" channel="Analog001" cond1="10" ope1="2" ope2="2" cond2="20" />..</UserAlarm>.... .............XML..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\alarm\is-BG0C1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.052401000084611
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgC4vIAyCwz1mF3KDEJM8lycy:TMVBdYvyW3YERyR
MD5:	FDE9308F356C5B798A8CC795B5E133F3
SHA1:	D3800C6CF0FE17085D2C64900FFC3977BC95E9CA
SHA-256:	302739211F66760DD450A55D206223C20A9A23DCBA36F4CDE58E5EE650E9932B
SHA-512:	C75248B6E16D9D81C130638F1E41A42AC4EBB05861712862806662D67FC03F90A353F59DAAA53B4C3351254846445B1AF35B945BC3AB92D71ED2C8615523C15F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<UserAlarmList buzzPlay="2" display="false">..</UserAlarmList>..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\alarm\is-J3TVN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2703
Entropy (8bit):	5.879402274914046
Encrypted:	false
SSDEEP:	48:cBP/g5cGeY2sd/eZcGeY2uWcGeY2u3ueQFtRLcGeY2pGUBG:mg5dEJoj3fQFPF8GWG
MD5:	F2FC9559FCB964E24DBDC5F87DCA37BC
SHA1:	B341D31DFC2EBE000B1A91AA1F1E02C0F64056E9
SHA-256:	B4068299F8FC2D0B7CAB3CAEADE09531FE1257A90FFE95A750869EE82F983246
SHA-512:	9DD6567DCD6D61B5FBCF94A4C32C1843181EF64AF627C973F7878E1F6918109D250531CBFCB6E406B47E708D22D9028DB2515D0B382742269D6CAE64B6BC9F16
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>.. ..ope1..ope2.................................................................XML....................................................-->..<UserAlarmList>.. .............XML.......id...............................7....................... -->..<UserAlarm active="true" id="Alarm-A" name="Alarm-A" buzzer="c:/windows/media/tada.wav">...<OccuurrenceCondition alarmType="analog" channel="Analog001" cond1="10" ope1="1" ope2="3" cond2="20" />...<RecoverCondition alarmType="analog" channel="Analog001" cond1="10" ope1="2" ope2="2" cond2="20" />..</UserAlarm>.... .............XML..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\alarm\is-MLS62.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15778
Entropy (8bit):	5.088110386346183
Encrypted:	false
SSDEEP:	384:xrqkUPr9km5r4kEWrrkEzrmkcxQrJk2Brkkcw4rnksI:sVeyiGKhI
MD5:	86EEA51F0044FE09C9E1B64DCF9FC09F
SHA1:	5EE40096FB997FC0DDD809CDFFDF9063EF36A580
SHA-256:	F037F111AC0C70BB66FB0049909B35B5B374C8D18AD79F3F4C61D6921CA606E5
SHA-512:	1802C13B5DB8026AFF97ABD02E246C84676129E9659C3C834EB59E0CDE9D2FF8D9FCA05737059A6AFCC33C60747FACD2F64256DCDB6E3C826418A74919537FCE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<UserAlarmList buzzPlay="0" display="true">..<UserAlarm active="false" id="Alarm-A" name="Alarm-A1" buzzer="c:/windows/media/tada.wav">..<OccuurrenceCondition alarmType="analog" channel="AN001" cond1="12.0" ope1="1" ope2="2" cond2="26.0" />..<RecoverCondition alarmType="analog" channel="AN001" cond1="27.0" ope1="3" ope2="0" cond2="" />..</UserAlarm>..<UserAlarm active="false" id="Alarm-B" name="Alarm-B1" buzzer="c:/effects/hogehoge.wav">..<OccuurrenceCondition alarmType="digital" channel="DC001" cond1="1" />..<RecoverCondition alarmType="digital" channel="DC001" cond1="0" />..</UserAlarm>..<UserAlarm active="false" id="Alarm-C" name="Alarm-C1" buzzer="c:/effects/hogehoge.wav">..<OccuurrenceCondition alarmType="serial" channel="SI01" condMode="Number" decoder="dec1" cond1="10.0" ope1="1" ope2="1" cond2="20.0" cond3="" />..<RecoverCondition alarmType="serial" channel="SI01" condMode="Number" decoder="dec1" cond1="10.0" ope1="2" ope2="1" cond2="20.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\alarm\max-userAlarm.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15778
Entropy (8bit):	5.088110386346183
Encrypted:	false
SSDEEP:	384:xrqkUPr9km5r4kEWrrkEzrmkcxQrJk2Brkkcw4rnksI:sVeyiGKhI
MD5:	86EEA51F0044FE09C9E1B64DCF9FC09F
SHA1:	5EE40096FB997FC0DDD809CDFFDF9063EF36A580
SHA-256:	F037F111AC0C70BB66FB0049909B35B5B374C8D18AD79F3F4C61D6921CA606E5
SHA-512:	1802C13B5DB8026AFF97ABD02E246C84676129E9659C3C834EB59E0CDE9D2FF8D9FCA05737059A6AFCC33C60747FACD2F64256DCDB6E3C826418A74919537FCE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<UserAlarmList buzzPlay="0" display="true">..<UserAlarm active="false" id="Alarm-A" name="Alarm-A1" buzzer="c:/windows/media/tada.wav">..<OccuurrenceCondition alarmType="analog" channel="AN001" cond1="12.0" ope1="1" ope2="2" cond2="26.0" />..<RecoverCondition alarmType="analog" channel="AN001" cond1="27.0" ope1="3" ope2="0" cond2="" />..</UserAlarm>..<UserAlarm active="false" id="Alarm-B" name="Alarm-B1" buzzer="c:/effects/hogehoge.wav">..<OccuurrenceCondition alarmType="digital" channel="DC001" cond1="1" />..<RecoverCondition alarmType="digital" channel="DC001" cond1="0" />..</UserAlarm>..<UserAlarm active="false" id="Alarm-C" name="Alarm-C1" buzzer="c:/effects/hogehoge.wav">..<OccuurrenceCondition alarmType="serial" channel="SI01" condMode="Number" decoder="dec1" cond1="10.0" ope1="1" ope2="1" cond2="20.0" cond3="" />..<RecoverCondition alarmType="serial" channel="SI01" condMode="Number" decoder="dec1" cond1="10.0" ope1="2" ope2="1" cond2="20.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\alarm\userAlarm.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.052401000084611
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgC4vIAyCwz1mF3KDEJM8lycy:TMVBdYvyW3YERyR
MD5:	FDE9308F356C5B798A8CC795B5E133F3
SHA1:	D3800C6CF0FE17085D2C64900FFC3977BC95E9CA
SHA-256:	302739211F66760DD450A55D206223C20A9A23DCBA36F4CDE58E5EE650E9932B
SHA-512:	C75248B6E16D9D81C130638F1E41A42AC4EBB05861712862806662D67FC03F90A353F59DAAA53B4C3351254846445B1AF35B945BC3AB92D71ED2C8615523C15F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<UserAlarmList buzzPlay="2" display="false">..</UserAlarmList>..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\conning\ConningDefinition.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	38118
Entropy (8bit):	4.321741164502036
Encrypted:	false
SSDEEP:	384:EBuBcU49pBuBcU49sXtVYU49oB/KOr97tih3hpvMU49EB/Kwr9zHZ4OpiIRsiG06:g5bwnW0W51WEl7Vbe
MD5:	076CB4B126DD51BA6FB3C8F6CB353219
SHA1:	93DE653037611840C10D73EE2D6CAF0FAA7D866B
SHA-256:	4F44D0240E7A914027B5E40088B9544EA2FED854633B664B206E45E814B08B37
SHA-512:	22E5B577A7A1C7FBAE626304B7F90880FDAAC5DC59862DA5F5B75D538033F362C1A18C189784AE0020C67909BD8A7CC1C771E083816DA9282C937C5C05104811
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?> ..<java version="1.7.0_25" class="java.beans.XMLDecoder"> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>Conning</string> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>15</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.NumericDataDisplayForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.NumericDataDisplayObject</string> .. </void> .. <void property="data"> .. <void index="0"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. <void index="1"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. <void index="2"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. </void> .. <void property="flag"> .. <array class

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\conning\DefaultConningDefinition.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8247
Entropy (8bit):	4.55942294731948
Encrypted:	false
SSDEEP:	192:o5XYQYF6f6IKHM8grk3adkt16JBdkKgCgH:op/626B74m4es3dZbi
MD5:	4ED526AE7B9E764203550776F8AD9B61
SHA1:	64C4C6AD40980A9027914082418E83F1DFFB2DAE
SHA-256:	B30A49DBDCECA84BE2ED3CF069E1B23849A2BD80F3508681F0B1DAEB26A961EB
SHA-512:	F1ADE776B966404B14E82C91E19014424F9029AC60D00E7C52A4B788A759C7920861800DCE7A3F919863CBC902F15772DF0AFA84ABD7C52DA977F43A9D2F0149
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?> ..<java version="1.7.0_25" class="java.beans.XMLDecoder"> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>FullSetSheet</string> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>15</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.CompassForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.CompassObject</string> .. </void> .. <void property="key"> .. <string>CompassSheet</string> .. </void> .. <void property="x"> .. <int>313</int> .. </void> .. </object> .. </void> .. <void method="put"> .. <string>13</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.NumericDataDisplayForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.NumericDataDisplayObject</string> .. </void> .. <void property="key"> ..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\conning\is-0QJMJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8247
Entropy (8bit):	4.55942294731948
Encrypted:	false
SSDEEP:	192:o5XYQYF6f6IKHM8grk3adkt16JBdkKgCgH:op/626B74m4es3dZbi
MD5:	4ED526AE7B9E764203550776F8AD9B61
SHA1:	64C4C6AD40980A9027914082418E83F1DFFB2DAE
SHA-256:	B30A49DBDCECA84BE2ED3CF069E1B23849A2BD80F3508681F0B1DAEB26A961EB
SHA-512:	F1ADE776B966404B14E82C91E19014424F9029AC60D00E7C52A4B788A759C7920861800DCE7A3F919863CBC902F15772DF0AFA84ABD7C52DA977F43A9D2F0149
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?> ..<java version="1.7.0_25" class="java.beans.XMLDecoder"> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>FullSetSheet</string> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>15</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.CompassForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.CompassObject</string> .. </void> .. <void property="key"> .. <string>CompassSheet</string> .. </void> .. <void property="x"> .. <int>313</int> .. </void> .. </object> .. </void> .. <void method="put"> .. <string>13</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.NumericDataDisplayForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.NumericDataDisplayObject</string> .. </void> .. <void property="key"> ..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\conning\is-Q2V93.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	38118
Entropy (8bit):	4.321741164502036
Encrypted:	false
SSDEEP:	384:EBuBcU49pBuBcU49sXtVYU49oB/KOr97tih3hpvMU49EB/Kwr9zHZ4OpiIRsiG06:g5bwnW0W51WEl7Vbe
MD5:	076CB4B126DD51BA6FB3C8F6CB353219
SHA1:	93DE653037611840C10D73EE2D6CAF0FAA7D866B
SHA-256:	4F44D0240E7A914027B5E40088B9544EA2FED854633B664B206E45E814B08B37
SHA-512:	22E5B577A7A1C7FBAE626304B7F90880FDAAC5DC59862DA5F5B75D538033F362C1A18C189784AE0020C67909BD8A7CC1C771E083816DA9282C937C5C05104811
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?> ..<java version="1.7.0_25" class="java.beans.XMLDecoder"> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>Conning</string> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>15</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.NumericDataDisplayForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.NumericDataDisplayObject</string> .. </void> .. <void property="data"> .. <void index="0"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. <void index="1"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. <void index="2"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. </void> .. <void property="flag"> .. <array class

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\decoder\DefaultDefineDecoder.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (363), with CRLF line terminators
Category:	dropped
Size (bytes):	149810
Entropy (8bit):	5.440728394068986
Encrypted:	false
SSDEEP:	1536:yPcwlLPcwAzPcwBmPDbYjPDbdcPDbuZPDb09PDb3RPDbalPDbQePDbILPDbGnPau:05HHNlpK2SF8b2jfnJ1b
MD5:	98EF1EA9CB80CE74CABD805DAF5C5232
SHA1:	21BFA9B8D650854681434CB7115FFEA1703C1B3F
SHA-256:	7846246A6303D714FE1A4B35BCA9105E6518FBF29A433AF4AD1325722CC447E2
SHA-512:	44841922EC96D590DAD05A995B44340D78F8AC42D5141E87A229FB37C319DD117D7D57FD6623F1F369C8072EBEB68D9DD52ED09A0C9039E07A8C65354B912410
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="no"?><DECODERS><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Depth(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">Echo sounder\</PROPERTY><PROPERTY name="Description"/><PROPERTY name="DecoderScript">Search for DPT....print( #2,"M");..trend(double(#2));..</PROPERTY></NMEA-DECODER><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Offset(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">Echo sounder\</PROPERTY><PROPERTY name="Description"/><PROPERTY name="DecoderScript">Search for DPT..print( #3,"M");..trend( double(#3) );..</PROPERTY></NMEA-DECODER><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Range(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\decoder\UserDefineDecoder.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.894918389718543
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCaOELA/schlA:TMVBd6OjY
MD5:	EDD4E78B0335455E0860E25CC63F56B6
SHA1:	1928DB934894162ADD003053AE0CB1C54A45350F
SHA-256:	7157D1AB6A5F59517FA275798E036570882ABB5815E18C194F0D7EB24A7DC739
SHA-512:	B4C678DAACF67775C252E73ED1903C5788BD02A1CACBF2F848692F60405DCFE3568B1EE8DA4526D74699C28141E7BDDEA064841ADFCA6ACCFF9D4F27CF79311C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?><DECODERS/>

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\decoder\is-HH37C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (363), with CRLF line terminators
Category:	dropped
Size (bytes):	149810
Entropy (8bit):	5.440728394068986
Encrypted:	false
SSDEEP:	1536:yPcwlLPcwAzPcwBmPDbYjPDbdcPDbuZPDb09PDb3RPDbalPDbQePDbILPDbGnPau:05HHNlpK2SF8b2jfnJ1b
MD5:	98EF1EA9CB80CE74CABD805DAF5C5232
SHA1:	21BFA9B8D650854681434CB7115FFEA1703C1B3F
SHA-256:	7846246A6303D714FE1A4B35BCA9105E6518FBF29A433AF4AD1325722CC447E2
SHA-512:	44841922EC96D590DAD05A995B44340D78F8AC42D5141E87A229FB37C319DD117D7D57FD6623F1F369C8072EBEB68D9DD52ED09A0C9039E07A8C65354B912410
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="no"?><DECODERS><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Depth(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">Echo sounder\</PROPERTY><PROPERTY name="Description"/><PROPERTY name="DecoderScript">Search for DPT....print( #2,"M");..trend(double(#2));..</PROPERTY></NMEA-DECODER><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Offset(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">Echo sounder\</PROPERTY><PROPERTY name="Description"/><PROPERTY name="DecoderScript">Search for DPT..print( #3,"M");..trend( double(#3) );..</PROPERTY></NMEA-DECODER><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Range(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\decoder\is-QO7TG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.894918389718543
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCaOELA/schlA:TMVBd6OjY
MD5:	EDD4E78B0335455E0860E25CC63F56B6
SHA1:	1928DB934894162ADD003053AE0CB1C54A45350F
SHA-256:	7157D1AB6A5F59517FA275798E036570882ABB5815E18C194F0D7EB24A7DC739
SHA-512:	B4C678DAACF67775C252E73ED1903C5788BD02A1CACBF2F848692F60405DCFE3568B1EE8DA4526D74699C28141E7BDDEA064841ADFCA6ACCFF9D4F27CF79311C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?><DECODERS/>

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\is-5HNVR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with very long lines (467), with CRLF line terminators
Category:	dropped
Size (bytes):	4949
Entropy (8bit):	5.289970304199814
Encrypted:	false
SSDEEP:	96:C6ctwrT5oLxL4wCjjRnUlcs7VSkkE4k3oclr:VctwriewCjVnUlcs/kZk3oclr
MD5:	4B86853D7BF2673B52A917859F8EAE44
SHA1:	0093D813529841158F9BCFB67DAA6F1713F47AA8
SHA-256:	1525B54F9DD32AD96A7D74A950502E044E0F890C7D3BAD2BDD81C4587216398D
SHA-512:	D5C269B602219814554CE616ABF57D17C9FFA6B48DA38318C81A58528770005F43BE5D8F86347FD6FC924F0A97EE67B26929BE87D712E50AB5D21D98E8D94B52
Malicious:	false
Preview:	# default font name..font_name_default=NSimSun....# default font size..font_size_default=12....#Host Appellation..server-hostname=172.31.16.200..playback-server-hostname=localhost..lastconnect-server-hostname=172.31.16.200....#Port number at connection destination..server-port=24004..playback-server-port=24003..module_manage_server_port=10110..vlc_manage_server_port=10120....#Communicator Appellation..communicator-name=DGNPCommunicator....#Trial frequency of initial connection (-1:unrestraint.CThe rest:Specified frequency)..max-connect-trials=1....#Connected return of Trial frequency (-1:unrestraint.CThe rest:Specified frequency)..max-reconnect-trials=0....#Interval of Connected trial(ms)..trial-interval=5000....#read of Communicator.ECycle of Writing Loop..io-loop-cycle=200....#Time-out of HELLO..reply-hello-timeout=15000....#ECHO Transmission Cycle..heartbeat-cycle=10000..playback-heartbeat-cycle=10000..#playback-heartbeat-cycle=2147483647....#Reply ECHO Time-out..#GNPAdmSession.HEAR

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\is-8LO53.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3637
Entropy (8bit):	5.2375778608011405
Encrypted:	false
SSDEEP:	96:h0hct8T5oLVmg54ua8l9lyj+HHBZkn8l8/8DK:hUct8iY3ua8nyanBZkn0gH
MD5:	7A2CDAFCE38EDB8F29DD4A367CEB34B9
SHA1:	E1A6B983982ACF6B46317AE8114C99BC806D459C
SHA-256:	F48165D0DC1BB6462034DD9F4C9F31E37123433794813B16CC99BF3F565F786E
SHA-512:	32C3833A37FB9D5FD25E434A724BB54FCE85CA756A5DE4B4C5773A1DCA160A6217AF9D98A71646F1800154862EDE9034AC73A285B2DE584B4C1683B1D4BFC88D
Malicious:	false
Preview:	# default font name..font_name_default=NSimSun....# default font size..font_size_default=12....# font size of Numeric Data Display component..font_size_numeric_data_display=18....#Host Appellation..server-hostname=172.31.16.200..playback-server-hostname=localhost..lastconnect-server-hostname=172.31.16.200....#Port number at connection destination..server-port=24001..playback-server-port=24002..module_manage_server_port=10110..backup-server-port=24006....#Communicator Appellation..communicator-name=DGNPCommunicator....#Trial frequency of initial connection (-1:unrestraint.CThe rest:Specified frequency)..max-connect-trials=1....#Connected return of Trial frequency (-1:unrestraint.CThe rest:Specified frequency)..max-reconnect-trials=-1....#Interval of Connected trial(ms)..trial-interval=5000....#read of Communicator.ECycle of Writing Loop..io-loop-cycle=200....#Time-out of HELLO..reply-hello-timeout=15000....#ECHO Transmission Cycle..heartbeat-cycle=10000..playback-heartbeat-cycle=10000..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\sheet\ViewerDefinition.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5572
Entropy (8bit):	4.535836046572228
Encrypted:	false
SSDEEP:	24:2dIlukvg+DM7BvwsCDLB/vwTDdEQ/vCkDsOAOGvTkD4WvUDnEGvxOL1DSP2v8DxU:cIG9O/wtGymkD
MD5:	A71BE58C3D0F810873E17EEAE1341491
SHA1:	E01AA28D7CA07BAC6DA76A86DCF100E58249EA3A
SHA-256:	9B1F353A0CE6CBE93929ED344EB83D3A578055FE3AECDA351BD08FA3FD856D8A
SHA-512:	982CFCB5B9762DBEFDC302BF956D4EAB4C44DCD841CAB0F2CEABBA1005DF2261BC4D63F279AF7748DE4CC32B233E9C882F42E4D82A358B7C64FC06DCEF28DCE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<java version="1.7.0_25" class="java.beans.XMLDecoder">. <object class="java.util.HashMap">. <void method="put">. <string>0</string>. <object class="java.util.HashMap">. <void method="put">. <string>Name</string>. <string>Conning</string>. </void>. <void method="put">. <string>Edit</string>. <string>true</string>. </void>. <void method="put">. <string>Class</string>. <string>jp.co.furuno.vdr.ui.viewer.CustomViewer</string>. </void>. <void method="put">. <string>Icon</string>. <null/>. </void>. </object>. </void>. <void method="put">. <string>1</string>. <object class="java.util.HashMap">. <void method="put">. <string>Name</string>. <string>Serial</string>. </void>. <void method="put">. <string>Edit</string>. <string>true</string>. </void>. <void method="put">. <string>Class</string>. <string>jp.co.furuno.vdr.ui.viewer.SerialViewer</string>.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\sheet\is-INQNC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5572
Entropy (8bit):	4.535836046572228
Encrypted:	false
SSDEEP:	24:2dIlukvg+DM7BvwsCDLB/vwTDdEQ/vCkDsOAOGvTkD4WvUDnEGvxOL1DSP2v8DxU:cIG9O/wtGymkD
MD5:	A71BE58C3D0F810873E17EEAE1341491
SHA1:	E01AA28D7CA07BAC6DA76A86DCF100E58249EA3A
SHA-256:	9B1F353A0CE6CBE93929ED344EB83D3A578055FE3AECDA351BD08FA3FD856D8A
SHA-512:	982CFCB5B9762DBEFDC302BF956D4EAB4C44DCD841CAB0F2CEABBA1005DF2261BC4D63F279AF7748DE4CC32B233E9C882F42E4D82A358B7C64FC06DCEF28DCE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<java version="1.7.0_25" class="java.beans.XMLDecoder">. <object class="java.util.HashMap">. <void method="put">. <string>0</string>. <object class="java.util.HashMap">. <void method="put">. <string>Name</string>. <string>Conning</string>. </void>. <void method="put">. <string>Edit</string>. <string>true</string>. </void>. <void method="put">. <string>Class</string>. <string>jp.co.furuno.vdr.ui.viewer.CustomViewer</string>. </void>. <void method="put">. <string>Icon</string>. <null/>. </void>. </object>. </void>. <void method="put">. <string>1</string>. <object class="java.util.HashMap">. <void method="put">. <string>Name</string>. <string>Serial</string>. </void>. <void method="put">. <string>Edit</string>. <string>true</string>. </void>. <void method="put">. <string>Class</string>. <string>jp.co.furuno.vdr.ui.viewer.SerialViewer</string>.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\vdrMaintenanceViewer.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with very long lines (467), with CRLF line terminators
Category:	dropped
Size (bytes):	4949
Entropy (8bit):	5.289970304199814
Encrypted:	false
SSDEEP:	96:C6ctwrT5oLxL4wCjjRnUlcs7VSkkE4k3oclr:VctwriewCjVnUlcs/kZk3oclr
MD5:	4B86853D7BF2673B52A917859F8EAE44
SHA1:	0093D813529841158F9BCFB67DAA6F1713F47AA8
SHA-256:	1525B54F9DD32AD96A7D74A950502E044E0F890C7D3BAD2BDD81C4587216398D
SHA-512:	D5C269B602219814554CE616ABF57D17C9FFA6B48DA38318C81A58528770005F43BE5D8F86347FD6FC924F0A97EE67B26929BE87D712E50AB5D21D98E8D94B52
Malicious:	false
Preview:	# default font name..font_name_default=NSimSun....# default font size..font_size_default=12....#Host Appellation..server-hostname=172.31.16.200..playback-server-hostname=localhost..lastconnect-server-hostname=172.31.16.200....#Port number at connection destination..server-port=24004..playback-server-port=24003..module_manage_server_port=10110..vlc_manage_server_port=10120....#Communicator Appellation..communicator-name=DGNPCommunicator....#Trial frequency of initial connection (-1:unrestraint.CThe rest:Specified frequency)..max-connect-trials=1....#Connected return of Trial frequency (-1:unrestraint.CThe rest:Specified frequency)..max-reconnect-trials=0....#Interval of Connected trial(ms)..trial-interval=5000....#read of Communicator.ECycle of Writing Loop..io-loop-cycle=200....#Time-out of HELLO..reply-hello-timeout=15000....#ECHO Transmission Cycle..heartbeat-cycle=10000..playback-heartbeat-cycle=10000..#playback-heartbeat-cycle=2147483647....#Reply ECHO Time-out..#GNPAdmSession.HEAR

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\current\vdrViewer.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3637
Entropy (8bit):	5.2375778608011405
Encrypted:	false
SSDEEP:	96:h0hct8T5oLVmg54ua8l9lyj+HHBZkn8l8/8DK:hUct8iY3ua8nyanBZkn0gH
MD5:	7A2CDAFCE38EDB8F29DD4A367CEB34B9
SHA1:	E1A6B983982ACF6B46317AE8114C99BC806D459C
SHA-256:	F48165D0DC1BB6462034DD9F4C9F31E37123433794813B16CC99BF3F565F786E
SHA-512:	32C3833A37FB9D5FD25E434A724BB54FCE85CA756A5DE4B4C5773A1DCA160A6217AF9D98A71646F1800154862EDE9034AC73A285B2DE584B4C1683B1D4BFC88D
Malicious:	false
Preview:	# default font name..font_name_default=NSimSun....# default font size..font_size_default=12....# font size of Numeric Data Display component..font_size_numeric_data_display=18....#Host Appellation..server-hostname=172.31.16.200..playback-server-hostname=localhost..lastconnect-server-hostname=172.31.16.200....#Port number at connection destination..server-port=24001..playback-server-port=24002..module_manage_server_port=10110..backup-server-port=24006....#Communicator Appellation..communicator-name=DGNPCommunicator....#Trial frequency of initial connection (-1:unrestraint.CThe rest:Specified frequency)..max-connect-trials=1....#Connected return of Trial frequency (-1:unrestraint.CThe rest:Specified frequency)..max-reconnect-trials=-1....#Interval of Connected trial(ms)..trial-interval=5000....#read of Communicator.ECycle of Writing Loop..io-loop-cycle=200....#Time-out of HELLO..reply-hello-timeout=15000....#ECHO Transmission Cycle..heartbeat-cycle=10000..playback-heartbeat-cycle=10000..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\alarm\comment_userAlarm.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2703
Entropy (8bit):	5.879402274914046
Encrypted:	false
SSDEEP:	48:cBP/g5cGeY2sd/eZcGeY2uWcGeY2u3ueQFtRLcGeY2pGUBG:mg5dEJoj3fQFPF8GWG
MD5:	F2FC9559FCB964E24DBDC5F87DCA37BC
SHA1:	B341D31DFC2EBE000B1A91AA1F1E02C0F64056E9
SHA-256:	B4068299F8FC2D0B7CAB3CAEADE09531FE1257A90FFE95A750869EE82F983246
SHA-512:	9DD6567DCD6D61B5FBCF94A4C32C1843181EF64AF627C973F7878E1F6918109D250531CBFCB6E406B47E708D22D9028DB2515D0B382742269D6CAE64B6BC9F16
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>.. ..ope1..ope2.................................................................XML....................................................-->..<UserAlarmList>.. .............XML.......id...............................7....................... -->..<UserAlarm active="true" id="Alarm-A" name="Alarm-A" buzzer="c:/windows/media/tada.wav">...<OccuurrenceCondition alarmType="analog" channel="Analog001" cond1="10" ope1="1" ope2="3" cond2="20" />...<RecoverCondition alarmType="analog" channel="Analog001" cond1="10" ope1="2" ope2="2" cond2="20" />..</UserAlarm>.... .............XML..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\alarm\is-2EIHU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.052401000084611
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgC4vIAyCwz1mF3KDEJM8lycy:TMVBdYvyW3YERyR
MD5:	FDE9308F356C5B798A8CC795B5E133F3
SHA1:	D3800C6CF0FE17085D2C64900FFC3977BC95E9CA
SHA-256:	302739211F66760DD450A55D206223C20A9A23DCBA36F4CDE58E5EE650E9932B
SHA-512:	C75248B6E16D9D81C130638F1E41A42AC4EBB05861712862806662D67FC03F90A353F59DAAA53B4C3351254846445B1AF35B945BC3AB92D71ED2C8615523C15F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<UserAlarmList buzzPlay="2" display="false">..</UserAlarmList>..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\alarm\is-D50D5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15778
Entropy (8bit):	5.088110386346183
Encrypted:	false
SSDEEP:	384:xrqkUPr9km5r4kEWrrkEzrmkcxQrJk2Brkkcw4rnksI:sVeyiGKhI
MD5:	86EEA51F0044FE09C9E1B64DCF9FC09F
SHA1:	5EE40096FB997FC0DDD809CDFFDF9063EF36A580
SHA-256:	F037F111AC0C70BB66FB0049909B35B5B374C8D18AD79F3F4C61D6921CA606E5
SHA-512:	1802C13B5DB8026AFF97ABD02E246C84676129E9659C3C834EB59E0CDE9D2FF8D9FCA05737059A6AFCC33C60747FACD2F64256DCDB6E3C826418A74919537FCE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<UserAlarmList buzzPlay="0" display="true">..<UserAlarm active="false" id="Alarm-A" name="Alarm-A1" buzzer="c:/windows/media/tada.wav">..<OccuurrenceCondition alarmType="analog" channel="AN001" cond1="12.0" ope1="1" ope2="2" cond2="26.0" />..<RecoverCondition alarmType="analog" channel="AN001" cond1="27.0" ope1="3" ope2="0" cond2="" />..</UserAlarm>..<UserAlarm active="false" id="Alarm-B" name="Alarm-B1" buzzer="c:/effects/hogehoge.wav">..<OccuurrenceCondition alarmType="digital" channel="DC001" cond1="1" />..<RecoverCondition alarmType="digital" channel="DC001" cond1="0" />..</UserAlarm>..<UserAlarm active="false" id="Alarm-C" name="Alarm-C1" buzzer="c:/effects/hogehoge.wav">..<OccuurrenceCondition alarmType="serial" channel="SI01" condMode="Number" decoder="dec1" cond1="10.0" ope1="1" ope2="1" cond2="20.0" cond3="" />..<RecoverCondition alarmType="serial" channel="SI01" condMode="Number" decoder="dec1" cond1="10.0" ope1="2" ope2="1" cond2="20.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\alarm\is-PAMK8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2703
Entropy (8bit):	5.879402274914046
Encrypted:	false
SSDEEP:	48:cBP/g5cGeY2sd/eZcGeY2uWcGeY2u3ueQFtRLcGeY2pGUBG:mg5dEJoj3fQFPF8GWG
MD5:	F2FC9559FCB964E24DBDC5F87DCA37BC
SHA1:	B341D31DFC2EBE000B1A91AA1F1E02C0F64056E9
SHA-256:	B4068299F8FC2D0B7CAB3CAEADE09531FE1257A90FFE95A750869EE82F983246
SHA-512:	9DD6567DCD6D61B5FBCF94A4C32C1843181EF64AF627C973F7878E1F6918109D250531CBFCB6E406B47E708D22D9028DB2515D0B382742269D6CAE64B6BC9F16
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>.. ..ope1..ope2.................................................................XML....................................................-->..<UserAlarmList>.. .............XML.......id...............................7....................... -->..<UserAlarm active="true" id="Alarm-A" name="Alarm-A" buzzer="c:/windows/media/tada.wav">...<OccuurrenceCondition alarmType="analog" channel="Analog001" cond1="10" ope1="1" ope2="3" cond2="20" />...<RecoverCondition alarmType="analog" channel="Analog001" cond1="10" ope1="2" ope2="2" cond2="20" />..</UserAlarm>.... .............XML..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\alarm\max-userAlarm.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15778
Entropy (8bit):	5.088110386346183
Encrypted:	false
SSDEEP:	384:xrqkUPr9km5r4kEWrrkEzrmkcxQrJk2Brkkcw4rnksI:sVeyiGKhI
MD5:	86EEA51F0044FE09C9E1B64DCF9FC09F
SHA1:	5EE40096FB997FC0DDD809CDFFDF9063EF36A580
SHA-256:	F037F111AC0C70BB66FB0049909B35B5B374C8D18AD79F3F4C61D6921CA606E5
SHA-512:	1802C13B5DB8026AFF97ABD02E246C84676129E9659C3C834EB59E0CDE9D2FF8D9FCA05737059A6AFCC33C60747FACD2F64256DCDB6E3C826418A74919537FCE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<UserAlarmList buzzPlay="0" display="true">..<UserAlarm active="false" id="Alarm-A" name="Alarm-A1" buzzer="c:/windows/media/tada.wav">..<OccuurrenceCondition alarmType="analog" channel="AN001" cond1="12.0" ope1="1" ope2="2" cond2="26.0" />..<RecoverCondition alarmType="analog" channel="AN001" cond1="27.0" ope1="3" ope2="0" cond2="" />..</UserAlarm>..<UserAlarm active="false" id="Alarm-B" name="Alarm-B1" buzzer="c:/effects/hogehoge.wav">..<OccuurrenceCondition alarmType="digital" channel="DC001" cond1="1" />..<RecoverCondition alarmType="digital" channel="DC001" cond1="0" />..</UserAlarm>..<UserAlarm active="false" id="Alarm-C" name="Alarm-C1" buzzer="c:/effects/hogehoge.wav">..<OccuurrenceCondition alarmType="serial" channel="SI01" condMode="Number" decoder="dec1" cond1="10.0" ope1="1" ope2="1" cond2="20.0" cond3="" />..<RecoverCondition alarmType="serial" channel="SI01" condMode="Number" decoder="dec1" cond1="10.0" ope1="2" ope2="1" cond2="20.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\alarm\userAlarm.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.052401000084611
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgC4vIAyCwz1mF3KDEJM8lycy:TMVBdYvyW3YERyR
MD5:	FDE9308F356C5B798A8CC795B5E133F3
SHA1:	D3800C6CF0FE17085D2C64900FFC3977BC95E9CA
SHA-256:	302739211F66760DD450A55D206223C20A9A23DCBA36F4CDE58E5EE650E9932B
SHA-512:	C75248B6E16D9D81C130638F1E41A42AC4EBB05861712862806662D67FC03F90A353F59DAAA53B4C3351254846445B1AF35B945BC3AB92D71ED2C8615523C15F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<UserAlarmList buzzPlay="2" display="false">..</UserAlarmList>..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\conning\ConningDefinition.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	38118
Entropy (8bit):	4.321741164502036
Encrypted:	false
SSDEEP:	384:EBuBcU49pBuBcU49sXtVYU49oB/KOr97tih3hpvMU49EB/Kwr9zHZ4OpiIRsiG06:g5bwnW0W51WEl7Vbe
MD5:	076CB4B126DD51BA6FB3C8F6CB353219
SHA1:	93DE653037611840C10D73EE2D6CAF0FAA7D866B
SHA-256:	4F44D0240E7A914027B5E40088B9544EA2FED854633B664B206E45E814B08B37
SHA-512:	22E5B577A7A1C7FBAE626304B7F90880FDAAC5DC59862DA5F5B75D538033F362C1A18C189784AE0020C67909BD8A7CC1C771E083816DA9282C937C5C05104811
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?> ..<java version="1.7.0_25" class="java.beans.XMLDecoder"> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>Conning</string> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>15</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.NumericDataDisplayForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.NumericDataDisplayObject</string> .. </void> .. <void property="data"> .. <void index="0"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. <void index="1"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. <void index="2"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. </void> .. <void property="flag"> .. <array class

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\conning\DefaultConningDefinition.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8247
Entropy (8bit):	4.55942294731948
Encrypted:	false
SSDEEP:	192:o5XYQYF6f6IKHM8grk3adkt16JBdkKgCgH:op/626B74m4es3dZbi
MD5:	4ED526AE7B9E764203550776F8AD9B61
SHA1:	64C4C6AD40980A9027914082418E83F1DFFB2DAE
SHA-256:	B30A49DBDCECA84BE2ED3CF069E1B23849A2BD80F3508681F0B1DAEB26A961EB
SHA-512:	F1ADE776B966404B14E82C91E19014424F9029AC60D00E7C52A4B788A759C7920861800DCE7A3F919863CBC902F15772DF0AFA84ABD7C52DA977F43A9D2F0149
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?> ..<java version="1.7.0_25" class="java.beans.XMLDecoder"> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>FullSetSheet</string> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>15</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.CompassForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.CompassObject</string> .. </void> .. <void property="key"> .. <string>CompassSheet</string> .. </void> .. <void property="x"> .. <int>313</int> .. </void> .. </object> .. </void> .. <void method="put"> .. <string>13</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.NumericDataDisplayForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.NumericDataDisplayObject</string> .. </void> .. <void property="key"> ..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\conning\is-9TO75.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8247
Entropy (8bit):	4.55942294731948
Encrypted:	false
SSDEEP:	192:o5XYQYF6f6IKHM8grk3adkt16JBdkKgCgH:op/626B74m4es3dZbi
MD5:	4ED526AE7B9E764203550776F8AD9B61
SHA1:	64C4C6AD40980A9027914082418E83F1DFFB2DAE
SHA-256:	B30A49DBDCECA84BE2ED3CF069E1B23849A2BD80F3508681F0B1DAEB26A961EB
SHA-512:	F1ADE776B966404B14E82C91E19014424F9029AC60D00E7C52A4B788A759C7920861800DCE7A3F919863CBC902F15772DF0AFA84ABD7C52DA977F43A9D2F0149
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?> ..<java version="1.7.0_25" class="java.beans.XMLDecoder"> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>FullSetSheet</string> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>15</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.CompassForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.CompassObject</string> .. </void> .. <void property="key"> .. <string>CompassSheet</string> .. </void> .. <void property="x"> .. <int>313</int> .. </void> .. </object> .. </void> .. <void method="put"> .. <string>13</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.NumericDataDisplayForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.NumericDataDisplayObject</string> .. </void> .. <void property="key"> ..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\conning\is-LCRJ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	38118
Entropy (8bit):	4.321741164502036
Encrypted:	false
SSDEEP:	384:EBuBcU49pBuBcU49sXtVYU49oB/KOr97tih3hpvMU49EB/Kwr9zHZ4OpiIRsiG06:g5bwnW0W51WEl7Vbe
MD5:	076CB4B126DD51BA6FB3C8F6CB353219
SHA1:	93DE653037611840C10D73EE2D6CAF0FAA7D866B
SHA-256:	4F44D0240E7A914027B5E40088B9544EA2FED854633B664B206E45E814B08B37
SHA-512:	22E5B577A7A1C7FBAE626304B7F90880FDAAC5DC59862DA5F5B75D538033F362C1A18C189784AE0020C67909BD8A7CC1C771E083816DA9282C937C5C05104811
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?> ..<java version="1.7.0_25" class="java.beans.XMLDecoder"> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>Conning</string> .. <object class="java.util.HashMap"> .. <void method="put"> .. <string>15</string> .. <object class="jp.co.furuno.vdr.ui.viewer.config.property.form.NumericDataDisplayForm"> .. <void property="component"> .. <string>jp.co.furuno.vdr.dooars.component.NumericDataDisplayObject</string> .. </void> .. <void property="data"> .. <void index="0"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. <void index="1"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. <void index="2"> .. <void property="mode"> .. <boolean>true</boolean> .. </void> .. </void> .. </void> .. <void property="flag"> .. <array class

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\decoder\DefaultDefineDecoder.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (363), with CRLF line terminators
Category:	dropped
Size (bytes):	149810
Entropy (8bit):	5.440728394068986
Encrypted:	false
SSDEEP:	1536:yPcwlLPcwAzPcwBmPDbYjPDbdcPDbuZPDb09PDb3RPDbalPDbQePDbILPDbGnPau:05HHNlpK2SF8b2jfnJ1b
MD5:	98EF1EA9CB80CE74CABD805DAF5C5232
SHA1:	21BFA9B8D650854681434CB7115FFEA1703C1B3F
SHA-256:	7846246A6303D714FE1A4B35BCA9105E6518FBF29A433AF4AD1325722CC447E2
SHA-512:	44841922EC96D590DAD05A995B44340D78F8AC42D5141E87A229FB37C319DD117D7D57FD6623F1F369C8072EBEB68D9DD52ED09A0C9039E07A8C65354B912410
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="no"?><DECODERS><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Depth(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">Echo sounder\</PROPERTY><PROPERTY name="Description"/><PROPERTY name="DecoderScript">Search for DPT....print( #2,"M");..trend(double(#2));..</PROPERTY></NMEA-DECODER><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Offset(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">Echo sounder\</PROPERTY><PROPERTY name="Description"/><PROPERTY name="DecoderScript">Search for DPT..print( #3,"M");..trend( double(#3) );..</PROPERTY></NMEA-DECODER><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Range(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\decoder\UserDefineDecoder.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.894918389718543
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCaOELA/schlA:TMVBd6OjY
MD5:	EDD4E78B0335455E0860E25CC63F56B6
SHA1:	1928DB934894162ADD003053AE0CB1C54A45350F
SHA-256:	7157D1AB6A5F59517FA275798E036570882ABB5815E18C194F0D7EB24A7DC739
SHA-512:	B4C678DAACF67775C252E73ED1903C5788BD02A1CACBF2F848692F60405DCFE3568B1EE8DA4526D74699C28141E7BDDEA064841ADFCA6ACCFF9D4F27CF79311C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?><DECODERS/>

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\decoder\is-3M4GO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.894918389718543
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgCaOELA/schlA:TMVBd6OjY
MD5:	EDD4E78B0335455E0860E25CC63F56B6
SHA1:	1928DB934894162ADD003053AE0CB1C54A45350F
SHA-256:	7157D1AB6A5F59517FA275798E036570882ABB5815E18C194F0D7EB24A7DC739
SHA-512:	B4C678DAACF67775C252E73ED1903C5788BD02A1CACBF2F848692F60405DCFE3568B1EE8DA4526D74699C28141E7BDDEA064841ADFCA6ACCFF9D4F27CF79311C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?><DECODERS/>

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\decoder\is-V7SIN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (363), with CRLF line terminators
Category:	dropped
Size (bytes):	149810
Entropy (8bit):	5.440728394068986
Encrypted:	false
SSDEEP:	1536:yPcwlLPcwAzPcwBmPDbYjPDbdcPDbuZPDb09PDb3RPDbalPDbQePDbILPDbGnPau:05HHNlpK2SF8b2jfnJ1b
MD5:	98EF1EA9CB80CE74CABD805DAF5C5232
SHA1:	21BFA9B8D650854681434CB7115FFEA1703C1B3F
SHA-256:	7846246A6303D714FE1A4B35BCA9105E6518FBF29A433AF4AD1325722CC447E2
SHA-512:	44841922EC96D590DAD05A995B44340D78F8AC42D5141E87A229FB37C319DD117D7D57FD6623F1F369C8072EBEB68D9DD52ED09A0C9039E07A8C65354B912410
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="no"?><DECODERS><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Depth(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">Echo sounder\</PROPERTY><PROPERTY name="Description"/><PROPERTY name="DecoderScript">Search for DPT....print( #2,"M");..trend(double(#2));..</PROPERTY></NMEA-DECODER><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Offset(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">Echo sounder\</PROPERTY><PROPERTY name="Description"/><PROPERTY name="DecoderScript">Search for DPT..print( #3,"M");..trend( double(#3) );..</PROPERTY></NMEA-DECODER><NMEA-DECODER Readonly="true" Type="Analog"><PROPERTY name="Title">Range(DPT)</PROPERTY><PROPERTY name="InputType">NMEA</PROPERTY><PROPERTY name="Formatter">DPT</PROPERTY><PROPERTY name="DecoderPath">

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\is-CK4FG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with very long lines (467), with CRLF line terminators
Category:	dropped
Size (bytes):	4949
Entropy (8bit):	5.289970304199814
Encrypted:	false
SSDEEP:	96:C6ctwrT5oLxL4wCjjRnUlcs7VSkkE4k3oclr:VctwriewCjVnUlcs/kZk3oclr
MD5:	4B86853D7BF2673B52A917859F8EAE44
SHA1:	0093D813529841158F9BCFB67DAA6F1713F47AA8
SHA-256:	1525B54F9DD32AD96A7D74A950502E044E0F890C7D3BAD2BDD81C4587216398D
SHA-512:	D5C269B602219814554CE616ABF57D17C9FFA6B48DA38318C81A58528770005F43BE5D8F86347FD6FC924F0A97EE67B26929BE87D712E50AB5D21D98E8D94B52
Malicious:	false
Preview:	# default font name..font_name_default=NSimSun....# default font size..font_size_default=12....#Host Appellation..server-hostname=172.31.16.200..playback-server-hostname=localhost..lastconnect-server-hostname=172.31.16.200....#Port number at connection destination..server-port=24004..playback-server-port=24003..module_manage_server_port=10110..vlc_manage_server_port=10120....#Communicator Appellation..communicator-name=DGNPCommunicator....#Trial frequency of initial connection (-1:unrestraint.CThe rest:Specified frequency)..max-connect-trials=1....#Connected return of Trial frequency (-1:unrestraint.CThe rest:Specified frequency)..max-reconnect-trials=0....#Interval of Connected trial(ms)..trial-interval=5000....#read of Communicator.ECycle of Writing Loop..io-loop-cycle=200....#Time-out of HELLO..reply-hello-timeout=15000....#ECHO Transmission Cycle..heartbeat-cycle=10000..playback-heartbeat-cycle=10000..#playback-heartbeat-cycle=2147483647....#Reply ECHO Time-out..#GNPAdmSession.HEAR

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\is-KOO7T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3637
Entropy (8bit):	5.2375778608011405
Encrypted:	false
SSDEEP:	96:h0hct8T5oLVmg54ua8l9lyj+HHBZkn8l8/8DK:hUct8iY3ua8nyanBZkn0gH
MD5:	7A2CDAFCE38EDB8F29DD4A367CEB34B9
SHA1:	E1A6B983982ACF6B46317AE8114C99BC806D459C
SHA-256:	F48165D0DC1BB6462034DD9F4C9F31E37123433794813B16CC99BF3F565F786E
SHA-512:	32C3833A37FB9D5FD25E434A724BB54FCE85CA756A5DE4B4C5773A1DCA160A6217AF9D98A71646F1800154862EDE9034AC73A285B2DE584B4C1683B1D4BFC88D
Malicious:	false
Preview:	# default font name..font_name_default=NSimSun....# default font size..font_size_default=12....# font size of Numeric Data Display component..font_size_numeric_data_display=18....#Host Appellation..server-hostname=172.31.16.200..playback-server-hostname=localhost..lastconnect-server-hostname=172.31.16.200....#Port number at connection destination..server-port=24001..playback-server-port=24002..module_manage_server_port=10110..backup-server-port=24006....#Communicator Appellation..communicator-name=DGNPCommunicator....#Trial frequency of initial connection (-1:unrestraint.CThe rest:Specified frequency)..max-connect-trials=1....#Connected return of Trial frequency (-1:unrestraint.CThe rest:Specified frequency)..max-reconnect-trials=-1....#Interval of Connected trial(ms)..trial-interval=5000....#read of Communicator.ECycle of Writing Loop..io-loop-cycle=200....#Time-out of HELLO..reply-hello-timeout=15000....#ECHO Transmission Cycle..heartbeat-cycle=10000..playback-heartbeat-cycle=10000..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\sheet\ViewerDefinition.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5572
Entropy (8bit):	4.535836046572228
Encrypted:	false
SSDEEP:	24:2dIlukvg+DM7BvwsCDLB/vwTDdEQ/vCkDsOAOGvTkD4WvUDnEGvxOL1DSP2v8DxU:cIG9O/wtGymkD
MD5:	A71BE58C3D0F810873E17EEAE1341491
SHA1:	E01AA28D7CA07BAC6DA76A86DCF100E58249EA3A
SHA-256:	9B1F353A0CE6CBE93929ED344EB83D3A578055FE3AECDA351BD08FA3FD856D8A
SHA-512:	982CFCB5B9762DBEFDC302BF956D4EAB4C44DCD841CAB0F2CEABBA1005DF2261BC4D63F279AF7748DE4CC32B233E9C882F42E4D82A358B7C64FC06DCEF28DCE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<java version="1.7.0_25" class="java.beans.XMLDecoder">. <object class="java.util.HashMap">. <void method="put">. <string>0</string>. <object class="java.util.HashMap">. <void method="put">. <string>Name</string>. <string>Conning</string>. </void>. <void method="put">. <string>Edit</string>. <string>true</string>. </void>. <void method="put">. <string>Class</string>. <string>jp.co.furuno.vdr.ui.viewer.CustomViewer</string>. </void>. <void method="put">. <string>Icon</string>. <null/>. </void>. </object>. </void>. <void method="put">. <string>1</string>. <object class="java.util.HashMap">. <void method="put">. <string>Name</string>. <string>Serial</string>. </void>. <void method="put">. <string>Edit</string>. <string>true</string>. </void>. <void method="put">. <string>Class</string>. <string>jp.co.furuno.vdr.ui.viewer.SerialViewer</string>.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\sheet\is-LJES7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	5572
Entropy (8bit):	4.535836046572228
Encrypted:	false
SSDEEP:	24:2dIlukvg+DM7BvwsCDLB/vwTDdEQ/vCkDsOAOGvTkD4WvUDnEGvxOL1DSP2v8DxU:cIG9O/wtGymkD
MD5:	A71BE58C3D0F810873E17EEAE1341491
SHA1:	E01AA28D7CA07BAC6DA76A86DCF100E58249EA3A
SHA-256:	9B1F353A0CE6CBE93929ED344EB83D3A578055FE3AECDA351BD08FA3FD856D8A
SHA-512:	982CFCB5B9762DBEFDC302BF956D4EAB4C44DCD841CAB0F2CEABBA1005DF2261BC4D63F279AF7748DE4CC32B233E9C882F42E4D82A358B7C64FC06DCEF28DCE2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<java version="1.7.0_25" class="java.beans.XMLDecoder">. <object class="java.util.HashMap">. <void method="put">. <string>0</string>. <object class="java.util.HashMap">. <void method="put">. <string>Name</string>. <string>Conning</string>. </void>. <void method="put">. <string>Edit</string>. <string>true</string>. </void>. <void method="put">. <string>Class</string>. <string>jp.co.furuno.vdr.ui.viewer.CustomViewer</string>. </void>. <void method="put">. <string>Icon</string>. <null/>. </void>. </object>. </void>. <void method="put">. <string>1</string>. <object class="java.util.HashMap">. <void method="put">. <string>Name</string>. <string>Serial</string>. </void>. <void method="put">. <string>Edit</string>. <string>true</string>. </void>. <void method="put">. <string>Class</string>. <string>jp.co.furuno.vdr.ui.viewer.SerialViewer</string>.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\vdrMaintenanceViewer.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with very long lines (467), with CRLF line terminators
Category:	dropped
Size (bytes):	4949
Entropy (8bit):	5.289970304199814
Encrypted:	false
SSDEEP:	96:C6ctwrT5oLxL4wCjjRnUlcs7VSkkE4k3oclr:VctwriewCjVnUlcs/kZk3oclr
MD5:	4B86853D7BF2673B52A917859F8EAE44
SHA1:	0093D813529841158F9BCFB67DAA6F1713F47AA8
SHA-256:	1525B54F9DD32AD96A7D74A950502E044E0F890C7D3BAD2BDD81C4587216398D
SHA-512:	D5C269B602219814554CE616ABF57D17C9FFA6B48DA38318C81A58528770005F43BE5D8F86347FD6FC924F0A97EE67B26929BE87D712E50AB5D21D98E8D94B52
Malicious:	false
Preview:	# default font name..font_name_default=NSimSun....# default font size..font_size_default=12....#Host Appellation..server-hostname=172.31.16.200..playback-server-hostname=localhost..lastconnect-server-hostname=172.31.16.200....#Port number at connection destination..server-port=24004..playback-server-port=24003..module_manage_server_port=10110..vlc_manage_server_port=10120....#Communicator Appellation..communicator-name=DGNPCommunicator....#Trial frequency of initial connection (-1:unrestraint.CThe rest:Specified frequency)..max-connect-trials=1....#Connected return of Trial frequency (-1:unrestraint.CThe rest:Specified frequency)..max-reconnect-trials=0....#Interval of Connected trial(ms)..trial-interval=5000....#read of Communicator.ECycle of Writing Loop..io-loop-cycle=200....#Time-out of HELLO..reply-hello-timeout=15000....#ECHO Transmission Cycle..heartbeat-cycle=10000..playback-heartbeat-cycle=10000..#playback-heartbeat-cycle=2147483647....#Reply ECHO Time-out..#GNPAdmSession.HEAR

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\save\default\vdrViewer.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3637
Entropy (8bit):	5.2375778608011405
Encrypted:	false
SSDEEP:	96:h0hct8T5oLVmg54ua8l9lyj+HHBZkn8l8/8DK:hUct8iY3ua8nyanBZkn0gH
MD5:	7A2CDAFCE38EDB8F29DD4A367CEB34B9
SHA1:	E1A6B983982ACF6B46317AE8114C99BC806D459C
SHA-256:	F48165D0DC1BB6462034DD9F4C9F31E37123433794813B16CC99BF3F565F786E
SHA-512:	32C3833A37FB9D5FD25E434A724BB54FCE85CA756A5DE4B4C5773A1DCA160A6217AF9D98A71646F1800154862EDE9034AC73A285B2DE584B4C1683B1D4BFC88D
Malicious:	false
Preview:	# default font name..font_name_default=NSimSun....# default font size..font_size_default=12....# font size of Numeric Data Display component..font_size_numeric_data_display=18....#Host Appellation..server-hostname=172.31.16.200..playback-server-hostname=localhost..lastconnect-server-hostname=172.31.16.200....#Port number at connection destination..server-port=24001..playback-server-port=24002..module_manage_server_port=10110..backup-server-port=24006....#Communicator Appellation..communicator-name=DGNPCommunicator....#Trial frequency of initial connection (-1:unrestraint.CThe rest:Specified frequency)..max-connect-trials=1....#Connected return of Trial frequency (-1:unrestraint.CThe rest:Specified frequency)..max-reconnect-trials=-1....#Interval of Connected trial(ms)..trial-interval=5000....#read of Communicator.ECycle of Writing Loop..io-loop-cycle=200....#Time-out of HELLO..reply-hello-timeout=15000....#ECHO Transmission Cycle..heartbeat-cycle=10000..playback-heartbeat-cycle=10000..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\serial\SerialOutputSettingList.xml.gz (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 146
Category:	dropped
Size (bytes):	136
Entropy (8bit):	6.119457396458099
Encrypted:	false
SSDEEP:	3:FttDKtoYT6y3tz+T9g2FvpeBs8hycfp/1X2VgRbBktl3/ln:Xt82ktz0e2pMq80qTdid
MD5:	BBD639890647EA87DE8E6B828ADCF0B4
SHA1:	7B03FF46924D274AB92A9CABBF169ED611566F8C
SHA-256:	281E6329955A6B3D59CAE21869A02C70801C93CD8D9ACD2B1CD496A7608C9F64
SHA-512:	0600BFE1C86B41A723C49BFEDB63DE41BFDE4C494795AE8AC36BC20AFBE42F4BCE1B1FE91F8B611DB179D5B94C2AFB8F57A350EF9DCAF06ADDBCE5CE730FEF0A
Malicious:	false
Preview:	...............Q(K-*...U2.3PRH.K.O..K.U..q.P..S..J,KDVg.g.o`.....X\l....KJM.+...qI...Z...`.....\....$3G..(..'..DI.d.>H....B9.=....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\data\serial\is-F3E3L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 146
Category:	dropped
Size (bytes):	136
Entropy (8bit):	6.119457396458099
Encrypted:	false
SSDEEP:	3:FttDKtoYT6y3tz+T9g2FvpeBs8hycfp/1X2VgRbBktl3/ln:Xt82ktz0e2pMq80qTdid
MD5:	BBD639890647EA87DE8E6B828ADCF0B4
SHA1:	7B03FF46924D274AB92A9CABBF169ED611566F8C
SHA-256:	281E6329955A6B3D59CAE21869A02C70801C93CD8D9ACD2B1CD496A7608C9F64
SHA-512:	0600BFE1C86B41A723C49BFEDB63DE41BFDE4C494795AE8AC36BC20AFBE42F4BCE1B1FE91F8B611DB179D5B94C2AFB8F57A350EF9DCAF06ADDBCE5CE730FEF0A
Malicious:	false
Preview:	...............Q(K-*...U2.3PRH.K.O..K.U..q.P..S..J,KDVg.g.o`.....X\l....KJM.+...qI...Z...`.....\....$3G..(..'..DI.d.>H....B9.=....

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AISChannel(VDM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqPXMlJMey:TFeXmfy
MD5:	145995A39403247C48A1294BBD3F24B7
SHA1:	FDE206B8842D5D6DC2C55419FA9132D29BCCDDA9
SHA-256:	8E1E1809D5A615B804ADE5C19320254123200A6A519E2A8EEF7B0195FDFDAD13
SHA-512:	9EA1428CD5C2DC6194578A7FA6C7C7FB8365CC903254B0CD19FCC5DF85191BD9DBF289458BF68A104003F7E504DD69DBF80918595BBCFBEB272CAA9554C1285B
Malicious:	false
Preview:	Search for VDM..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AISChannel(VDO).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqcJMey:TF7fy
MD5:	7C49E7807364975649412DC77DD30551
SHA1:	F8CB158215A90B66A65CB07A7B3873BB7AF84B11
SHA-256:	826A3362A264E57B38103AC2C57FF16D4F49B22F03DB7BE76CA82A9B119B1C5F
SHA-512:	C0CE7A1DD486E87B4FF5FBE13558B1CBF82ADB1B1F3BFBEC6FF23EA9544BBE718BF5BDD94CE5257778CC4057A53C0DC216EC79B644C41B7861EE44046A0BE788
Malicious:	false
Preview:	Search for VDO..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AckState(ALA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6EK:TFi
MD5:	DF1728A7643081E7A94D07541090BF14
SHA1:	645A91B67B8339EDC946057D0DAB3A97F34922D2
SHA-256:	835E85143CE6D5CB78435763641ABC89D81BEED4C010A7A314F3E27FB8C98EA3
SHA-512:	E31DAF5F1D0C872FEF48A7A146924D10289C84BC5EC388CE3D928885EF61D358625DEAC572B15BB429BDAF5F700C914EB7F9A9FE0413A38BD1FEC84AA752698C
Malicious:	false
Preview:	Search for ALA..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AckState(ALR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDzLJMey:TFv9fy
MD5:	88C9E487636A2C623D9B5F05E9FB49FB
SHA1:	192165866308DBDBDD9BB99D02C34879F89D722B
SHA-256:	0E404DE519C37D71714E450710D8ECA3DCE6AF154BEB7925DA9946D542B436A8
SHA-512:	9DCDB5BF2606C6AC3F439D9BD8DF263420CD02F57A510992443FFDCC442ACBFA711AD48EB077662F7ABAD1B553AECA36AC8ECC4E6CE263285C901FB06597E410
Malicious:	false
Preview:	Search for ALR..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AckState(FIR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlFMf:TFLZbK
MD5:	9001A172EA40F02820340531E7188A41
SHA1:	DAA459BCE4ED5638C033AA78879CB220C470A64B
SHA-256:	7CCBCE4B9B81D7584360BB0D4F4D8ABA0DC223789F771B8E9B6F294CE563F85A
SHA-512:	3E090E98D581D96E3C366B6B718CC37213ECB2B7277B3523DF84D686B14E833848DDF32883AB83BA2A656937D9B9F416C9503BE8BBEFD8F90947A6FB2B7F3093
Malicious:	false
Preview:	Search for FIR..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Actual Heel Angle(HRM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.499597622210291
Encrypted:	false
SSDEEP:	3:5NFDkAL7BloFifn:TFQiPYif
MD5:	9A3F4FC9DA8BAAD941D91AA61CD4F056
SHA1:	A643AC5548ED9EC5EC4454298D6FEE5E3FBD3926
SHA-256:	E257BDE9DE1F6BCBBB09BFEDCB1FE7B7F90E3F8AA9D215337A2153097FEF480C
SHA-512:	C3EEDEB418398A20B370DAC32F0E058C30C1370BD9B504935945BA675432B3BDA017E276EBD3706ADDF89101289251EC05663149B33C083A087F1FC49D12B0FC
Malicious:	false
Preview:	Search for HRM..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert Identifer(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDnLNVM3v:TF75VAv
MD5:	80E24D2721BD1B334C125C8EEC3B62C8
SHA1:	F80FD825BF69D54E4CB0E1773FE24D5B25B4EC34
SHA-256:	72F87A34011FD7D1F81B5F5B7DFCBBC4BAA8C00693DD7BF3E848EF7992985DA6
SHA-512:	264537B1A04B0AA67678275E8ED3C2C03A2718E7DFA0DC10AE39C50766174F26233FE31AE13A4E544299676CC53742A6E608B6180E79EC70E54BBCEFA9E4F7F5
Malicious:	false
Preview:	Search for ALF..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 1(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.735821149647001
Encrypted:	false
SSDEEP:	6:TF2JF02fIPc+cUIKrbcbbpI+cZOIKrbcbg4DTc/XKrLW:T0JKOIPfbIGYRUGYX81
MD5:	DE149D0B789E7AA0DCAD82FEEB602683
SHA1:	78885B7A60F066101665BCCCE6473BF4A9BA7D48
SHA-256:	5282A47096F5EE76B05FFD54FA2E82307F4188E73A98B1EC828BEB1DC883FD41
SHA-512:	976B828952F84FCBB97B18B2B856D2492F933D5C2E9BC7364F10CECB7337C8DAEBF358DC7C8ECE892EF04A50A5D66582A10DC62FF353293AD56B55DAF2111AC6
Malicious:	false
Preview:	Search for ALC..print(#7, " ", #6, " ", #8, " ");..if (0 == strcmp(#5,"1"))..{.. if (0== strcmp(substr(#9,1,1),"")).. {.. print(substr(#9,0,0));.. }.. if (0== strcmp(substr(#9,2,2),"")).. {.. print(substr(#9,0,1));.. }..}..if (0 != strcmp(#5,"1"))..{.. print(#9);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 10(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.742918596477533
Encrypted:	false
SSDEEP:	6:TFIQazfIPQ+lIKrbkI+FvIKrbXp4DTcTXKrjy:TOhrIPrlIGC+GXK8ey
MD5:	CE59AA836341199C42FC336B910A2F28
SHA1:	A5532D58B2F6D7D850BCCD1CA688B99BF6773B7E
SHA-256:	45ACB69A6C0E0A76C30A7E7716A731EB131697BED19CDD8BD6EA549704AE5268
SHA-512:	38AC244F621720D9F97E3AF2918224CCC6728CDCB2229AE78D161CAE2D5CDA33FFFC2507175C69A3C76A47D756305F00C996345872B69607C93435B1A83744AC
Malicious:	false
Preview:	Search for ALC..print(#43, " ", #42, " ", #44, " ");..if (0 == strcmp(#5,"10"))..{.. if (0== strcmp(substr(#45,1,1),"")).. {.. print(substr(#45,0,0));.. }.. if (0== strcmp(substr(#45,2,2),"")).. {.. print(substr(#45,0,1));.. }..}..if (0 != strcmp(#5,"10"))..{.. print(#45);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 2(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.7113737109794
Encrypted:	false
SSDEEP:	6:TFwUtzFsKfIPZ+UNjvIKrbUEI+U+kIKrbU8A4DTcMXKrDqe:TPDrIPc6jvIGtPdGD38x
MD5:	F0CEBD8E4DEF2216E6E4AEB384956DC5
SHA1:	4D37F04EA535839E472052091E02772104CB5CEC
SHA-256:	3A066E28039FDC5734B0EB056F6FC1095BC64EFB83666060432E00308CD70938
SHA-512:	F20A662662B36E83006EA174F39DBE0304026117E92597F9D8C3510BB0A7DE5C4BAEFE329102B1453CB99B97616810CADBA1F34CC1D5C81F199B5FE33AAFCA58
Malicious:	false
Preview:	Search for ALC..print(#11, " ", #10, " ", #12, " ");..if (0 == strcmp(#5,"2"))..{.. if (0== strcmp(substr(#13,1,1),"")).. {.. print(substr(#13,0,0));.. }.. if (0== strcmp(substr(#13,2,2),"")).. {.. print(substr(#13,0,1));.. }..}..if (0 != strcmp(#5,"2"))..{.. print(#13);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 3(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.761977534984806
Encrypted:	false
SSDEEP:	6:TFw0dxLVJfIP8yU+UZIKrbU+bpI+U8avIKrbU+g4DTc8ynXKrDoy:TvdxrIPZQIG3RxG3X8Ty
MD5:	ACF74046391BAA4E7390974E507C5101
SHA1:	8DD10E331F58B2BF9774AEE6F383BBE10B3EF85F
SHA-256:	1D02561491D2A5545551EF971CAB3E4B8D26714E3F903CF7D46D802F046EB73F
SHA-512:	7A020E1ACEAE43049B15C88B4C003E262449496F9926DF8674C866CFFA28B57EF059D373CC683FDB655984DC4DEFE6C2BE0CCBE2BE829D4CCCFA78F839A86000
Malicious:	false
Preview:	Search for ALC..print(#15, " ", #14, " ", #16, " ");..if (0 == strcmp(#5,"3"))..{.. if (0== strcmp(substr(#17,1,1),"")).. {.. print(substr(#17,0,0));.. }.. if (0== strcmp(substr(#17,2,2),"")).. {.. print(substr(#17,0,1));.. }..}..if (0 != strcmp(#5,"3"))..{.. print(#17);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 4(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.736443532438877
Encrypted:	false
SSDEEP:	6:TFwudzFxKfIPP+bvIKrb2I+jIKrblp4DTcqXKr4:ThdzFMIPGbvIGMsGM8C
MD5:	AA325D1D4B7F35121264E068DEB91197
SHA1:	82D7F05966FFEDB9C26C182A7864B68A81D17960
SHA-256:	F9E3639A513CD07F8E510E95BA3E12BC572899265944E621040D74492DF7312D
SHA-512:	662E48F2909CE956ACC15F25E199E9BEE8A74B8E8A4BF06098F9FFEAEA5E85DF58D70961F5B134CECBD76DB44F59120EAD6AAFBBCFB17A2DB23FDB7075639478
Malicious:	false
Preview:	Search for ALC..print(#19, " ", #18, " ", #20, " ");..if (0 == strcmp(#5,"4"))..{.. if (0== strcmp(substr(#21,1,1),"")).. {.. print(substr(#21,0,0));.. }.. if (0== strcmp(substr(#21,2,2),"")).. {.. print(substr(#21,0,1));.. }..}..if (0 != strcmp(#5,"4"))..{.. print(#21);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 5(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.7158358044900055
Encrypted:	false
SSDEEP:	6:TFmtfIPQ+1JLIKrbqI+fvIKrbaA4DTcTXKrM:TY1IPrHIGA4Ga38t
MD5:	22F0741BD27F78D768ACF0B401ADCDE8
SHA1:	A9DD8844301C33B89F55DE89747F407B3976B5C7
SHA-256:	253D89D17D8B6803744FE6BD6CC72B1F49471803ADE2FACC7DE8D34440A074B8
SHA-512:	C607E07395D79F2B2B20762971FF99C77BE6660C06BAAB7E496F4FB3B0AD66DDC6A1A62ACCF43D818853B1A37903A24A17BD53C120AEFC7C08C1952BFA762D33
Malicious:	false
Preview:	Search for ALC..print(#23, " ", #22, " ", #24, " ");..if (0 == strcmp(#5,"5"))..{.. if (0== strcmp(substr(#25,1,1),"")).. {.. print(substr(#25,0,0));.. }.. if (0== strcmp(substr(#25,2,2),"")).. {.. print(substr(#25,0,1));.. }..}..if (0 != strcmp(#5,"5"))..{.. print(#25);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 6(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.769404604106139
Encrypted:	false
SSDEEP:	6:TFGVfIPN+UkIKrbeI+7IKrbb4DTcAXKrRy:TgNIPIUkIGUEGE8Jy
MD5:	438383B219045F831E489048B29EB845
SHA1:	A78C6EA8D2CADD8AFB660734E0A1F5C761EA1804
SHA-256:	338E94B600375A70754D6FAE00A3F9A0F2CD3BEFCE863801E1070B05C7351344
SHA-512:	EDC21AE7EBB638B60B4A76DBC40F2FF30306BF5DBD0198D049CC56976A42E7BD7CDD76F0C28B8C1992717011FED8EE71976A7BBAC87886A36118315CBEC9F046
Malicious:	false
Preview:	Search for ALC..print(#27, " ", #26, " ", #28, " ");..if (0 == strcmp(#5,"6"))..{.. if (0== strcmp(substr(#29,1,1),"")).. {.. print(substr(#29,0,0));.. }.. if (0== strcmp(substr(#29,2,2),"")).. {.. print(substr(#29,0,1));.. }..}..if (0 != strcmp(#5,"6"))..{.. print(#29);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 7(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.723438807834864
Encrypted:	false
SSDEEP:	6:TFy2PJnNJFOKfIP2+WtvIKrbWEI+WNIKrbW8A4DTchXKrBjV:TwaJFVIPFWtvIGWiWeGW838+jV
MD5:	79D536C07EB516D9870E03A42D5D9E09
SHA1:	F6F49B0EB2C9F505016D934A5213769A9D38EEFF
SHA-256:	ABF3147E1B9D0C60DD27A5E2990F78B249F6C2B6C94FD11C5F3A7E2DB84DDD72
SHA-512:	21CA30952163CCCA296E87D938A553769A1F04688DB332F2F8F14B13CED9540BA504F0E0394B5BAFC17FBD0EE6617EE01BBB8E5B005D4FB33163FAC7848E3D92
Malicious:	false
Preview:	Search for ALC..print(#31, " ", #30, " ", #32, " ");..if (0 == strcmp(#5,"7"))..{.. if (0== strcmp(substr(#33,1,1),"")).. {.. print(substr(#33,0,0));.. }.. if (0== strcmp(substr(#33,2,2),"")).. {.. print(substr(#33,0,1));.. }..}..if (0 != strcmp(#5,"7"))..{.. print(#33);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 8(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.795187750352116
Encrypted:	false
SSDEEP:	6:TFysrJ9fJnzfIPz+WZIKrbW4I+W6IvIKrbW94DTc+XKrBWLy:TwsnfJrIPiWZIGW2W6GWG8zWLy
MD5:	A334DB2505872573F58D37594AFAEBDF
SHA1:	1C5BB66F46C72B0AEB16C4DB1ECB0176CDE6C4E6
SHA-256:	53FAA76C7D1F324F9E9FFC2E24A2948FE179C3F2537B639518D575B689A2A1D7
SHA-512:	90C4DAAD371F657399BC8207E6CC29EE45C6804BF8CF1118166BE0FE5C2D78F4E1925CB6BFFD143C55AC839AD4D65065A12C2235F638BE1A342E135FE53EDF58
Malicious:	false
Preview:	Search for ALC..print(#35, " ", #34, " ", #36, " ");..if (0 == strcmp(#5,"8"))..{.. if (0== strcmp(substr(#37,1,1),"")).. {.. print(substr(#37,0,0));.. }.. if (0== strcmp(substr(#37,2,2),"")).. {.. print(substr(#37,0,1));.. }..}..if (0 != strcmp(#5,"8"))..{.. print(#37);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Alert entriy 9(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.775567169733104
Encrypted:	false
SSDEEP:	6:TFyIxJFo9uKfIPGyU+hUIvIKrbYI+hIKrbAA4DTcGynXKrS:Tw2o91IPGy3xvIGWaGA38GyH
MD5:	2F2560F0846E110C120CE810E3752610
SHA1:	0E079F7CB82C0A156CE6D30FB69B9ACAC4411C32
SHA-256:	2DD72E6B1271493DD45D0A6E9FECD84B9F1C7111993AA9BC0BF08A2E5275C300
SHA-512:	D1EC4A0CEB6FFA6814DB6FA44762A8B8A30A7ED7C48B4CD3FFA1715E954DFC706CB8B8EFA683C02AC9F08AD547EDE9269125D7FAD77E648A583DBFC4073E8F20
Malicious:	false
Preview:	Search for ALC..print(#39, " ", #38, " ", #40, " ");..if (0 == strcmp(#5,"9"))..{.. if (0== strcmp(substr(#41,1,1),"")).. {.. print(substr(#41,0,0));.. }.. if (0== strcmp(substr(#41,2,2),"")).. {.. print(substr(#41,0,1));.. }..}..if (0 != strcmp(#5,"9"))..{.. print(#41);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AlertType(ALA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6Kfovn:TFlyn
MD5:	7FC3ADEB90AED72F7542EB256D30ABFE
SHA1:	28042ECFB24E33B4D9CFF0496E4910A51E3D9BB1
SHA-256:	85E91F9AB82BCAE4A89CF9EFA4DBB459A38354FFA8AE0AF819A8ADDFBF302CE2
SHA-512:	33EA6AC1DE593588BD41E35D3A59CDEBCFD55DC5D6C751C3BC32B109896A82FD06C10F2492652C1E39AC063FBC03F9C88AD1265B329A846FC9233977E8E28136
Malicious:	false
Preview:	Search for ALA..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Altitude(DTM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.601409765557392
Encrypted:	false
SSDEEP:	3:5NFDpLEJn3v:TFAnf
MD5:	F115DCEEF4C93CF8C4FB2663F6B84764
SHA1:	08512C44C65FEB5947D0D6D25D31700DCBB974D7
SHA-256:	52579E2F55AB543493A379A5C9DCF7E62276F8864634FC681F61BCDFB601679E
SHA-512:	0A331B3570985D7AED499B064E74B546C530776C4786321B4DC3362B51C4FDEB9A41807EA2C53CE626E7A700F510611DC34A288CA4D2264F095B0AF957693FDB
Malicious:	false
Preview:	Search for DTM..print(#8,"m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AntennaAltitude(GGA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDWkov4NVJFogv:TFXogVJF/
MD5:	014CB208D01B175CFEB1A8DF1AF2A04D
SHA1:	073BEE6BFD1DA79B9034BC60E6E0FDD13F63170C
SHA-256:	B53330BEB6E18F1A652B357351BC4FADA1C0276B434BE2439A1950A4ED1FDAFB
SHA-512:	28F733486C476B8D1580FAFCDAA303C7E02E9F5DA355E026297FFC7C376B78F1F0FE06C38CB88F81F4FA980C009DDD4B53F142065D556D45F5EB054EB074B8A7
Malicious:	false
Preview:	Search for GGA..print(#10, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AntennaAltitude(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDf2plNVJFogv:TFbYVJF/
MD5:	F29BA361323A5F7A9FF63E0133FE76ED
SHA1:	8A21A3E39DC3B083C7F39CE0A1D5B32AC159BB51
SHA-256:	8AF519F7602AF80D6E6029405B06980105D14CC2F3A420D7F370F4BFAD1A106E
SHA-512:	57DFE45BE5C667E76DB8F24E5B2EE8B2D6F66E5E3D9017CDF2D76BD2272B8795DF6AFAA789F2675BDE779AFC20E8E2267A0B3D7459B797DABEB30A283EF5FDC5
Malicious:	false
Preview:	Search for GNS..print(#10, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AzimuthDemand(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.39212668463354
Encrypted:	false
SSDEEP:	3:5NFDcclGv:TFI1v
MD5:	B398422890D6B44DE6371998BB906B79
SHA1:	9EA80D69266E0918DBEE3A0941AB4E3E2D09D2BE
SHA-256:	93684712BC62045311266009F77EFCFB851AFF92FBFE7F735BA5127B67EC75A6
SHA-512:	1D80C144EDFAE2AC15DEB0A11F93BA9B2F32D1B06EE32E679A3D03D62D942B7E165D665A3DF661A70681DCEB5D9630F145FEA911141D48F775A48809A8EC74AF
Malicious:	false
Preview:	Search for TRC..print( #7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\AzimuthResponse(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.39212668463354
Encrypted:	false
SSDEEP:	3:5NFD5KGv:TF1lv
MD5:	B050E06A5A0AFCE12467C1D9CFB087D3
SHA1:	F677E352C8AA84801D4D1A8BC5B8EB555C49E74D
SHA-256:	052EEA304152D8F7809D1D3AE836E70F8C429A564428838E8D2ACBEBCE82E304
SHA-512:	EB54DDC4C862753A15C0B504FB4B3A3BF1736517A0ECA6B97D21B66F50A6F033A1F4C1E664B025EB128E762B21ED3447D794AE9EC9D97E7EA453F7A19AB82A23
Malicious:	false
Preview:	Search for TRD..print( #7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\COG(RMC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	592
Entropy (8bit):	4.860033044912777
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloAYClopYCGtquYdf8Bloololc6GZ:Z925tjyVCyGCtd0Byoylc6i
MD5:	0872984EBBE74761131D858F84A5CEF0
SHA1:	029A8193AE37EC088252EB50D1A0903AA90F37BD
SHA-256:	3575E154F98A0ADDBB3DEF59EA5826E7C09075751B9ED796DC439DDD3DD35D4A
SHA-512:	BB1E2C4F85D25EB38CBE3B2AAB807C207FABB5928BE7EA3D763FF1699C20FC5E31EC8C5647EDA83EE928B0377D7597800EFB7071C29BAFE50A7155A48F88DE0C
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. .print( #9,".");...trend(double( #9));.. return;..}..if (strcmp(#13,"D")==0){...print( #9,".");...trend(double( #9));.. return;..}..print( "!");...print( #9,".");...trend(double( #9));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\COGMagn(VTG).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFD6b40/ZHBloFDy:TFM7RPYW
MD5:	4B9A028A5729946076CA012760D3D110
SHA1:	625119C8024B69A8EE743480EE7AA09F7BA88F53
SHA-256:	7AB1C77E93C64BFD59027FDC0EE3CB084C34A92C37AA425B63D66C19E2DB63B0
SHA-512:	08B34C801029C3BC4528F52C1F8D8D4A26617E958470E4B4AEFB9D2FC10AD6A922300515D91091109CB215A95735A168B7C6FDCB71232C19B3276FACFC98B37C
Malicious:	false
Preview:	Search for VTG..print( #4,".");..trend(double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\COGTrue(VTG).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFD6b4sfZHBloFifn:TFMnPYif
MD5:	E92F73416A8878299DA905044383B97A
SHA1:	2DAEBF505B3A6F38DB7C7896747D73509B3F2787
SHA-256:	948B6E0C700BC186B855ECDAB1D197F50E5583CF3024EDA8566E97BC4FF7CFE3
SHA-512:	0259D13D9E9C9BCBB19C579D42F7714F1E2C064F82B7993EEB457F1E577AACE68D44C83D5169E24CC63ABBA509776E05579EE9B0A873441DD574190DFACD4934
Malicious:	false
Preview:	Search for VTG..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Category(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLKfovn:TF7yyn
MD5:	F423C1F65DED70800300E8AFECF993F2
SHA1:	757337AF85BD8CAAA31FF00B730E589372BE552B
SHA-256:	53CF4F5308E94066E6EA0DBC0548013192B7BBE5B1735CD9F3BA6B8509A44365
SHA-512:	1110DA4E7FA1875C60A0D14B10A8C4DAEC68995605D3348C9D6AD4201B4897CEC25794DD8C316F4061FBE0871E0ACAD529A4168F83B92E0E3FD5D78FD7845E1C
Malicious:	false
Preview:	Search for ALF..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ChangeTime(ALR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.638611091386151
Encrypted:	false
SSDEEP:	3:5NFDzLH2XUXmMJwQwUXVfHYQwUX1L4QwUXE:TFvUUlwjUlfHYjUFL4jU0
MD5:	5C0B309F240036081410AA92DF7076D7
SHA1:	20095BDEC142AF5DCE3B762A0739A5A63E851B59
SHA-256:	DF3B267C5D0F2C982061A4AB0F159025AE938E1B98C2B3ACB96CA622722A8262
SHA-512:	284B55055D3565121D7A96584940A91F02ED04214092F1B5DC8590ADFCD2F7D1D3AC80062D94613401586D3EC4515210557293B879E9E899F639BF2483830FB5
Malicious:	false
Preview:	Search for ALR..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5),".",substr(#2,7,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Code(ACM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulPMf:TF9K
MD5:	FF321DFAE0D8A5030FC249A7F6C5F678
SHA1:	8F628AC1117DF22EF1AE6B0FCFB08D4886941466
SHA-256:	A75484C2BC6FE73D3E73E5F1ECA827B7D537872FB97DE44252E8FEFB0F0173C2
SHA-512:	89281FD3273D0AD877F927FE3623704697B1295925DF33277223EF634E5BF3F8677DF30F6D4A3EA2B370C807D898195A8E3A3DA9F7A508319951A1D0F81F8ACE
Malicious:	false
Preview:	Search for ACM..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Code(ACN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6PMf:TFNQK
MD5:	B41312F75583AE3C1D61A1914291ED7C
SHA1:	D03125FB6E4E773C9162EEEA363EB39A014C8E48
SHA-256:	040334504D902D0C7A850439D158FCF8975387DFA4C202B73B1B76CC4363ACC6
SHA-512:	E6BB3118B65359E953ABC4F41FC1990E51B68B379896255AE02AC9EA55189C0C85EFD10BEEBE8EB37B3FCAF028B5664382F2130C0BE24FE087D86784CA7D8E26
Malicious:	false
Preview:	Search for ACN..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Code(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLFMf:TF7xK
MD5:	38BB0B8E4C27959F084DFCD3EC02C9CB
SHA1:	FB4CF5B1B7CFC835CF396EE73F77A8DF704FE263
SHA-256:	BF8C9252A0FD961B1C6BD662E08BA44460F752BCF86689CAE74008465F992C52
SHA-512:	7CA5531C02A3AAB4A3A9C33F8A8595E1D2898CBAA84A9670247A53714002339469742B7E7FE136108740667B869328ADB7A0EB52150FF8F3D86ADA796F644BCF
Malicious:	false
Preview:	Search for ALF..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Command(ACM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulKfovn:TFoyn
MD5:	A9C7C1ABB3A328E9C2D0293F8CF82BF0
SHA1:	DD64CF4E8302626651D17758F0BF9C5AB00C71DF
SHA-256:	20BBE88D081ABDE5EEC5685ACD183AFC74A1DFF5BDE9108FCDC97ABC8406918D
SHA-512:	9217FF1FEBD9E87F2EC5BDF463C9AC84B35A7B9893880AB3414080A8382BFCEBF335018427B932D097BCDFE25D7C727551C44F4E9CEEBFACDC01792A4F5F81FC
Malicious:	false
Preview:	Search for ACM..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Command(ACN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6Kfovn:TFNpyn
MD5:	37D082C0B9E46111035436D10E4D26F2
SHA1:	F211D8942FB301E2492639A806301CAD2DAEAEE2
SHA-256:	F68F3F3B26B3AC3D66D09CE95449CCE47C2A4C40E5DA8FFAC6757600B171C9ED
SHA-512:	8C6F9905C7CA82674E0528C239CCD3E8F3FDD6C998E4D663A3DDC73D2BF6A62042C335242C62E5B9467937EC8C01F75418708830BF88820ECDF05906838C7F89
Malicious:	false
Preview:	Search for ACN..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\CommandedHeadingM(HSC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.730915395146161
Encrypted:	false
SSDEEP:	3:5NFDHFMl0/ZHBloFDy:TFnRPYW
MD5:	9BBAA32C70B631D6F2EC1123BC3F7CB8
SHA1:	8DF235621EE5FF025E48593FFFF6DAF3CCA8C880
SHA-256:	BD46A9E33A2246BB335A8AA04B252193E14625026AFF2C5043D66670D0673962
SHA-512:	443F6D4AAB01814070E618E0368330A5F2172FCD64A8060D0214CD766CE4DF2DA47C318DDDEE3E1DFC542905C43916B352515551ACC352ABCD5481E0C95A0FB9
Malicious:	false
Preview:	Search for HSC..print( #4,".");..trend(double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\CommandedHeadingT(HSC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.730915395146161
Encrypted:	false
SSDEEP:	3:5NFDHFMlsfZHBloFifn:TF7PYif
MD5:	04E5693FF20BBBE70605F7D5ECA497CE
SHA1:	0B8F4304DDB780C96825F536E847260C67849E27
SHA-256:	34CC3E64901E67735E101766350084174FCAEAE693C445F5B4CBA04AC48CA9D2
SHA-512:	32C024BBD8D56ED6AA8ED005C15F6814D4E149BF11DAEA045EAB4B6FC49104FEA986F256A782D4D2E8816C2E0AE9264EA57DB16D4CF6D1B96A09C35FF83E3F34
Malicious:	false
Preview:	Search for HSC..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\CommandedHeadingT(HTC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.7491279525714525
Encrypted:	false
SSDEEP:	3:5NFDNliseZHBloFxK:TFGswPYxK
MD5:	616D26A8F1C816E8FFE130104D6237EE
SHA1:	A49CAD6B0CF3DF3466E0F101AD13CEE692778939
SHA-256:	212A268679FECE731A57E7D5C849BA6D7D1C7774F2E5F7B63D58292BBDD03E0B
SHA-512:	3E7B9A99E5FC5D6871B6ACA0D53A997A643A0435609481F68672BAB29EAB52A3892D6A5437EC7F6EE10DD8F06AB17D0FCC2880E9821187742860C4194FA61626
Malicious:	false
Preview:	Search for HTC..print( #11,".");..trend(double( #11));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\CommandedHeadingT(HTD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.7491279525714525
Encrypted:	false
SSDEEP:	3:5NFDBVXKiseZHBloFxK:TFt9tswPYxK
MD5:	1A3ED18F18EFD04ACD6FD6D30A1E24A0
SHA1:	088B37B55332BE23DBAA3104C8692472B703F5AA
SHA-256:	6A7A801CB285781DF7B9EA9CDAADC6E994BE64A007F3F5BEAE70C5630244C9B3
SHA-512:	6797F32255C682D70DD73A0895272A536FDCB1CB2ED3CA228D98764CB740938BF10DD5A1F77F7383B17BF157E8276BEAEE18B3857EEE6AC0E9A4DD8C07315C3A
Malicious:	false
Preview:	Search for HTD..print( #11,".");..trend(double( #11));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\CommandedROT(HTC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.887438802525302
Encrypted:	false
SSDEEP:	3:5NFDNl3fYovRQHFxiGUm2eov:TF7fYoJSPOmI
MD5:	6E0A62FADCDE084C5C231B29BB9148B0
SHA1:	410BBF6819B1EB36CED8E54E2835CF7407359E93
SHA-256:	EFA8E459F1AABE9F00550585A26248270BB02D441E71954F12700982932CCE4E
SHA-512:	371E8B470118593387DFD729AA957F9CC19C6653E2FC6DF1FF3558040A2B3EE872904AD7C664D020229E5C419726FBA2A8E83C840FE912B3B4DD75C2BC02F908
Malicious:	false
Preview:	Search for HTC..print( #10,"./min");..trend( double(#10) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\CommandedROT(HTD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.887438802525302
Encrypted:	false
SSDEEP:	3:5NFDBVXK3fYovRQHFxiGUm2eov:TFt9EfYoJSPOmI
MD5:	57131BE288E84CB6E85C9DCA8F6C8F6F
SHA1:	FF3F65AD631327FB8EC7A2D8A3CA175297CFDCEE
SHA-256:	808BE71E7ED8FD09AF579EEB6CC2DC673A2B45231D35A12D328A96EDE6AA2AD8
SHA-512:	7FC73495A68EFB145327CCE04011D0BFFB95D6E78D81EB32DEEE329F922FA9F7174A3955877F20E7AA2225F609F725A0C21873F89CE67F9D60F5858EFDBF9472
Malicious:	false
Preview:	Search for HTD..print( #10,"./min");..trend( double(#10) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\CommandedRudderDir(HTC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.8615919943530495
Encrypted:	false
SSDEEP:	3:5NFDPmX9IsYB3FFErVeym6X9IyYtFFEr+Ov/XKseZHBloFf:TF2WFEr8AWFEr+2BwPYf
MD5:	79A53710647B89D5B8174679E5E2679F
SHA1:	AC64024963491F4BD3B80FC060E9ADA5F468EC7D
SHA-256:	6E77AEFB77632577ED01AB7721B2BD8FB2587039A090D4D02BEFA739744DD7F4
SHA-512:	FAB41A23954DA08B436CF9EB83054E1D1D70E18A8F053EFBD9FB2E4D935B05CAC419F72CB8825302308A3870707A574AA62988C502054FB66FCAA3B5DB843A1F
Malicious:	false
Preview:	Search for HTC..if (strcmp(#4,"L")==0){.. print( "PS ");..}..if (strcmp(#4,"R")==0){.. print( "SB ");..}..print( #3,".");..trend(double( #3));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\CommandedRudderDir(HTD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.8615919943530495
Encrypted:	false
SSDEEP:	3:5NFDBM6X9IsYB3FFErVeym6X9IyYtFFEr+Ov/XKseZHBloFf:TFtMeWFEr8AWFEr+2BwPYf
MD5:	A6A4CB991493ED15D48C9CE6A0F10B67
SHA1:	7F8D950726530F907FFE81E01AB9C60FE574F774
SHA-256:	CF7FA1AC306199ECB6C1DE642FBAEAD1CC3ED258B7CAC5722D4D7EAB6B53B2D4
SHA-512:	2B5381FCDCF6539661972EDF0339523F1212AE6B93DB563B739E54272C6356E189F652FCBEE1EDDBB30451F4727C23D2D2366C3A96BDF28D671131BFF7B369D9
Malicious:	false
Preview:	Search for HTD..if (strcmp(#4,"L")==0){.. print( "PS ");..}..if (strcmp(#4,"R")==0){.. print( "SB ");..}..print( #3,".");..trend(double( #3));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Condition(ALA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6LM3vn:TFQAvn
MD5:	1BE0A0A531D7DFE5158294AE79787B4C
SHA1:	C3B62D3A7E7E4EF1BFB3EF9C8FFAF39DFBAC2A4D
SHA-256:	93AC6FCABB3A51A43E7AA35EAAAFDD100D5F97DD500A9932654DA5F1A59E1CD1
SHA-512:	2019EF2D01577DC022F0AF5D3A6976ACE733E55942DA4D63335E3246C5FA24B02AB9181B17C9F5C286DAE5ABBF29B32D0F02F6F04E6CFCA716A62A7300C3D70D
Malicious:	false
Preview:	Search for ALA..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Condition(ALR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDzLIK:TFvR
MD5:	67E58223622F809A8496E44223914DC6
SHA1:	DA1B7F9F8B0178FAFBA241563BAE5E6A061482A4
SHA-256:	C853FDAF85B683ED37C3A60298C7C483356180D093E245B9D48452161F9E2618
SHA-512:	63AA886068C43C8BB2E4B844412A4E737BA615D98B36C758B4CC5C045446AA72DF5D900DB7F8B4712843AD0874A0A83702924E251A225C2ED741909E4CF7C5DC
Malicious:	false
Preview:	Search for ALR..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Condition(FIR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlEK:TFLZ/
MD5:	1C51C7119311D3425C80700CE1D18BDA
SHA1:	7072B0900A02819C38BA39E27F3923CAC63E58C2
SHA-256:	E8F5EA64CFC59E0B3143C5F3C4F514299BCE8163A540438F3624EA489AAFB8B4
SHA-512:	599FFCDBDB9B70352D34AAF2727DBA98C35D09102C5ED364DE03B8EFBD3E95EEF97589B5F11B9F6F1F3387F10F68EBDD1ADD4BD3375B9CE7E5F2B54955F8E7BC
Malicious:	false
Preview:	Search for FIR..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Condition(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.780616778028722
Encrypted:	false
SSDEEP:	3:5NFDAxfwRWoOJgGm3FFErKW:TFPRugtFErd
MD5:	E0C43B0FA18D0BC53317216BC60D927C
SHA1:	2287EBC17021547317C4BC5AB4F573F32E57BD40
SHA-256:	F1C82A11640ED06A5FFDE403C274130AA9E079729BDCAB2694BDF39D4285EAC2
SHA-512:	09D1FCC202F9FF3A8012C7A3F3880BA981E986AAA694D4959AE7D19C4AA85D0ED9905AB67557A50D2D69949F718DE793C87ECC779C23D851DAE989C610B6DC07
Malicious:	false
Preview:	Search for WAT..if(strcmp(#2,"E")==0){.. print(#8);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ControlLocation(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	491
Entropy (8bit):	4.771286256793215
Encrypted:	false
SSDEEP:	12:TUwlvRcIlvNMFPsr+lvZlv8UllvgcglvoGB:IwVnVeF3VZV8cVg3VoE
MD5:	47A9F6A5D1F674228D239B0269DE4A1D
SHA1:	BFE2C3133336AA2FF10F11320A488EA9C638B131
SHA-256:	DB1932632DD0A3B4E95780E3F6DB263B06E7A3822B6CDE3302B9301DD1C5461A
SHA-512:	0F748002A5E1ED299F0A44CDB24B23D7BE23C8C84A67D0546D4911A599B9E05573E52F0C0A6CFDF6F2CEA8B1BEBF1474D8D0A9AA07EF9762DEA329FF7D0D54D0
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#8,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#8,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#8,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#8,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#8,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#8,"W") == 0){.. print( "WING");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ControlLocationAnswer(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.745088333690341
Encrypted:	false
SSDEEP:	6:TFUJVHqXlqJl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9II:TOElilXcIlWsr+lPDlqUllbglWE
MD5:	9693D534176220960AB34C9E62A6941F
SHA1:	6272D757BBFA0675CCAAD2BF5BC16D537FEF55BA
SHA-256:	3AABB0D684B14D6D68260BE831A8DD9F85E37E778FCA6FBF4861CE6E2DC3B539
SHA-512:	87F86D14C1BF4F492FADFC9F59A1858AF5080EBAC5799AFD9D666C3C5397BD40C116B09E0E30478B244670099A85126B8826AE19A2D79C3A0E515120C79F3023
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ControlLocationAnswerPS(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.75388313954079
Encrypted:	false
SSDEEP:	6:TFUJXHEEClqJl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9v:TmkEClilXcIlWsr+lPDlqUllbglWE
MD5:	167FF61C8E1B09020643C1BA7252168A
SHA1:	8E32854A92E08446A8AB56604ABD304A6010B8EA
SHA-256:	5E93F7C1BD6478AB869A90DCE8AC7AC7B2AC2A4088D0D0F3AD70C1CCB82681DA
SHA-512:	4F0B5CF116888D2D4DB6BF1CD17BA9C6109BDAED5076F4EF7596F38914AB656B298C008E6600CD55AA8AE2D045929263D9078967D81B4971EE44C995D77656F3
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ControlLocationAnswerSB(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.75388313954079
Encrypted:	false
SSDEEP:	6:TFUJLlqJl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9IFErf:TKlilXcIlWsr+lPDlqUllbglWE
MD5:	E9877D384E5C1168A88FCFADB74A8A18
SHA1:	61C138793961D8934DEB325A3CCF99D1A6F1D1F4
SHA-256:	F1CBB3C4FD45F8A19957164589DAF91F9F0FCD2C27648AA627D8083AD6A1E46B
SHA-512:	7B95E8BBF20E6CB8FA32243900A6AA3311AF7EE2847E6D1C209DAA71CD07F129892F31E017C41E4D6FE9DD4F5488DCF29AB4D201F7C5A9F61CE357DAB1CAB420
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ControlLocationOrder(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.737515256933273
Encrypted:	false
SSDEEP:	6:TFUJVHqXlqaCl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9v:TOElZClXcIlWsr+lPDlqUllbglWE
MD5:	322E4C0407390097FEBF059F6809EAE3
SHA1:	87FE7237D7FF62AD7B2611E48DCEEA8D48CE53CA
SHA-256:	5B9AD1CB6CE0B1FBCDF3E3C1E5C3BE3822828C59B35E51850C77C456A2B5D0CD
SHA-512:	32362C709C8A83F0C6282618C2FF0159FDCE18CB41C710D807A3DF0D367CC88C8597C3349A5B486A4E1E28D43BA6FFDF3866D0934611BEF85ABF873DF3964EF5
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ControlLocationOrderPS(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.746310062783722
Encrypted:	false
SSDEEP:	6:TFUJXHEEClqaCl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqglZ:TmkEClZClXcIlWsr+lPDlqUllbglWE
MD5:	AAE538FBCE996A0EAB3A79DC1BF9FA36
SHA1:	9CD79678D18800E0DB990081CE3F3A3E4D930AAB
SHA-256:	8D4C90E3A13725FF246AA9270E4B720E5460A2A05634060FBB617F8B29622F05
SHA-512:	E938C379FDE374D85886981E7D9FECAB898022004DFD5A9B810982F2A4DF259F2F42A9CC07D832B00E16155D23AAF69028B15C0AAA836C8474C2AB6D3A734D2A
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ControlLocationOrderSB(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.746310062783722
Encrypted:	false
SSDEEP:	6:TFUJLlqaCl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9IFED:TKlZClXcIlWsr+lPDlqUllbglWE
MD5:	4FFECE5AE2BAD9ADD442C1F4232F1C36
SHA1:	3E59F3BC38034C8B056F5361902CA1C0A0929589
SHA-256:	D84C627CA0F5AA8DBE39BEF5A94AC0C8D26DDF41D0ABBFCCBF6F40B3C9234872
SHA-512:	7F9D547D5CDDD889F4D2F8B1D4CA02F74A02A992786D0BB3870AE9AB47BA76889615F94D5946F9A956CDBA9034AE33C2CC25348CE26992F88ECFD1C7FFA4F492
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ControlLocationPS(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	491
Entropy (8bit):	4.780142703932923
Encrypted:	false
SSDEEP:	12:TUjClvRcIlvNMFPsr+lvZlv8UllvgcglvoGB:IjCVnVeF3VZV8cVg3VoE
MD5:	CCA80CBECF84E2C8448F5D368867801F
SHA1:	9751F21CE89CB35F2A58D12DF807415D7682F18C
SHA-256:	8EEF0B37F6C51D9A42C4B7F4AEF01C30D0E4B47EDE8851B19784BCFA8D38F479
SHA-512:	78A36DA62613DAC9E1222FC8EB648F6F8F38917B62EC17780084AB38A8EDB0892A80030DF82CEB51B837F45D123176B3F15128FFDE5C8D33DC0A60A7DEEB4CF6
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#8,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#8,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#8,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#8,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#8,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#8,"W") == 0){.. print( "WING");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ControlLocationSB(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	491
Entropy (8bit):	4.780142703932923
Encrypted:	false
SSDEEP:	12:TU5lvRcIlvNMFPsr+lvZlv8UllvgcglvoGB:I5VnVeF3VZV8cVg3VoE
MD5:	8280077248499F0E05406BAA44C5CD0F
SHA1:	914095E136CED4EC1C91C3AF5F007B838FA85E38
SHA-256:	82564D9EA5527D00E6750C65587B97C05EC72029A43C5299A3A7E60A10BB778A
SHA-512:	38C5001F6DDC75F63B848CF7A085AD6C4BF4B68CFCE21681E87E43DFA702782B8629C2685274F4D44081F971BA39B145685240328C431B62C38BDB143C3F06C7
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#8,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#8,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#8,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#8,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#8,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#8,"W") == 0){.. print( "WING");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Counter(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDnLNXMf:TF75XK
MD5:	1BBED2288D8ED9454C91FEA05A927F74
SHA1:	2D0F5E8C5CDD77262EC1329704BE1A9C83CF6FC1
SHA-256:	00BEAAC24643F8833944FFE1834426C42C32D3AB8BF4C412A462953E90205E2C
SHA-512:	33411672F40DB0E629E5DCCCACA62BD052096F8CC5D0D13208CF0D6A50EB4CD5173606750B3CD47AB3C776FAF46696FCF1A9DEB5CB64D175788EB4D30EAE9E0B
Malicious:	false
Preview:	Search for ALF..print(#12);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Date(RMC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	683
Entropy (8bit):	4.806107560072881
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloCpU4HOUMlo9pU4HOUMGtqUpU4HOUrf8Bloololc6GZ:Z925tjyCpU4HOUMy9pU4HOUMKpU4HOUk
MD5:	C6C3B1CD0CE352EA5AAFAFDCADB0C974
SHA1:	D9B2A07D1EAC50010702A2D51E54C7CFF7A85FEE
SHA-256:	12E2AEE43FAEC05966E6D05E70D468D87D2D8A2F9A1BDCBAFB5435C91F5535BF
SHA-512:	4240C4DEBEE30168454B685842FA208BE27D018B2AD603300B8FF2BEBAD8B8166124C949A28C92D73E447FD9D63541479970CC1312AA8B98E2C7715C7166C43B
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. print(substr(#10,0,1)," ",substr(#10,2,3)," ","20",substr(#10,4,5));.. return;..}..if (strcmp(#13,"D")==0){.. print(substr(#10,0,1)," ",substr(#10,2,3)," ","20",substr(#10,4,5));.. return;..}..print( "!");..print(substr(#10,0,1)," ",substr(#10,2,3)," ","20",substr(#10,4,5));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Datum(DTM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	359
Entropy (8bit):	4.761036585101526
Encrypted:	false
SSDEEP:	6:TFHy4WFEr8JlFyaFErFceoIlF21fOFErJlFkFErDAIlFtZVOFEr0GK3IGs:TpyhlFy3JlF21TlF3AIlF13KYGs
MD5:	11608BE88EBA262C9FEC529AA4B7955E
SHA1:	62BCFD7745351E75A2C49F51E1067EC6E3787926
SHA-256:	696D64267C5495F9ED1139A918922CF9F1E5B269FA7A638B5C3E38610DE0E734
SHA-512:	9D5ABC81D299A3C2F6AC3AC47E7B6AB6E80EA12BE47D8007F0146F3754178B756304113C294CFF76D69A135F26D44DBD553B40746C9391CC157828B327DB64C6
Malicious:	false
Preview:	Search for DTM..if (strcmp(#2,"W84")==0){.. print( "WGS84");.. return;..}..if (strcmp(#2,"W72")==0){.. print( "WGS72");.. return;..}..if (strcmp(#2,"S85")==0){.. print( "SGS85");.. return;..}..if (strcmp(#2,"P90")==0){.. print( "PE90");.. return;..}..if (strcmp(#2,"999")==0){.. print( "User defined");.. return;..}..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\DatumSubCode(DTM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDpLPMf:TFVK
MD5:	27A2908F51F89EA953C5B849632A95EF
SHA1:	58768D2F54E9F4ACF5BF6BBE57181806FC503824
SHA-256:	1516B976409E722E0FADB46DC88EAEBC27ADCC99D3909F8E25B67D2B84AFA96C
SHA-512:	F17D8E5C0AB122C975644DFE4A0BCBAA379C03A3B1E6036E6B2023A8D7268F356943C1A4FAA684BCED8AF5379A123CA8CA197C50D128DFC09A47F48403568BED
Malicious:	false
Preview:	Search for DTM..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Depth(DPT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.736801114695635
Encrypted:	false
SSDEEP:	3:5NFDMoN6RCRQHBloGXMfyn:TFwoxRSPgK
MD5:	CC45AB9654DA42B75AFD190F2F16E3CF
SHA1:	4C1BC4977EA2CABEBA5991FEA7164E4C3D1BECEE
SHA-256:	56CABE1B0F76EE5DE8465A0157EF927446D5A3D39C20BE824AD59040CF4C732C
SHA-512:	8A920FB65351D14BD1B3EC5AE27379BB97F04050354703368CD5546CD4876096A6C330F9C339B6FE05F2A7945316120EEC16B0029A7658E7AB857E3B72CC9491
Malicious:	false
Preview:	Search for DPT..print( #2,"M");..trend(double(#2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\DepthIntegrity(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.782551202337296
Encrypted:	false
SSDEEP:	6:TFJPDGNjXk1FmFErUd6lqNjBsBmFEra6lqNjDk1FmFErzzIlqNjJR3FErpKyGBkq:TPUjXkPuIlYjI3lYjDkPZElYjPSKyGeq
MD5:	8049B7C7FFC37DFCC65B25CF167A1283
SHA1:	41F07E754FA606761E5BCD49C7BDA9A60939C359
SHA-256:	E80F009AC8F3B85A93549E0E065BDC44C12F611C397D030F260A8FE6C6451111
SHA-512:	C77B800C8F453E73E4A5B92D72279B993CF5B01E62EDDEB89BBDE1B75E01EBEC43A474B642A35766EA5012A2036F2E03B4C7436501DA93CC315EBDCDFECC1FF7
Malicious:	false
Preview:	Search for NSR..if( strcmp(#10, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#10, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#10, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#10, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\DepthPlausibility(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.704716914248863
Encrypted:	false
SSDEEP:	6:TFJPDGNQDsFErvIlqNQTHE1AFErYhlqNQLHMi3FErpKyGBk/y:TPUQ/IlYQCqlYQgiSKyGeq
MD5:	B430A4A044F8E604F3D41A9752DD6F56
SHA1:	221A0036621A739D9636C831ED7561A6E8DBDDE7
SHA-256:	412090C03A7D4C60AF70264F11DC5DBD9A6ACBCD66B3DE81F79FEDA526F95A12
SHA-512:	FA82AD5023848037A127577BD5F999736307A82CEC5830BA53C117A4A9E70C39E29C5B846A37D6B5F46C4AB35B15949CEE6E079F47AB698B6906947B951149A7
Malicious:	false
Preview:	Search for NSR..if( strcmp(#11, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#11, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#11, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\DetectionPointCount(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.780616778028722
Encrypted:	false
SSDEEP:	3:5NFDAxfwRWoOJgGm3FFErFM3vFv:TFPRugtFErFAvV
MD5:	B8AEEDC64E02ABC88806B8C721D5100E
SHA1:	6C77EE37C03CE41E0F48542ADEC9C8F9A9348B6A
SHA-256:	C6EA968D3E40BF8880A990FF84285214155E5815D8A3D950912D16C9518D98B7
SHA-512:	C3ACC29CF676F4D4196E09102ABF181B131D55E369DDF6BCA507F66C0063D6B3FBF676F7E2F48DFD6BDBF536B379B684B59C6B97423DC9477E23E2CF87578233
Malicious:	false
Preview:	Search for WAT..if(strcmp(#2,"E")==0){.. print(#7);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\DetectionPointNumber(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.746718472943976
Encrypted:	false
SSDEEP:	3:5NFDAxfwRWoOJ2P3FFErFM3vFv:TFPRu2tFErFAvV
MD5:	6453618412AFEC72B6140D2FF66768D7
SHA1:	45FD618BB7826C8DC893ADA2910F0FFD987A358B
SHA-256:	B8EA611B2225D0D136364BFB52177136BC9C940E8CF0E5BBCB6ADE7418B22C18
SHA-512:	29A858050779F081EA75E855C172C08521336F480997B0E16154374060E2357FF6070E08062F17CBBA5B7650E2FDC38A5DFE377DD93A9E7B956151FF5D6F36E6
Malicious:	false
Preview:	Search for WAT..if(strcmp(#2,"S")==0){.. print(#7);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\DifferentialData(GGA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDWkov4NRJ96M3v:TFXogRJ96Mf
MD5:	045EE688293BF6CB3FE0556BA5771A06
SHA1:	38F7FDC92569B1374CED20ED30928B6873FCB0F3
SHA-256:	BC0A163B033E4F1671950E83960D4DA95D266E4272FF365A7F0E67E2E80C5050
SHA-512:	0159AEDDD9F6DF75B6CF5724FAE20B970772537064BF8CEB4420A72E17E2A7D2C17A6F77B6C948B62A184DF86CF058DED30FC9A915316D00C88367B0BC15E2BC
Malicious:	false
Preview:	Search for GGA..print(#14, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\DifferentialData(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDf2plNXMf:TFbYXK
MD5:	FA44FD4263F7940EBE4F3211508FF122
SHA1:	B13BE419944B0007863D9715766312B5C5A96DE8
SHA-256:	8FC2D817D80B52DF2BEFD99A88395011AF1418CFE5ACD960FB13A0000FEA0B41
SHA-512:	F5B7243112F9CCBE69E19C7C4E9736E80721FFB5AF087F7E704610D53ED0AB6613A0C32C57AF498ACF12DCB5EDACE1C39BDE6BE49BAE97A1F2220556DFCDA2F7
Malicious:	false
Preview:	Search for GNS..print(#12);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EngineTelegraphAnswer(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.7951281103782515
Encrypted:	false
SSDEEP:	12:TOElilw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:aE4bIEygGeygIVHiygBKeygaf3E
MD5:	527D676855A12CC6E7EE5714D3F74B87
SHA1:	BC04027E3272ADF8480B3EEFC8213C6EC0295362
SHA-256:	F0269D190C07B2F57FCFF71B661994B4BA27FBC2C6B1F1549F0D00CD7481731F
SHA-512:	3218FB546D52760C229465386F1C1A8F4F133211F47A7641C0851F026A12D8487A07CAE24EFA4B0266ECAEC37B4D9B90A161E6852A7B5735B8882D89027D9448
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EngineTelegraphAnswerPS(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.798632387108336
Encrypted:	false
SSDEEP:	12:TmkEClilw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:qkEC4bIEygGeygIVHiygBKeygaf3E
MD5:	193BF8E52C81F948BF9F89DBBA4CA37F
SHA1:	658947FDB7A2891CB60CAEC90D5D0790F5C1AE91
SHA-256:	4BD6727ED15F15DF866863EB413E88F48B0049A7C36FC95262E039E5FCBB018A
SHA-512:	C7F658B812DCE99463809ACDA6E26AB0E7ACD8B9F05A408C57D84C7536A25863A5492303132F1063AC3B011D7C6899E62B44E847DA82F322721585BBA00DA1EE
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EngineTelegraphAnswerSB(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.7967985228466175
Encrypted:	false
SSDEEP:	12:TKlilw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:m4bIEygGeygIVHiygBKeygaf3E
MD5:	ADEE5AC22C2DEE0C9F461F0792BBFEE8
SHA1:	D54E801EDA819DC81F378A7E06CCE52A27DAA2F7
SHA-256:	C908DFF94B61E02279A64711C3E9F510C9963325B3C84B02CA01F335A64317BF
SHA-512:	0C6CDF6413C2285D37BE003AAE5438091205F6BFC5D538715779975EBDFF8CE1BD1BF2FA341AF9C611D70FD046B3A3ABA0F8B37756EA4544AD91F04D343F3324
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EngineTelegraphOrder(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.796850212260854
Encrypted:	false
SSDEEP:	12:TOElZClw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:aESbIEygGeygIVHiygBKeygaf3E
MD5:	F2C4E9188E8C7054089831C22544E4C4
SHA1:	3F1C10BBD5A2C825EFB6F51A49C5D53068173897
SHA-256:	4E045B08D95396D619BDAE4B10F2981BA51D6DF80F9281552A600688293BE24E
SHA-512:	FF89F042C8D3F3AE4F818E2EA8EEC7DDD2DAD1CDDB62B06829BCDEF2000502147F7645E59BAFEE48AE5A21DF17E7E756EF4417261F919E8D75065287DE3C005E
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EngineTelegraphOrderPS(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.800354488990939
Encrypted:	false
SSDEEP:	12:TmkEClZClw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:qkECSbIEygGeygIVHiygBKeygaf3E
MD5:	F8FBC44969B2C7264E441F87F082A313
SHA1:	A75D8C644BA47D8DAFF3259F116C0C77ADB0F01F
SHA-256:	BD107D1C802600B57695A41732034B5EE49FA9A0FDC52C2F8523E4E2C8DDBE34
SHA-512:	D7AC08E24CB04C4E79370FD9F386AD7290FE0D76FA196481F71C117AE6669D5416E1CE23E6036BC55E31F00624DAA63EBD30CCFDEB2638ABC7F6D8080965961C
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EngineTelegraphOrderSB(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.79852062472922
Encrypted:	false
SSDEEP:	12:TKlZClw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:mSbIEygGeygIVHiygBKeygaf3E
MD5:	0CEF2FB0DD2BB0E0DFC458F23FC54CE4
SHA1:	3CCA4EA3DAF21991794CE6E82B6C3EDA13415A10
SHA-256:	9AF98741E55D0B3FF84588D02653AE1E503399D2F5247FAA18CB167C488B851E
SHA-512:	9951CD42FF12631CB9E8BADA5818A080ACEC091F39D49F3D518D1D4734BA5C2B4495AD6D69D89DA3D9826F593D97D9BAA32DEF4AF21A65A1D29D16E9BBE133C6
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EscalationCounter(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDnLNWfy:TF75qy
MD5:	AA14D734B267DFE193844B7AFD6502F8
SHA1:	6A95B180393B0CD11FA8BE69E60072E8AD279530
SHA-256:	F32CD188D81F8ABF6335AE8B3F40D3C76B49E1CE2159DC0D4C08AAF1D8CC3AC3
SHA-512:	37D4684113A3F5367D1105C09AE497D6AD0F7D8373E56751CD19B6166FC2B2606F1FF6FFD2F4C7B625910D3F8760F45EC5158D3C771BFB670BD3B8F37232B877
Malicious:	false
Preview:	Search for ALF..print(#13);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EventTime(ALA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.642282254934298
Encrypted:	false
SSDEEP:	3:5NFDgG6H2XUXmMJwQwUXVfHYQwUXoov:TF9UlwjUlfHYjUFv
MD5:	BDA918175C26FEE73E277324BC9F8242
SHA1:	74CED1AA141FC4D6767D215FAA077E38C4B1645C
SHA-256:	8A486C5AB541B1290F769D93E76F2A2629C87307AD4F6527EA7DD3CAA3F695F1
SHA-512:	B2B919935D772A1D74F88D27B4FAEC9E888FB7EFC872927F248AC31AD1CC2B739A02F9DB46CBC3E80E22D104C9F91328077FE2A16570F8955DCA27DCC2B23BD5
Malicious:	false
Preview:	Search for ALA..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EventTime(DOR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.663562559067146
Encrypted:	false
SSDEEP:	3:5NFDLoREWbaIHwQwUWZhJHfHYQwUWfAfov:TFFWbpHwjUWZhJHfHYjUWfdv
MD5:	FB346936BED36B64AC998EF2A53CD3D2
SHA1:	F2AFBA975680B5AA92B14FCA63E921A9123A49EA
SHA-256:	46F582A8DA456A2B6DE6361541224B71B30C686513B85B9CBF735B0F1AC457BE
SHA-512:	83B8A3381784D3D8C834AC1B773A4D85979C0C4CF771CF958D0D7C00FEE43A62E7F307DEA074FA4036C139445EB6F5715377B2FDE2D5EE4F6A6D3D8F71EDFCAA
Malicious:	false
Preview:	Search for DOR..print(substr(#3,0,1),":",substr(#3,2,3),":",substr(#3,4,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EventTime(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.638611091386151
Encrypted:	false
SSDEEP:	3:5NFDflH2XUXmMJwQwUXVfHYQwUX1L4QwUXE:TF7+UlwjUlfHYjUFL4jU0
MD5:	8B7FD1FC25DBC3B036B77ACF57B96AF6
SHA1:	018FDED4B112FFBFCF080D70242FCFF65F3E2B47
SHA-256:	98D7D8A197B486CAFB3920BF99C3EAE618086D00316603B67D6737C57CDD7BCA
SHA-512:	D557DB5F3015CF74079BDCFB7BC6C6DB7C9741C2C73100C5E734B4B0F3C98222248A6BA8D4465DD95C53A3FC2132054C1B3713F56FCA073D5B8B65B8A16D1DA9
Malicious:	false
Preview:	Search for ETL..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5),".",substr(#2,7,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\EventTime(FIR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.638611091386151
Encrypted:	false
SSDEEP:	3:5NFD3QMlH2XUWbaIHwQwUWZhJHfHYQwUWfFHL4QwUWcpf:TFLZ+UWbpHwjUWZhJHfHYjUWfFHL4jUH
MD5:	A8B236A3AE8973CDB1B60B9A29BEDEB6
SHA1:	5F06F670B06F65319ABBE9C98C38A9F1F5E39D97
SHA-256:	418422B73F1BD8F15F84A53E142DE2EFAB09235453CFC486C34680FDA570904F
SHA-512:	C607EA0446D78764DA4665EB3BC71774CA3534BDEA03DFB13199BC3FF698A8FC28E1C4E2065E5286D6E8A2DCE14E475C4C1DA415889BA881B35216A8B177D373
Malicious:	false
Preview:	Search for FIR..print( substr(#3,0,1),":",substr(#3,2,3),":",substr(#3,4,5),".",substr(#3,7,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\FillBit(VDM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqPXMlLM3vn:TFeXkAvn
MD5:	A05893BC7E9C7797C023A0C2EDE88576
SHA1:	551D3191056A71674089D35DB0244B6274AB26D6
SHA-256:	5584C4245BAEF23A62EB9D04B179E7A13A1F5F7581437ABF694028111CBF2669
SHA-512:	222F10223B13A80B621580FA5B321304B7580035A4A71148DF9BE59CAECC0F8A406C856F079839EA9DD2CC606DE3D3A03DAD972893D7020DEFAFDA8779F625D9
Malicious:	false
Preview:	Search for VDM..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\FillBit(VDO).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqcLM3vn:TF5Avn
MD5:	7CD218B684DB45B17EE11A6E0598DD7F
SHA1:	AF0396EA51591E53AAE819C879C047805F54D47F
SHA-256:	050AF8A13B3605276415B043AC80790A6663DF6C463D5FCAE073BEE3D579D117
SHA-512:	D25BA1095C4BD33B15641245272E89E41D298D437D4EEEED88B9BFCF4B2D86F75A8A70F4FED793484456573225620D25143327BBBA98F980006BA709F1C27723
Malicious:	false
Preview:	Search for VDO..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\FireDetectorNumber(FIR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.780616778028722
Encrypted:	false
SSDEEP:	3:5NFD38WoOJgGm3FFErFM3vFv:TFL8ugtFErFAvV
MD5:	2FF37557A174A3041F504F9333E25F9D
SHA1:	06AD34B44D76A3E21A48ADE6497B2329E99F7980
SHA-256:	D5193FC489C2D135A42890575D4B801283D054CB12B89FD2723C879F3A855498
SHA-512:	AC1DF089468DC847A37046B9058BC255D5D4A17EEF150AA3B8E363CFEACC308E026DD0D38BC617657C0E0DA8D2644652FDB92EE781882CBBA2DC26C5D2C5BFAD
Malicious:	false
Preview:	Search for FIR..if(strcmp(#2,"E")==0){.. print(#7);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\FirstBinaryIndex(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6OK:TFd8
MD5:	9A98221B75E04495B57FD940FB905F52
SHA1:	E16E96ED4EEF6073A2AC0CD55B90D374ECB04CBD
SHA-256:	481CC45BC31A6C2165623D338F0F0E8AAD5E8B35DC31F4D0D1A5D7BF831910A5
SHA-512:	BCDADD853FC22A76FB8D538A0390BFF0902E99FEA0F5C3242EE03D5D0E4DF984D57862D95CC7EFF0C4F3EE9C51346AD66FF5987CE75BAFEC74B58BE30DED7CEF
Malicious:	false
Preview:	Search for GEN..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\FirstDivision(DOR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLJMey:TFhfy
MD5:	2D20F88549C5829DEDE2C95CEB94A4BE
SHA1:	FA8D11388086B160207445CF25EBAD46F4147130
SHA-256:	5F9A8DCB5EEBD14C48114274DEEAC9B104562C834DF91F43D63DCB09F0C8DAC8
SHA-512:	97C36A220C29FAD2737D77539715EBD31719B6005814C1690C2C0C7D83BE7C703EEFFF823A354769F5171F68900DD82B7B35493F1E36579BF8C63325456436DB
Malicious:	false
Preview:	Search for DOR..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\FirstDivision(FIR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlJMey:TFLZXfy
MD5:	A663D17B1C29CF1172A35534BA35C61F
SHA1:	C1EF2DFE397146A26E41FD0E92075E67EC32856B
SHA-256:	57249D438D62E2EDC67DD0C2CF1965325D78001E9F98F5F335EF74CFCE60E3DF
SHA-512:	029078E235BA19882AA6CA8E5B27655EB8C3B2D4B5DE799306A84B8949898B9E5A7D156D1823DD8A90021B7E812EFBDA544A0705D15C0A1278A596E1F42F4BC5
Malicious:	false
Preview:	Search for FIR..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\FirstLocation(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRJMey:TFfcXfy
MD5:	E5104FE97581BEF75F2F57EF92B45E72
SHA1:	0614F5E5E1ED319462782F2C22833028F12777AC
SHA-256:	1CAD7906E681EA601DE2D981B44B094B478389624CFFBF052FCC4051CCF430FE
SHA-512:	ECF89F84DA248D9B4D5F01028CBEF82E3303FDF16519CD284ABC47EF5EE4CC8CA96EA4CE9809C5633E87DB138FB36A41786B58B3C2CC642517C79E9C0D9C7CF8
Malicious:	false
Preview:	Search for WAT..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Flag(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.5262170368431915
Encrypted:	false
SSDEEP:	3:5NFDFDGRzbWYY4FFErLM3o+3AfqRzKliaFFErLM3o+3AGXKgOLHfL:TF8FbWWFErLhlqFkFErLhGBk/L
MD5:	51ACECCC92F86A969A0D3176CC996C4F
SHA1:	564EE1D5D8F811321AAE70EE45F4B056D7F18142
SHA-256:	FCEC5EC3E0777F509D046E6D63990034F50B6CDCAFBD73CF7481114AAC6A512A
SHA-512:	A3EFC33ECAE71C983D0E607B61AD70E2FF7DD9D43B40520CB7564117C4AFB4F3FBBAC91556D8A3960A5EE45588432A04C873F67E485023FF5FB439350B896981
Malicious:	false
Preview:	Search for TRC..if( strcmp(#9, "R" )==0){.. print(#9);.. return;..}..if( strcmp(#9, "C" )==0){.. print(#9);.. return;..}..print("unknown");.. ..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\GeoidalSeparation(GGA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDWkov4NXJZv:TFXogXJR
MD5:	ADC7822BCB7DA6F130C18FE1D9457049
SHA1:	C4CE03E919564C5D36C1F5974CD2268C7C4DACFF
SHA-256:	6DF23B4D69BF9ED2131D96B5135EA8029D037C925F61988779AD7DE617EDBDD6
SHA-512:	3B978498329EC86AB9E9855A8998F152371F52F0048AC3D073C177E5D5D5BD804212324FB95BE0A0ADCD9D36BF29C4D54F9746556B206CA03E0B2E2A12BC7614
Malicious:	false
Preview:	Search for GGA..print(#12, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\GeoidalSeparation(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.51364592935837
Encrypted:	false
SSDEEP:	3:5NFDf2plNUkgv:TFbYe
MD5:	41AC3657E10721B2C08C463DE2B9FAC1
SHA1:	9C140F8D2119D55E52E7F34D7930476992C38146
SHA-256:	C35B2FA855C59579C853C589BCAB8EADADA0F3A3CB55262ADBA75D835638AC80
SHA-512:	EF8F1C4844ACCFB9D2D93C2329BA6924809CC819FEB9AF3FA521DAD080DE3648FD39ADA90389041B481D60823B03338D8BDA84507E4C60C3B2F7EC58491D8289
Malicious:	false
Preview:	Search for GNS..print(#11, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\HDOP(GGA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.513794876803092
Encrypted:	false
SSDEEP:	3:5NFDWkov4FJqs3v:TFXooJdf
MD5:	455D0135D897C5650D699A71E6878DC9
SHA1:	E1EC5F4FE50F050733AE47E07E6E351359757229
SHA-256:	38FFAFD8AC7D4AC6F64060BFBA8B73EFC1A0CCDDA41B0E844A85F9870D144EF6
SHA-512:	F416C8573112A36278BDE6BC9F958E84F624D8FB65FAF084C5FFB7DD3A30207AB0065DC97184A09963F23CED50B08C0DF3579881E6C4D0D74B2DC3451617B2FF
Malicious:	false
Preview:	Search for GGA..print(#9, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\HDOP(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.513794876803092
Encrypted:	false
SSDEEP:	3:5NFDf2plFJqs3v:TFbQJdf
MD5:	4D0EF61907E761F6F31306E0D4F1869C
SHA1:	4E30EF303B5FE6DD1E1DEEA64F0984CA60036FD2
SHA-256:	0721DDB5FB79CDEE797F937623AB2CC5244443394EEBD6313D98F4A75302EB6F
SHA-512:	ADA0859F196FF6761A09DD618FF7524DD5047760ED6B79C1C00F1401349C74BED8C2B658A1A5A6760E4CE618E3D341187798DAE94AAD53ED32A7752A76F24F1D
Malicious:	false
Preview:	Search for GNS..print(#9, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\HeadingIntegrity(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.770310755768087
Encrypted:	false
SSDEEP:	6:TFJPDGyVk1FmFErUd6lqyDsBmFEra6lqyBk1FmFErzzIlqyLR3FErpKyGBk/y:TPpkPuIlG3lRkPZEltSKyGeq
MD5:	4D390F3AFAF20423C562CA6ECC426AA7
SHA1:	874995D14DE9CF15996F8C923B4095B9D64BC63D
SHA-256:	818BF5E9EF0D4C3A23C05EFDCE4C8B1A47A9C72B9ECF77FAEBF849402ABD3C41
SHA-512:	766E80C0BADC51C359D92748EE636C0A388E34DAC3D69B40C74CE209A4CD4BE1B7115779DDA63557BB07AC4749816AC82B366291B011EA40B1DCEE2379380B56
Malicious:	false
Preview:	Search for NSR..if( strcmp(#2, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#2, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#2, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#2, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\HeadingMagn(HDG).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFDBlsfZHBloFifn:TFiPYif
MD5:	1CD30B0EA309136ED8775947F136352A
SHA1:	1080CF9335DBC22409406EAC6DB1CCCFEB63DEDB
SHA-256:	1867198A606B9FF3081E6BD98E60023F878157E220119092E529DD9134C3B831
SHA-512:	695CC1513A982DC44D3ABAB76175D6435487886B1DBD482650D9F9747364366ABB3E5DA2C15374F9336A90723386317500D310912118D8E6628761F0149A5CC4
Malicious:	false
Preview:	Search for HDG..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\HeadingPlausibility(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.691435688769648
Encrypted:	false
SSDEEP:	6:TFJPDGPnsFErvIlqPfk1AFErYhlqPHsi3FErpKyGBk/y:TPOIlJqlBiSKyGeq
MD5:	4E78BB7594763C54A3B66442930229A7
SHA1:	D06049A799E7117A8FFE20F4735E056208041AFF
SHA-256:	D71DC6C724AE232903F3ED16FF66007A8109F7C1CD23C4CE712997F3F1E132C1
SHA-512:	D766EC7A3BC645BF8EB616C15F3DEAD95574A82A2F664EDDD6A3A2918C1709DDC4ABED9D87EF0A9CFB3BFFB3C49571205759220BD1C8D926AFB8673016F224ED
Malicious:	false
Preview:	Search for NSR..if( strcmp(#3, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#3, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#3, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\HeadingTrue(HDT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFDB9KRsfZHBloFifn:TFN9lPYif
MD5:	3EFFBACDD60F7332FEB020A732349A0B
SHA1:	83D8E79196137D49BF2CAC30EF6946879EF293FA
SHA-256:	3E46C33790B6702B23DFA43946A7A571D30DB08C559F4C879750BB085E6FE3EE
SHA-512:	D9BE39A0CC32BF77158462C40888F1B557E793B465F2BEF4C172FD56B156B17F665BC48529D7726BCB4BF13D330A6E806DD2409B8EBBB72CFDCDA7E492442848
Malicious:	false
Preview:	Search for HDT..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\HeadingTrue(THS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.666462569330563
Encrypted:	false
SSDEEP:	6:TFqV9HNFErV2g/IGtHUK2e3FErgW+6lqQFEro+lqGFEr2UF6GRPOy:TA3y2ggGtD8Bl8lpc6GZ
MD5:	DA22728E3D1D46EA91514300438D559A
SHA1:	B5C864132F6AE32F3F934874712DF15CE7E099D6
SHA-256:	289DE3F2A076FA65F1431BA82A0E91EBD61720AE9B1FD5C4290ECFE6F152E07E
SHA-512:	D479C56A46CDF62AEF1A5665F2C45F6A1219216CD533C8ABBB3EF792CAB7DBA5318391C49B44F2B79EACFDC9E8FF52A8449B0D3DB1C19815DBDEBA92564C8401
Malicious:	false
Preview:	Search for THS..if (strcmp(#3,"V")==0){.. print( "Data invalid");.. return;..}..print(#2, ".");..if (strcmp(#3,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#3,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#3,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Identifer(ACM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulIK:TFf
MD5:	ED9557BB7966F9C4CA1E0A1BB2F0A44F
SHA1:	01FDB7930D12E01EDAFBCFE3A3FDA2A5DC72EF2C
SHA-256:	BFCB8B66EC3CC42A684D2D19E343A8FFADE3BB76D4D409B1A4AC560EB9EFDE2B
SHA-512:	3CC9E376BFA328EB75369F30A157F49179EE82E06A0049E15EE40AF09EE5230DE732D8B549C2F685F1CFF4E8C0DB4C826C058EA5B1ACF907B1D49FC214BFB9A4
Malicious:	false
Preview:	Search for ACM..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Identifer(ACN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6IK:TFNa
MD5:	7C8BB037A13C27C2676A8B98A43C5992
SHA1:	2BA118514051A83ED81A155E4308F147737832DB
SHA-256:	488C7638851251026522A1178C9E6449B243AEF5FD00A710031CA80154F65587
SHA-512:	0F99A4FDAF50B755FBE73C22CE991CF0EA00B512747F970A96FCEF8A7FAF44CBB395C2FC6546BC815DEE95E3754731C38FC5A1C8D3C83212756025ABAC2A3879
Malicious:	false
Preview:	Search for ACN..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Identifier(HBT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD9XKRIK:TFZK
MD5:	CC69E07B345FEA80CF67553AD5E160C2
SHA1:	797039A1055B15A6E483EFC832D18974E2378869
SHA-256:	3EA60E7DD7F3EB02B465E20A045625C2A5758AD5714A833899E4F6CC9E05C188
SHA-512:	03E3113629C4D83A7BA3BA8C8A5D302A8594380466A80039ED1096B5C8EA5A254CBB9871F6F3D78ACBDB5DC403404A8D1B5D7FF08058C9D0D1CD842F3B6F1549
Malicious:	false
Preview:	Search for HBT..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Instance(ACM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulJMey:TF7fy
MD5:	0E8FC319562A6CB26EFAD5578BFE306A
SHA1:	BBF84B058CD3492BE004758E8D6DE312666F6A05
SHA-256:	DFA855D64D2351148C39D661B0D3D039E9088E9B888A080DF616A5AA064D3FAA
SHA-512:	F16BC4699D80D44125545FBA4AEE10BA92A7568C7997C1D2003FE7E8D33F8FDBAA63693EA7142FB0EFD97E1E6ECD975D16DED8B416D40DC3836509276E408388
Malicious:	false
Preview:	Search for ACM..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Instance(ACN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6JMey:TFNWfy
MD5:	9E5ECD43941F88F92A142DB5628D84DE
SHA1:	19C65CC84050AC1A11C37C8DF1DDE5B86E9E747F
SHA-256:	7CCB217CD6CF840A4E3651CA14A6393C0719233E3A074933C307EEB2EDA3EEA0
SHA-512:	23BA3547A10AF3E51D841D923E52D6ABAFD4290B8CC0564ED95263142C0DEF9DB3A38223D43D4EEE3A42ED9CC7EC9EAA7F09C4E970CD267CBA6A44EC9C172F47
Malicious:	false
Preview:	Search for ACN..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Instance(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDnLNUAv:TF75J
MD5:	7E4879C3AA70E0D00C5047CA8BF34B8E
SHA1:	93F273EB08973D3853E33EECF1EACE58BF5B9728
SHA-256:	4DDD4CE4DF30E8435674B5133721BD641789A35FEE3724DC6B6DA2830581E945
SHA-512:	DFD7C80F71C6BDAEDBA8539AEBB8B5E74D566C0F44A7E27952C8030F26477EDEC4B5BD7577439C9ABE325B4249138475F95BBEEA0FCB71D785A8E90CB9A3DE2F
Malicious:	false
Preview:	Search for ALF..print(#11);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\InstanceNumber(ALA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6JMey:TFSfy
MD5:	B038662C5BB55C5264D07363EA7D704F
SHA1:	09E82DEEAC2AB2BAE4B98716B8BDA5C307CF5A39
SHA-256:	1F87F61EE2A1613EFF7F9E69CA37847B8BBB882BEEC5F76FE076613E4D35BD07
SHA-512:	3CEAA2A39688FC0A74A053F992CFE50CAE645B86325F72BEE26C4F179DE2D930E64C7B97BEDE1AD97B686FF2BB600799A9F9C41840132E82E8D126360FAB9A53
Malicious:	false
Preview:	Search for ALA..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Interval(HBT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD9XKROK:TFZs
MD5:	C03D8C934E2F06F3BFB88E7C5F69644C
SHA1:	295C8595C19DDA731186D8C25F4524793EB930F5
SHA-256:	29CFA759D3BB168B4C159465C380D5345EABBAC22ABD93CF56A424F477E931EC
SHA-512:	970371F9FD66CDADF79771A92F10DA5C3E1ABA904DE82B1115B951E8B36B1DF159EDDC4CD54D0C532460F71D08B918AD6FDB156873EC4A3CFB8EC825B4D281FC
Malicious:	false
Preview:	Search for HBT..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Last Change(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLJMey:TF79fy
MD5:	F8E47A12FDAFD813A4C474559DEFB2BB
SHA1:	9EEAF0625C7CECC62672D016C68591416B57949D
SHA-256:	D90C6DAE455B2A8EDE5F43328086EC99C823FE19FFCF7924AA7FEBCF7FC1EE16
SHA-512:	1732881E68E7B76A15B479CDF8AD46271C93F19D2ABF90DF41256A7B2A28F8FCC2711134BCF6F1B6133AFE2398ED0D1D7CCAE3627768C2131E98CD47760FF72D
Malicious:	false
Preview:	Search for ALF..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\LatOffset(DTM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.7040511288482865
Encrypted:	false
SSDEEP:	3:5NFDpL5FT93vRQHFxiFDy:TFLFFJSPmW
MD5:	F66A022F2F14FF2894733169A4D04BF2
SHA1:	91DDAED0BAA309CB78DE3F541A5E2D950B8B4A08
SHA-256:	0E67203156C7BB28BC4E13003CACC6DD336B942AB20F3D013C8106C158EC820D
SHA-512:	91896D5324DF2412BA6931341EFC612E97F39CBEA2A5FF78372BBD09EE88F64DB1D053C8C0627E5F2A7B1757B899DA5BD5C04FB3C270BDE5AE67B4163225F66A
Malicious:	false
Preview:	Search for DTM..print( #5," ",#4, "min");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Latitude(GGA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1408
Entropy (8bit):	5.038433372570456
Encrypted:	false
SSDEEP:	24:cS2RXjUWN+WVhNh2jUWN+WVhERjUWN+WVh++2jUWN+WVhpmLjUWN+WVhaC0mjUWv:crdjU5oL2jU5oUjU5o6jU5ocjU5oaC0O
MD5:	F0C6309B8F09C6AABC18A3C35C04A3B0
SHA1:	49ADB95902B14885E3C9E2415433BCA330D6A73B
SHA-256:	760715AAF73C02921CCF96EED146FAB312A0CB724B75D875B7F5172AA34CEEB1
SHA-512:	DC80D06AE980D9B5A498A95CEA8EEA9AF8717EB34A6754DD46E4294DC281975CB4BAD845A3D075CEDE437EC3FFCE47D7A307AE96457BEF40E76B0F15CB817476
Malicious:	false
Preview:	Search for GGA..if (strcmp(#7,"0")==0){.. print( "Data invalid");...return;..}..//if #7 = "1" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"1")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "2" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"2")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "3" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"3")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "4" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"4")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..} ..//if #7 = "5" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"5")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Latitude(GLL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.087745028346076
Encrypted:	false
SSDEEP:	6:TFZ4RJYlFErQWY2Y8sHFLesQvWJAUln9VbMWylK4Pmif:TvsmFLes6WJAUdYrl1m0
MD5:	546A3559488C8BD7648DEFC94F917932
SHA1:	CDEEA1642425F1989406D24F953DE723F03D774D
SHA-256:	B478FA523D717F723BD4570E296457AC89AB536D01354E36A51FAF0730DFBACE
SHA-512:	A39F2EC78942CAF6C45A7006A17C63A855E0D44E60829C8E68C33C51F79BD0699513C56C5A9866F994EC88F0B74EC595729C9EF76E0800D5E125B2B0C055282A
Malicious:	false
Preview:	Search for GLL..if (strcmp(#7,"A")!=0){.. print( "GPS failed");.. return;..}..//Print #3 " " #2 1:2 "." #2 3:6 F00.000..print( #3," ",substr(#2,0,1),".",fmt("%5.3f",double(substr(#2,2,7))));..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Latitude(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.060161669319466
Encrypted:	false
SSDEEP:	24:Zu2ssnjUWN+WVh7OjUWN+WVh3KjUWN+WVhtMjUWN+WVhxwjUWN+WVhaC0mjUWN+X:JdjU5oqjU5o6jU5oejU5o2jU5oaC0mj2
MD5:	CAE67BACB192EA2B30B99817F27C6CD3
SHA1:	7E2CEBC95F5C4C97B9771C59984B89C614E5452C
SHA-256:	DB9ED45668236293B7158AA0FA701240A083789C38F2DC4D1DE4346E82221882
SHA-512:	9BB1B520E1437A59FE1FDBFFB1EA717BC604E9CB633883436067180BF1A50F0CF1D8A27EB179A50BC087BE6F9B31BF5F3EEA6B1C3027D97D4A8D13942F9B9C44
Malicious:	false
Preview:	Search for GNS..if (strcmp(#7,"N")==0){.. print( "Data invalid");...return;..}..//if #7 = "A" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"A")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "D" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"D")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "P" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"P")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "R" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"R")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "F" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"F")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. retur

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Latitude(RMC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	692
Entropy (8bit):	4.958200302568717
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloIFiU3YrPDhloZFiU3YrPDhGtq6FiU3YrPD4f8Bloololc6GZ:Z925tjyxUu7hy+Uu7hpUu740Byoylc6i
MD5:	C74E39B4F2A8EC56E195BC72444C3905
SHA1:	BDE6FCB3B9A5B93C36F0CBD036A92623AE955E81
SHA-256:	93D36316EC95210B2DC1F942CA9CBDF77BC6B283B51ECF7C9835A835050E8FF2
SHA-512:	93CB4BE9396A8524AACC192BCA45E615E08303DC7BBD350611D051A583DFA5C97B07E7C4FD17AD94794062C72EB6E1C4287E8E0A12C719E870BE29EDF825D607
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. print( #5," ",substr(#4,0,1),".",fmt("%5.3f",double(substr(#4,2,7))));.. return;..}..if (strcmp(#13,"D")==0){.. print( #5," ",substr(#4,0,1),".",fmt("%5.3f",double(substr(#4,2,7))));.. return;..}..print( "!");..print( #5," ",substr(#4,0,1),".",fmt("%5.3f",double(substr(#4,2,7))));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\LocalTimeZone(ZDA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.59445640611102
Encrypted:	false
SSDEEP:	3:5NFDmkplSR3y:TFupy
MD5:	D658C8FB3A97174BB9C31122DCD8FCA7
SHA1:	090525535062538656775110C2DDACA2D03E0723
SHA-256:	7F3F1464B96675B1DB3EFACE0457462EA5E46C6501B6EC5DD7F5D9963992D3B3
SHA-512:	1F74CD3D3601D7846D8182F399C8926FBDBF174D103C05976887D39B0FD08CF4B1CD651404909B3AABF854EF5A2EB19501A6047C470813A235D1232344DE3A63
Malicious:	false
Preview:	Search for ZDA..print( #6,":",#7 );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Location(ROR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.323161167392161
Encrypted:	false
SSDEEP:	3:5NFD1W6Rv:TFJN
MD5:	7D76484CB9ABD382DF414D9C975AAE4A
SHA1:	FD8EC1320FDD32B45BC18517DF680CD72A44BBA6
SHA-256:	BFEF15238F02F2C6A9B41E5AD2D7D58824E622B2D1B4BBFFC341C7EC6FC44ACA
SHA-512:	64CD59CA52E363912B82D4B290E0E9D9688F1641FDCD35405F8F51F7819DFDD630BCC752F74619A804C7FDF53F36515C88EA5AFC0A350526F6EB3618395F22C8
Malicious:	false
Preview:	Search for ROR..print( #6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\LonOffset(DTM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.7040511288482865
Encrypted:	false
SSDEEP:	3:5NFDpLYG3vRQHFxiFWv:TF+mJSPmo
MD5:	A88ADBA379C4C840CF16D7F88FEBF317
SHA1:	388496120BFF200E40A4D62613BDA72D583E8C94
SHA-256:	86E247ECB9D4469BF17208FD80647E0B5E7475D6833110458E17379A7C4ABC13
SHA-512:	E85E030A4E28F65CEF08F88AE524B697ABA657799C77C1FBC7144132674AACB4A4CAC222D8DE8E3561EDC6763A67E63A36F3E63CE60171E3C77BE7515C1BFF2F
Malicious:	false
Preview:	Search for DTM..print( #7," ",#6, "min");..trend( double( #6));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Longitude(GGA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	5.044294068122479
Encrypted:	false
SSDEEP:	24:cS24X8UsihUXm2UsihxX2Usih+TX/UsihfXAUsihfXsGUsiZxe3TBsoRc6i:cr4X8UsihUXm2UsihxX2UsihSX/UsihQ
MD5:	57E9FA9E28F39969316E1EC751353C10
SHA1:	A5967B1F2660309061C61231C6BE5548755B6C89
SHA-256:	835706390F3CB5465C2037FBE276A3587B11D9F852118A32925BBE1D2E6D0D92
SHA-512:	9E859AF9F4F9E43DB66DC10C9EC3594E47C2538D411AC07BDF8FEAAA51B36D749E9690D21E1EC79EAED5E5C7BD9271057AD2C6C15911DDE4BC683BF59412E3AD
Malicious:	false
Preview:	Search for GGA..if (strcmp(#7,"0")==0){.. print( "Data invalid");...return;..}..//if #7 = "1" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"1")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "2" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"2")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "3" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"3")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "4" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"4")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "5" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"5")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. retu

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Longitude(GLL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.099125025909878
Encrypted:	false
SSDEEP:	6:TFZ4RJYlFErQWY2Y8S6AKFUFiUNaVVbMWymwK4Pms:TvsS61FUFiU8Yrd1ms
MD5:	EBD87D58F7D0A0DFE57DEEA4C8202964
SHA1:	8A9A2835CD9F828BBDB9EED2A3F0C5A7697E8981
SHA-256:	16E9BAB5D0137FABEDD3992A69EF48103D9CE6264478D058031CB227A17DD1B8
SHA-512:	7B576629A126E635E4A916B7D25BB451761C0138A51A83ECB8689005865B50CD3514B40838D119422CF1A41880AADFFA0C281D99520AA4863C2EE89C69DE9D77
Malicious:	false
Preview:	Search for GLL..if (strcmp(#7,"A")!=0){.. print( "GPS failed");.. return;..}..//Print #5 " " #4 1:3 "." #4 4:6 F00.000 ..print( #5," ",substr(#4,0,2),".",fmt("%5.3f",double(substr(#4,3,8))));..trend( double( #4) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Longitude(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1347
Entropy (8bit):	5.029132232087029
Encrypted:	false
SSDEEP:	24:Zu2s5XyUsihiXVUsihuXrUsih0XXUsihYXBUsihfXsGUsiMBCPc6n:JoXyUsihiXVUsihuXrUsih0XXUsihYXf
MD5:	A9172424F6D4242F2E4642E0E11CEDF7
SHA1:	7EF2C9558E42B620B641AF6FE4C11A377820FBBA
SHA-256:	6C8C79B2F3D96DCBF1BF3DA1FA60F8DA8069B6FF7978D1885679A3BE6AB560EA
SHA-512:	0AF1CE0F2BEAE090E38C0D87D3281EE2C1AE30E8768CEFB61AE0BC3AFADD5AFC04AD324CA81FC300F1A43343AD82431AF4AD6CE447B4C9D77C025E0B832B3B5B
Malicious:	false
Preview:	Search for GNS..if (strcmp(#7,"N")==0){.. print( "Data invalid");...return;..}..//if #7 = "A" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif..if (strcmp(#7,"A")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "D" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif..if (strcmp(#7,"D")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "P" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"P")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "R" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif..if (strcmp(#7,"R")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "F" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"F")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Longitude(RMC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	761
Entropy (8bit):	4.995326481306636
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloTUKpYrAeOUlolUKpYrAeOUGtqZUKpYrAe1jf8Bloololc6GZ:Z925tjyTUKUvbylUKUvbLUKUvF0Byoyk
MD5:	228C694325AB9DE579D0CDF03188493C
SHA1:	78BB3BFF585B4618441EC458E2F13A47FDCB537B
SHA-256:	931ABACD29450C3C7C82E57D3561CDD21F0F4762CC59D7E2216C52DBB307FC6B
SHA-512:	1D951B04137FBBF6BD6B98A0066D56FE6EF5DD23D667E69ED137429D8F321B917CE2F699DA95B86D07DC35BAE9F7CE3F1DE595DB44F54A8B870B2426F829B69F
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. print( #7," ",substr(#6,0,2),".",fmt("%5.3f",double(substr(#6,3,8))));...trend( double(#6) );.. return;..}..if (strcmp(#13,"D")==0){.. .print( #7," ",substr(#6,0,2),".",fmt("%5.3f",double(substr(#6,3,8))));...trend( double(#6) );.. return;..}..print( "!");..print( #7," ",substr(#6,0,2),".",fmt("%5.3f",double(substr(#6,3,8))));..trend( double(#6) );..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MagneticDeviation(HDG).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.4968985554505645
Encrypted:	false
SSDEEP:	3:5NFDBl89Yeyn:TFgyn
MD5:	F602950FE072F1CBF8A5AE02B3DB0A2E
SHA1:	5A062BE2DAD4AFC2B40F5CC3DDA58AC24E707529
SHA-256:	BF4EB8D280C7BA0359E177D842CC0A7F60E5C72C183C4A50BAE078AFDE6988F5
SHA-512:	AE8822F491AD5530F32D08D56E55E78E2BDD4B31227B80399D0855B9C50B81313406C35ED504211105D6A555C7BD8FFCEFDF3CFD87A18883823B90414AB1C0E7
Malicious:	false
Preview:	Search for HDG..print( #4, " ",#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MagneticVariation(HDG).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.45148902643068
Encrypted:	false
SSDEEP:	3:5NFDBlQlw3v:TFgl8v
MD5:	045D7D9A42FD731DBBCD9B80D243597C
SHA1:	CD8F08F8AEB6895990F8F215802598A18B843AC5
SHA-256:	ABED1A53898E81035E095B31F7B219CAE2C396DAF3426A68F46EFCCD78EDEE26
SHA-512:	0D0348129259272924785D3BA72D19F6CF07DE3C4A3FAF5C7EAB81649F1E16E44D8C9D054A4582274690246C6231985DF8B949E121659077C037761DFD2CC49C
Malicious:	false
Preview:	Search for HDG..print( #6, " ", #5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MagneticVariation(RMC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.446439344671014
Encrypted:	false
SSDEEP:	3:5NFD3fN63FpuMey:TFL12FVey
MD5:	2BB372B7E8492E7FEAAC268ADA2AD868
SHA1:	69FC162A1056F8DB0AFE36B0C180121928D4D3E7
SHA-256:	A98D3BD218DAC4F7CA1513AF80DA5ADFD3DAA0C63154F7A2043F4B089B87EDF8
SHA-512:	E489CC09534F55B16F151B697CC90C1CEFDC37ED96FCEB7DF46AC1D6B8B8F8ABCDBB0795DB2AB92C4A1B8A9487150BBE7A768BEE60B711DABF306FBA3E451038
Malicious:	false
Preview:	Search for RMC..print( #12, " ", #11);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MeasurementData(XDR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	4.621895151006009
Encrypted:	false
SSDEEP:	24:3sYdYe20p8zBAtNnZNGYT4X6Hvny+QWrnflnquBcC1lBV:35i1MznBd/BV
MD5:	7CB9E0DEC493FB5079E3FB46E808434E
SHA1:	5DAB211100CA075D364DC8C2583374AD1C8EADDE
SHA-256:	DF5EEE715527B64D28220AECE5B8466EE06CD2079681E0F7C5890F19D5A7C626
SHA-512:	1AD27AD80ECE736D2856A45268366146A52507CE2D75260DE68280C40A06DD6313B5EDE8E0287716D5038986DEBC11575B3E9435EA2F547869E264F0EAC12610
Malicious:	false
Preview:	Search for XDR..if( strcmp(#2,"C")==0){.. if( strcmp(#4,"C")==0){...print(#3,".C");.. return;.. }..}..if( strcmp(#2,"A")==0){.. if( strcmp(#4,"D")==0){...print(#3,".");.. return;.. }..}..if( strcmp(#2,"B")==0){.. if( strcmp(#4,"K")==0){...print(#3,"kg/m3");.. return;.. }..}..if( strcmp(#2,"D")==0){.. if( strcmp(#4,"M")==0){...print(#3,"m");.. return;.. }..}..if( strcmp(#2,"F")==0){.. if( strcmp(#4,"H")==0){...print(#3,"Hz");.. return;.. }..}..if( strcmp(#2,"L")==0){.. if( strcmp(#4,"S")==0){...print(#3,"ppt");.. return;.. }..}..if( strcmp(#2,"N")==0){.. if( strcmp(#4,"N")==0){...print(#3,"N");.. return;.. }..}..if( strcmp(#2,"P")==0){.. if( strcmp(#4,"P")==0){...print(#3,"Pa");.. return;.. }..}..if( strcmp(#2,"R")==0){.. if( strcmp(#4,"I")==0){...print(#3,"l/s");.. return;.. }..}..if( strcmp(#2,"T")==0){.. if( strcmp(#4,"H")==0){...print(#3,"rpm");.. return;.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MeasurementData1(XDR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDz4PMf:TFHqK
MD5:	D0E0AD37929DCCB878628533F0B3B540
SHA1:	C43241D4ABD8DF413F30B7773452557C9E5F6192
SHA-256:	CF2E6F978624642C121F5F95B5A2E180C0E3A06B74D9010316A9817B3C76CCCC
SHA-512:	5605176FA7EF9B939444C1629E9DED71AF3471DD959415A681D6F8F6FCCD0B0631E9356738DC7CED3A12E20C5784AD94CFB313E47F61849D8DDCEA57B7A29C5E
Malicious:	false
Preview:	Search for XDR..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MeasurementPointID(HSS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.807888696044131
Encrypted:	false
SSDEEP:	3:5NFD3vMkWoI8FB3HFFErCEWEBI+3AGXKOK:TF7/1lFErCEWEBIGs
MD5:	21FD97C54ED97789301D038FDB6F4316
SHA1:	8CE9D0B80915F920407EE8B70288A472B8D058EF
SHA-256:	84FA9A77788254A6D3A827AD177BA2688A6CC76ED50349E116F96095ABDDCE28
SHA-512:	C2149F0B686E4A7D36A28902D9B559E19245E99645C5A306DD933F640892FBE5095EB030B4755497B595A4ABD6418918C5DFFFF8DDB0642036A54A7A2C1BFD6E
Malicious:	false
Preview:	Search for HSS..if(strcmp(#4,"A")!=0){.. print("Data Invalid");.. return;..}..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MeasurementValue(HSS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.807888696044131
Encrypted:	false
SSDEEP:	3:5NFD3vMkWoI8FB3HFFErCEWEBI+3AGXKPMf:TF7/1lFErCEWEBIGgK
MD5:	95B2A60CBA859364E20C9BD9E1CC6914
SHA1:	BA6467C3EBCC82D6EE702B05C490F37504679319
SHA-256:	76AACBA2B593DA1AC10A10D1326E8FDD074515027617BE3CB0527012562545E8
SHA-512:	51FDB70D5253CB037B48AA0F58B2433BBF0C90BEB9482E78BB243BEFB48BEE6EF07ECC0EA238A92A49713027D0D0DC83D4440A400B0549047C483C9190EBFBC2
Malicious:	false
Preview:	Search for HSS..if(strcmp(#4,"A")!=0){.. print("Data Invalid");.. return;..}..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MessageType(DOR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLOK:TFT
MD5:	540D6DC826FB7E96A7FCF4DC424A4585
SHA1:	D65FD3E4773304CD60090FE505888DD7C9542025
SHA-256:	2822BA1F63E0BEF6423B212BCBB37A96AB9DC3ED930098F0B0BA47097F3F5CC5
SHA-512:	162D4EC7DB96501A1BD7B898BA588389F7F0A83A3563AB93F335719EC79823385A19BDB52AC20F34640E42E54413E57E3A31435FF548691D42AB7B1FF7CE1EF3
Malicious:	false
Preview:	Search for DOR..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MessageType(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDflPMf:TF7RK
MD5:	9EBBA5E4945E2912F4BA1156579DAEBA
SHA1:	F22DF7A4FA1D9B58485F7D0AED3C84C3648D7D63
SHA-256:	C283203C6E4CFAC37C905597E7DDADB9EE21C6FFD1AC58C7887C611AFC3B2681
SHA-512:	B3CF03DEE954AD9D6E482DEAA18260D969E63DEA3FC58121AE5A3E306AAD7D031351CD648FA0E9E3CF9F7099C5C62F94F0D75138FDCC8D17AD371636E2C965EE
Malicious:	false
Preview:	Search for ETL..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MessageType(FIR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlOK:TFLZd
MD5:	C8D5CBF313458D5E441B99E3EA43F20C
SHA1:	564029CD28EFCE342BDD017F6FE6D6F96306837A
SHA-256:	FE60C981B5080B7B1A711F8192CC74361364D3FEFA224FDF7F398741D112BCC0
SHA-512:	214EE131AC19AFA257D040150C6C6BBB2CFBF452F6373C8F07DC0434BCD32A6732978658A0037F5A2B312B5FA81D7EC051E079208FD37F1B6C9FC2D0156D66E1
Malicious:	false
Preview:	Search for FIR..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MessageType(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLROK:TFfcd
MD5:	48437D98D2234EC715C98AC7BCA13826
SHA1:	5AE24DF193D3A0F8B15F92079EE212C8FB26A7EF
SHA-256:	DF300D966C82F12090C9B269012860C1795E7BEEC728FD120C295ED77FFDE894
SHA-512:	2425455478A743E92842B2FBB0F9A7CD5AA70F2A463F3712CE77B90F549B136D6D6845BB6974BB1D017A7BB2E58730DCE91251DCC86412D0659291897BAE7A88
Malicious:	false
Preview:	Search for WAT..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Mode(GLL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDdGvVXKEK:TFZ4VXG
MD5:	185AB46A21A31E480DDB265B6C0E7A5F
SHA1:	8B2CF04C397FFFC3A3CF63993E0A2AF2C36E446E
SHA-256:	E22354C80C82AC56D8BE37711FAE0E46970DAC1800F802337ACEA655F483A121
SHA-512:	E4320F30CD428CE08FE22655F67D157AC13B69F739262BD3C5C713F9B2A9323C04E592532247ED2D9BD47EE9B1798E15EC151827EB1A0878858206EDA08F53C6
Malicious:	false
Preview:	Search for GLL..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Mode(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551767
Encrypted:	false
SSDEEP:	3:5NFDf2plLM3vn:TFbeAvn
MD5:	AD6EE5DA600F068849CCCD330D139F09
SHA1:	8734A25F0A4686F7216D2F4C9075F7E9E0E517DE
SHA-256:	B567B833B6B6297869DC5AEB40DFAF66CA22A722D7E5A6FA19CA0A01D2F1CD5C
SHA-512:	A1BF4E60741E5E3D4272FAC42DDDEE16A265662CE87CD4FB4F98FBC0A173A06976936120F30B9AC34A7647826847B49A8C49A722C3D5F91FB49FC4B95DF47638
Malicious:	false
Preview:	Search for GNS..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\MonitorSystemType(DOR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLIK:TFN
MD5:	373EE063D70945C4FCBFDD3D0B0D6D99
SHA1:	5E865BB2D4BD1C9A3141FA74D92BA9B4EE52C299
SHA-256:	41DADCB9E2AA3C563100FBC18AF7AB43DC45E22403FAD0D438E5EB4C4CC3462C
SHA-512:	F369D374F2C73AEB6BC4B7795EC9234D761A63D664B89FCA9C3237A0B5BD53CCD2C4E4649B25A8C14786DB4507F6415E31521803564C678BFC1BDBA618EE3174
Malicious:	false
Preview:	Search for DOR..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Offset(DPT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.701649204701856
Encrypted:	false
SSDEEP:	3:5NFDMoN6RnRQHFxiGWEovn:TFwoURSPMBvn
MD5:	14A2BD450B44058474EBA3793E1BB278
SHA1:	10F5A2945BFB2E69C3E389FE09622C37CC3C24DD
SHA-256:	3F90F83BDEF9817589E1384E5BE0ACC1F0A57EA6223C6F520DAC186646DDA174
SHA-512:	160ECCCE42C8B4D6B2F9B58D52472F5C1E5BAA4A2DABE6DB1FCF3E1EC05ED862BB2A8DA18AA50667813F02E158A9233A63B24A53C28FC944FF831DB0213973AF
Malicious:	false
Preview:	Search for DPT..print( #3,"M");..trend( double(#3) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\OpenCount(DOR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLLM3vn:TFjAvn
MD5:	ADD54C2AD039D3819F17D4A255771A77
SHA1:	DF832CA778BB31BF8735BB1469BA4A8B6EC57790
SHA-256:	26430E301504D413136CF3CC53FA4212B4DDC7089FC034F4FA869D6B8A48840C
SHA-512:	1DD6E60A96AC5E358607E42A238426CECA264D1AD2DC798411BD7A4980DA54CB3ADAFE15D9E819B2B93011E849ECDE1C271E8A99F1804E5ADE49EAC2B87079EB
Malicious:	false
Preview:	Search for DOR..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\OperationLocation(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	447
Entropy (8bit):	4.766661871794292
Encrypted:	false
SSDEEP:	6:TFBHxHFErebAIlvNMF1FIFErcr+lv25FErohwlvmsiHFErqqq4lvg5FErHgqglvj:TXRcIlvNMFPsr+lvZlv8UllvgcglvoGB
MD5:	89E0A61E88C29B92F0081CC035FF9157
SHA1:	757D2BA2F277A2FF685039241E059F351AC90AA9
SHA-256:	668DFB154D41F522DC930E28AF69B0CF596E56A584430CB182B85681C0C898BE
SHA-512:	035C117598F0F97013708683E6C8ED5BFE711C8F21C1F62AAA95E6A38604FCC9E0896C9574F49F6D4914CA9E71281221A462909C917C0C46F58EC92B2E6A7567
Malicious:	false
Preview:	Search for TRC..if (strcmp(#8,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#8,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#8,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#8,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#8,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#8,"W") == 0){.. print( "WING");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\OverrideSetting(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRFMf:TFfcbK
MD5:	B323567D9FB0EB882E600C52DFEC526A
SHA1:	C22161DB9AB0CEA0D4A2F82300338255A37EDEAD
SHA-256:	3B375F025B537C8D1CE821D877CD549C9F7C9B1EAB372A15E37A52899CCB4798
SHA-512:	4C867D6469551A7419CB42D5A4287B67E06DF6AEBFD41284BD4D20C6F4CA5B1043460911D59E362C3888EDB4648A8BA855A777437F104C599DF3EC9973DC9A65
Malicious:	false
Preview:	Search for WAT..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PackedBinary1(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6IK:TFda
MD5:	B5FD55809DCB2ACE715944A1B05D8268
SHA1:	1B6EAD168F7EDD133644522A77681A8A953E2B09
SHA-256:	8AB84776194EDDDE62E064C0BA994EA06C9B5700EB80D24FEB254170209CAE2E
SHA-512:	44BD4F6D8C67817F5A7BA5AF96CBC9EB9FF42E0EC3AD4937C5CD3C754AD841B7E34DC3E00BD985274985DAECE2D9D636AFA6BE1AADCE190C4D493342D6BE11A2
Malicious:	false
Preview:	Search for GEN..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PackedBinary2(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6JMey:TFdWfy
MD5:	1B4B2960306A45519E5E11852A869284
SHA1:	7AF8439C3D682570B1C4B79533A9B08CA2564046
SHA-256:	449EF17819C0B49A9532442197BE043D66D26CAE169F59FFBC4DCCAA5BFA55B1
SHA-512:	45D8D52B0A22D81E62C06558F8A80B76FD2560B3DB6B14D2669D3BFB7C4C8495737E53B4F483B93DE0CD3092F2FC0B1278CD82DF5C2A5E96131E89842F03E1B3
Malicious:	false
Preview:	Search for GEN..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PackedBinary3(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6Kfovn:TFdpyn
MD5:	DD191062060590C0D600716C0000584F
SHA1:	FB43EED97C406A516B047A92AA14018EA551BAFD
SHA-256:	B165AB96689DB86DE9A3A64126C12CD7891F60C4CFD4F4A4834A37399E508B36
SHA-512:	C5B280224A29D1E1BE9E09768B2713B1D3E4EC75F91732C6CB68CF195AA6E6D8D8A57E116975896AD01854CD328021AC973072E2DE0ED660C5E8EB5FF456FA8C
Malicious:	false
Preview:	Search for GEN..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PackedBinary4(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6LM3vn:TFdUAvn
MD5:	733E6AC73E44C6ED593098929168C4F5
SHA1:	DFE7D28DEC8DC26F3D041A7626FE2D868F361308
SHA-256:	4239163C34F8072F7E5BC83A33EAA0C6CC69F61F7BA5E85997263D9D041669ED
SHA-512:	F62F15C0EC237307D09D0DB08BFE635EEBBBA03D7D4184959F33A1DBA987C40C33186D9CDF9330A6AF31F1E79C54F9B848B356615B741046503BD0AAF8000721
Malicious:	false
Preview:	Search for GEN..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PackedBinary5(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6EK:TFdW
MD5:	61A2C7A8666697FEEC54D6314A6CB83B
SHA1:	A343380DB8444F715880340AA541644B989F30DB
SHA-256:	A809C0BB40081049726DD6D08CDB591F933A35CA3195B64C0584B65D188F5299
SHA-512:	9C81E2FFE5A2627D0E7141A55927DB50F1819E2A644F8EFAF3566C2D67CE1CB0240096B24F91A29C42272AB329F4B37957B2BE21927533C23725A212549447C9
Malicious:	false
Preview:	Search for GEN..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PackedBinary6(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6FMf:TFdaK
MD5:	23D45B511DBC703285E353196E84E73A
SHA1:	1A84BE9B85848411AD5EED0E455700E5B92A3A55
SHA-256:	87E41B664AB8F30D34520258680FEB4303429A2319911C4563EC939F98DB3FD4
SHA-512:	921013BC766CDC890F924C33E20035ACC65EE628764C055BD780D4E1E6AF2F994C82E838FA1C53F641166767A0BB8E0FB3AF4B65E75265395E565B97DF4E710B
Malicious:	false
Preview:	Search for GEN..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PackedBinary7(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDUq6NVM3v:TFdSVAv
MD5:	429EF79A0415B51D154FD230503D0862
SHA1:	DA7CC58CB541C387756F12562DD467E4B11E376E
SHA-256:	564EABD16CDDCEB66094B1855A8BD290EAD32602B6D9E3831CBE86816EDBB533
SHA-512:	90A3ED08023B093502CF1D0845891D1885EF2DBD87A06B26475AAB4AEEF2FA5724496E505DFBE36A2A0DA9A8A7C8BA05FC4B770C2079406D0009EDA077C6F8BF
Malicious:	false
Preview:	Search for GEN..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PackedBinary8(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDUq6NUAv:TFdSJ
MD5:	617749B1BD5871A5B249FF70A9058361
SHA1:	2DEDAB8DE8F802F1A71612953DEE579B5DE07DE1
SHA-256:	87FB54199E318D10EF1D5A292632982C73A8AACA64E19463A366875760662CA3
SHA-512:	552FFB707ABDE69159DFEDD65D7F435433D954DB140A07D721D685CABAB6B4A65C67D287A1D1A6C8B16640CC675B45436680BF4C667E7A583163765F24E11506
Malicious:	false
Preview:	Search for GEN..print(#11);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchDemandDeg(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.8451834689284174
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlaXGjq0pxKGuPYcKEZmFEruHhGu:TsT2ggl0GjVONYcKEUhGu
MD5:	35685D095FBCAB305FA3A0352AD5589E
SHA1:	E0EEC1D76748418FE494CA4DF75D3F423D0EFAC6
SHA-256:	34D05B420C46C068E72B145157E3FE6D43EAFAF9AAB868B0052DBEAC5A5EC3E0
SHA-512:	722727ED9C54B664C41097F37AFE491D7869613D63D165D2AE21B3B23C5BAE5059AD204145CA6CE2F15FA8814C8BA8351AEE5BE1E3BFB24E3BADC84A9F8A0D96
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchDemandDegPS(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.8451834689284174
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlaXGjq0pxKGuPYcKEZmFEruHhGu:TsT2ggl0GjVONYcKEUhGu
MD5:	35685D095FBCAB305FA3A0352AD5589E
SHA1:	E0EEC1D76748418FE494CA4DF75D3F423D0EFAC6
SHA-256:	34D05B420C46C068E72B145157E3FE6D43EAFAF9AAB868B0052DBEAC5A5EC3E0
SHA-512:	722727ED9C54B664C41097F37AFE491D7869613D63D165D2AE21B3B23C5BAE5059AD204145CA6CE2F15FA8814C8BA8351AEE5BE1E3BFB24E3BADC84A9F8A0D96
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchDemandDegSB(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.85046698502259
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlaXGjq0pxKGuPYcKEbIAlFEraGDHK:TsT2ggl0GjVONYcKEbF/GbK
MD5:	A10463C3C0842E133ABC4347213F87A6
SHA1:	7D9D2E6058BC7F7BFAC4DB03DE62C170F88FF9D0
SHA-256:	07C6EC49AA759925B2D88816388E14B323CCD1DEA2A7388961FDCCB96C40F9E5
SHA-512:	8485FA3F62F26BCACA2C8B6FEA63E517B2E8D7B5A49B0FBD1E8CA6F716FC253FA3D4F9A2793983BAAC88A015EFF7A4391FAE49B6109267DA157AFAD64398BC3A
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchDemandPer(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.820807398788273
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlWXGjq0pxKGTHf5PYcKEZmFEruHhGu:TsT2ggl4GjVOQ/dYcKEUhGu
MD5:	6BE808A74CE47B0528B9CBCC39C3ED7A
SHA1:	ACD322442B017D1964C418A0AEAC83F78860541B
SHA-256:	8D578061B5B6849E2512A11121806370C8204C5731FD85998D5281644FAFB2C5
SHA-512:	B05C0979DBCD9D312BCB61D745CDAE1B2ACCA20F852994737F05375E7B81C3913F898C1E83D66E6B635B3246BD0275286F08F3E6170666CBA6CEDC6AC6C6D7A9
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchDemandPerPS(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.820807398788273
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlWXGjq0pxKGTHf5PYcKEZmFEruHhGu:TsT2ggl4GjVOQ/dYcKEUhGu
MD5:	6BE808A74CE47B0528B9CBCC39C3ED7A
SHA1:	ACD322442B017D1964C418A0AEAC83F78860541B
SHA-256:	8D578061B5B6849E2512A11121806370C8204C5731FD85998D5281644FAFB2C5
SHA-512:	B05C0979DBCD9D312BCB61D745CDAE1B2ACCA20F852994737F05375E7B81C3913F898C1E83D66E6B635B3246BD0275286F08F3E6170666CBA6CEDC6AC6C6D7A9
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchDemandPerSB(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.826179438139153
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlWXGjq0pxKGTHf5PYcKEbIAlFEraGDHK:TsT2ggl4GjVOQ/dYcKEbF/GbK
MD5:	E721D25F232CE982F09B71FD82E96FDC
SHA1:	3676273D51B69E515D066A5ECA7ED76069E0B8E8
SHA-256:	DD318DAC5932ED2B1F72E67A59872DEB46EFB353FB8C3D05541AAE08623D69D0
SHA-512:	B6B0704F3772C48D823AC94AA7D5744A432F82270C6CB83316689FB046134F4CAE684FC31FAFBC65C9A24690F007CF46C706364BEF5402D05249E0B43B61FB16
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchOrderDeg(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.917504567714332
Encrypted:	false
SSDEEP:	6:TFCwxXluJimFErV2g/IluJcXGjq0pxCBvuPYhtCFMLR1MY+:TUwlJT2gglrGjVeAYnF+
MD5:	2855C5098977A178F249B784541FCE6F
SHA1:	F1964F1C477F94FB0C04A82F0CA4DE650F34E0E1
SHA-256:	8B5C7D6F416880206E131D510F57602FECAD20D1294FB40B23A9B314D6957F6E
SHA-512:	3CEA1DCB690DCFDDE109B686C100E4DC5B2388003E5221FA1E71CA2EB7DA8F16E206C4E53B8EF9D06BBB1215D4D4FCE37A537306194D1466BC487E786F925A68
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print (".");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchOrderDegPS(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.928927480608119
Encrypted:	false
SSDEEP:	6:TFCjCluJimFErV2g/IluJcXGjq0pxCBvuPYhtCFMLR1MY+:TUjClJT2gglrGjVeAYnF+
MD5:	077300DC689235E2DFB2379F6A3EE612
SHA1:	4BA6CBBB2733DB5488EB6AF12202BD5142B87CEC
SHA-256:	930C1906031841A9AD7130462F33E6B2037234ABFD91220359B625191614B0F4
SHA-512:	DA83DFCC2480DDA1D626E7E6E7A97D9913F24C755822C8C8C32D631CF1B4D91BC783FAA1999A69351526E123312466BB5F9A2D1C8499CE56F6A9B37EFED7AA19
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print (".");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchOrderDegSB(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.922598366684069
Encrypted:	false
SSDEEP:	6:TFC5luJimFErV2g/IluJcXGjq0pxCBvuPYhtCFMLR1MY+:TU5lJT2gglrGjVeAYnF+
MD5:	48E045B698B3C5A89BD43B84A1796718
SHA1:	00AF88050006E6E8C660DA93782CF0D51F55F150
SHA-256:	BAA07B446084825D7BC18DD3FCB740D659C5AD818AE0C3615834CBCE5DDF87E7
SHA-512:	EF355A531DBD0C749A99DE0FC2C005EE279040665FB34AA6D38055FD5B8DBA65EDF20802DA3F4225E4227B68EE8FC586820252D8C7431747FD8373F5FD6C01E1
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print (".");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchOrderPer(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.895832548462717
Encrypted:	false
SSDEEP:	6:TFCwxXluJimFErV2g/IluJgXGjq0pxCBvTHf5PYhtCFMLR1MY+:TUwlJT2gglvGjVeb/dYnF+
MD5:	637A504659642736DE8C2AAF3D7FB765
SHA1:	014495C70DE3217CD793DFE9EE4794845D8DA50F
SHA-256:	D2A06CA634D6F7C2FF0C68B32F4A114E433143047DF6ADA772864F52454DB311
SHA-512:	B0E921AEAF57CC65D0DBA82579907EC59C8C06873F5934216C7A887634E33572590E6590932ED88FE9734AF9CD35B97FEF0B894033A43912925DCE29370A764D
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print ("%");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchOrderPerPS(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.90729172457204
Encrypted:	false
SSDEEP:	6:TFCjCluJimFErV2g/IluJgXGjq0pxCBvTHf5PYhtCFMLR1MY+:TUjClJT2gglvGjVeb/dYnF+
MD5:	5560BB9958F5EDE8F5FC8273B94FB46F
SHA1:	9F4524DE875719188222D92EB890C9FB8B29E214
SHA-256:	50D8F09435C7BA95DE260872C5DDE6AE67610A51FE74BDC060BDE394E2A9938E
SHA-512:	186C129D6ACF0A09216D5074EE6C787C480F3993577F8A1A27B94F5551973EEBAF39F2C9CB2716B767C41F2A4E1BC5A1BBB92934C9E622C9EA8B346725FF82B8
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print ("%");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchOrderPerSB(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.900942518222834
Encrypted:	false
SSDEEP:	6:TFC5luJimFErV2g/IluJgXGjq0pxCBvTHf5PYhtCFMLR1MY+:TU5lJT2gglvGjVeb/dYnF+
MD5:	018DFA70A2067AFCB8E5A459962633B8
SHA1:	B6642CC950572DC86C42D3823BBCC26471166D5F
SHA-256:	52A397989997B5553BB128CCF388DFF44E9DB60128B3054842CA37B84C44ED3A
SHA-512:	ED007CF4489DCCA94CA07892DB05AB6AF811E0AC443A575FF2EA7936977FE2AA77CDC9295266D645FA567537D95EB5FD3ACF073609916835257848BD56A9DA2D
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print ("%");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchResPonsePer(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.813534671515546
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlWXGjq0pxKGTHf5PYcKEZmFEruHhGu:TNT2ggl4GjVOQ/dYcKEUhGu
MD5:	F0A90FD1E7848040D7C63B7690AA4A24
SHA1:	12C11780B8A53CB619E039CD4ED64004A53621CF
SHA-256:	558B339F75292DCEED13BCFB78F110C61E29EFBF1F46C9D7445A8FD5FD85A307
SHA-512:	38987CFA0888F9968A40BA836D1420EB7F5168923BB9D37248C2547AB8E08FB63C40A06C229FCE735AA805B9FA9BF7A5415A929531E4CB2709ED57BDFCA6E360
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchResponseDeg(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.835201992471304
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlaXGjq0pxKGuPYcKEZmFEruHhGu:TNT2ggl0GjVONYcKEUhGu
MD5:	E9CE55A0DADA85DB6F8198B58489880B
SHA1:	0E52C0EE4D784BBF5A6CE9181F3D7066EB0CBABE
SHA-256:	BA4C9E117A396B445DB20E82EC4AAD5A70BBD5EC203E29693EC11966B6AD7C7A
SHA-512:	465C6725B6D30537E31B30E09FE45DD8451841F669420FC7D499722D18DC9380A9BCEC25D4D0937FEE3F4413141D6B9B5D9F9E5CB9170AA116F94D7514044B08
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchResponseDegPS(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.835201992471304
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlaXGjq0pxKGuPYcKEZmFEruHhGu:TNT2ggl0GjVONYcKEUhGu
MD5:	E9CE55A0DADA85DB6F8198B58489880B
SHA1:	0E52C0EE4D784BBF5A6CE9181F3D7066EB0CBABE
SHA-256:	BA4C9E117A396B445DB20E82EC4AAD5A70BBD5EC203E29693EC11966B6AD7C7A
SHA-512:	465C6725B6D30537E31B30E09FE45DD8451841F669420FC7D499722D18DC9380A9BCEC25D4D0937FEE3F4413141D6B9B5D9F9E5CB9170AA116F94D7514044B08
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchResponseDegSB(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.840521542776512
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlaXGjq0pxKGuPYcKEbIAlFEraGDHK:TNT2ggl0GjVONYcKEbF/GbK
MD5:	CA7B69D1559F2609B53E860BF0B0A292
SHA1:	EB13B6343D3D30301D081F99FD28C088109E2B91
SHA-256:	44BF74E05DCD9029CB2181C60D415EA1904E8955A72E529264712617A63272F1
SHA-512:	CE508FF3793457F32C9D1BFB0E93C2797A33F9A5DDBCADAA11136588537920BD97C7833EBD518861FC5BD1E0937258862D93279079DAFA95EBA6A6AEB173032B
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchResponsePerPS(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.813534671515546
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlWXGjq0pxKGTHf5PYcKEZmFEruHhGu:TNT2ggl4GjVOQ/dYcKEUhGu
MD5:	F0A90FD1E7848040D7C63B7690AA4A24
SHA1:	12C11780B8A53CB619E039CD4ED64004A53621CF
SHA-256:	558B339F75292DCEED13BCFB78F110C61E29EFBF1F46C9D7445A8FD5FD85A307
SHA-512:	38987CFA0888F9968A40BA836D1420EB7F5168923BB9D37248C2547AB8E08FB63C40A06C229FCE735AA805B9FA9BF7A5415A929531E4CB2709ED57BDFCA6E360
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PitchResponsePerSB(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.818933061327559
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlWXGjq0pxKGTHf5PYcKEbIAlFEraGDHK:TNT2ggl4GjVOQ/dYcKEbF/GbK
MD5:	232109F58F88675F382E0A35B0BD4BC3
SHA1:	99077499373C99DBF85B41BAE81FEF907CB40B16
SHA-256:	DB086F56E76AD8A506C8322CDEDF753243A069E855D7E42E72F16FCB36518757
SHA-512:	2FF2B30F5ABD48C595040894EC182C8F505D78D1C484AEFF9AE42307853CB5EF91E57BDD47C6DEFB83C9711023A43689A8A61DF45E6A7F9DDA5F92D3D5D140AD
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PositionIntegrity(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.770310755768087
Encrypted:	false
SSDEEP:	6:TFJPDGVF1FmFErUd6lq9mFEra6lq5F1FmFErzzIlqu3FErpKyGBk/y:TPsPuIl83l0PZEl7SKyGeq
MD5:	00EEB44C24F8B3A601DA1427DA198314
SHA1:	1960DC100D3F1CB40AEEAE99ED99483FF91DEC7E
SHA-256:	FD74DFC0A5156280D67064FC17769ACE390A29681C278279ED6967864D2DB92D
SHA-512:	1D975BA149325FBB00C07F37518EA8CD50A0E7662FBE8A6DBB20771D1A5E2831876C268EDB26C3A48497D0AEA57BAB241A92BAD3F3539E0740ACCC42A1AE683A
Malicious:	false
Preview:	Search for NSR..if( strcmp(#4, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#4, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#4, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#4, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PositionPlausibility(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.691435688769648
Encrypted:	false
SSDEEP:	6:TFJPDGJsFErvIlqJvE1AFErYhlqJnx3FErpKyGBk/y:TPQrIlc2qlcxSKyGeq
MD5:	3D4CBE7AEDD94C56EF4379BB8D6850AD
SHA1:	45F1268A0D729945AC52A781E12404686A3680AF
SHA-256:	7E21EC51BFF36A23212FBEAED9A4674A1E06EF9F38B8F62B8175849BFD8216AA
SHA-512:	2B53AD41FEB1E9CB40B65C02E75E7A5766BB45F0DD60D55612A567177FB90B0914EADAC89AAEFF85FE512E57179A1577FC482F5C1A55B90D2AEF5035D2208883
Malicious:	false
Preview:	Search for NSR..if( strcmp(#5, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#5, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#5, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Priority(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLLM3vn:TF7/Avn
MD5:	1C2E063C6BCD44C523D9E78D999C3756
SHA1:	B5AC52FF3473F990224327CC5658120EC28103DC
SHA-256:	A46DE7EB623F4C9474D017EA92207FAC23FDF70F96BAE6E51F1B03082D96953C
SHA-512:	1793118BBF4146B72223239F190940C9B2EC2D4A59476013CD6C93E54221EA827F7CEBD143F64B82B33ADAAA3F73DC58F6FCCF5CD360D6E49A023A48DE2E7C2D
Malicious:	false
Preview:	Search for ALF..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PropellerPitch(RPM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.105414684205305
Encrypted:	false
SSDEEP:	6:TFapx4LR32g/pMsbB7Hejq6KVBe5P02KEZGLRTMYJDfy:TAbA2ggjSVBed02KESFNK
MD5:	778381A083D5887876AB1D9889236DF5
SHA1:	4A27E00C833CEAFF8711DDFB730FC83996B75BED
SHA-256:	CC69BF3894102B7AADCB29897165B1135E36100C1912862157D4C84573AD89EE
SHA-512:	5507557CC05F1695D7F386CEAB734556C0DEE3EA830FC5926F06989F2ED5D6AC1BE973CFACBF9C2FD8CCE96989E558C7CAAFFB1FB66FBC18A4E9F02F2618E519
Malicious:	false
Preview:	Search for RPM..//If (#6 <> "A") {..if (strcmp(#6,"A") !=0){...print( "Data invalid");...return;..}..//If #3 <> "0"..if (strcmp(#3,"0")!=0){...return;..}..print( fmt("%2.1f",double(#5))) ;..print("%");..trend(double(#5));..if( double(#5) < 0){...print( "Ast" );...return;..}..print( "Fwd" );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\PsPropellerPitch(RPM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.122427451057994
Encrypted:	false
SSDEEP:	6:TFad5EIeLR32g/pMsbBzVFejq6KGTHf5PYedYsgKEZGLRcYe:TAzJy2gQjSQ/dYYYzKEae
MD5:	1732654AA51D4F339C214AE0DA902CB0
SHA1:	A33D9049BEE4F2246A33FA506973CB42A665C967
SHA-256:	6A66FA7528E1E5C0CE4889CDAE20808EA618596AD21C77D7A6C0BD40BEB4A96D
SHA-512:	8B70E26F95B467F3634EBA3E795AD1797507E7AFE3214445EE7A58C9EA74BA59EABF8F1703F2FAA4374EB172E8BC7822F6C81FB848D240D6C995A66B8E5E3073
Malicious:	false
Preview:	Search for RPM..//If #6 <> "A"..if (strcmp(#6,"A")!= 0){...print( "Data invalid");...return;..}..//If #3 <> "2"..if (strcmp(#3,"2")!=0){...return;..}..print( fmt("%2.1f",double(#5))); ..print ("%");..trend(double( #5 ));..//If #5 < 0..if (double(#5) < 0){...print("Ast");...return;..}..print("Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMDemandPer(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.895840154756691
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/Il0XGjq0pxMeTTHf5PYJIMgeLREH0Yu:TOT2gglmGjVXv/dYJIhdNu
MD5:	CF43C3C7BD49EAAB06248A5406A9DE63
SHA1:	CB83A5508051208D73DA310D9D53093584760459
SHA-256:	ABA5CB312F72847FE14F09D8CD4956B31A672311DDAC002B53773BDC81B255D0
SHA-512:	94CF6D3ED4685A31C7A36E9DC416AC02954CE97D1169358DBEECC99E09B07D1C7A7F5FD9F6D060F1C7FFCEEAAB12B4F4B9B4AA4874094038FE923DDE07AF1C1E
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) < 0){...print(" PS");...return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMDemandPerPS(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.895840154756691
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/Il0XGjq0pxMeTTHf5PYJIMgeLREH0Yu:TOT2gglmGjVXv/dYJIhdNu
MD5:	CF43C3C7BD49EAAB06248A5406A9DE63
SHA1:	CB83A5508051208D73DA310D9D53093584760459
SHA-256:	ABA5CB312F72847FE14F09D8CD4956B31A672311DDAC002B53773BDC81B255D0
SHA-512:	94CF6D3ED4685A31C7A36E9DC416AC02954CE97D1169358DBEECC99E09B07D1C7A7F5FD9F6D060F1C7FFCEEAAB12B4F4B9B4AA4874094038FE923DDE07AF1C1E
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) < 0){...print(" PS");...return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMDemandPerSB(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.827863787639069
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/Il0XGjq0pxMeTTHf5PYJIMslFEraSHK:TOT2gglmGjVXv/dYJI5/0K
MD5:	E93CB4326D3E1EC3542BCB01B275BE60
SHA1:	181F2387F4F545CF15102745F49D287AFF42EDEE
SHA-256:	58B77674FA851A3F1EB11D9AD3AA92CBF256FE2CBC0FE5CB75A01F7B44C6A865
SHA-512:	455A5783EC046A34CAD1C7832BFEFC70842B4B70F52678ACDE717B9E7EB6AD101601706CE87A1284F66251D6073846EB223CC2B5086B0E3FCD7231F2A74E3BF6
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) >= 0){.. print(" SB");.. return;..}.....print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMDemandRpm(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.835071091497352
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/IlAFpGjq0pxMeTyeCSPYJIMgOFEruHhGu:TOT2gglAXGjVXu50YJIhqhGu
MD5:	67005C1C0178201B347CE2E5C7898FE1
SHA1:	CC2E151F13347C5B5DBDFC330CAC9125B149634A
SHA-256:	E7BAE12903468E1B1155B7A5C5B300261EAD1AC4ADC2B5C06451E41AE99784D8
SHA-512:	653695A8C3D08A34AE323D459103FB81FAEACD9817B11688E3F3AA39A6190A7A3C08F3E6B9A18670E43720A3AEF683557A938E14A6710DD992AE498318ED5568
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMDemandRpmPS(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.835071091497352
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/IlAFpGjq0pxMeTyeCSPYJIMgOFEruHhGu:TOT2gglAXGjVXu50YJIhqhGu
MD5:	67005C1C0178201B347CE2E5C7898FE1
SHA1:	CC2E151F13347C5B5DBDFC330CAC9125B149634A
SHA-256:	E7BAE12903468E1B1155B7A5C5B300261EAD1AC4ADC2B5C06451E41AE99784D8
SHA-512:	653695A8C3D08A34AE323D459103FB81FAEACD9817B11688E3F3AA39A6190A7A3C08F3E6B9A18670E43720A3AEF683557A938E14A6710DD992AE498318ED5568
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMDemandRpmSB(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	4.840390712476405
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/IlAFpGjq0pxMeTyeCSPYJIMslFEraGDHK:TOT2gglAXGjVXu50YJI5/GbK
MD5:	4B6A35EDACC70CCE8BB95F9FC555F63B
SHA1:	5CD5507C2ED6C0BA9BF51D4E0217671FFBD3F8F5
SHA-256:	9DC5727C88CD850AFEDF98CC7E9D1B1AED6CE8CF84233A1F1E940D4F89E125C7
SHA-512:	16956530D29DED12CBDB10BE879241F39AABB2C0C8B1E1511F261DF7F5E0A573762B31C605455D367E45A09752D5A8D1080C5260C75AB1404DDB96E9992C16F7
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMEngine(RPM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.782390539923682
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJgeuo+UoU6X9Peco+3AGXKc31+CQHFxx:TFaoEFcrV2g/Itge9vfqeXGfkCSPmW
MD5:	98D1D4C295FADEAFB12E6F168FCD9237
SHA1:	77C7B7665CEC7C095301DB80D57F8C2660440838
SHA-256:	AFF41DF2DCD3054B991920CA632DFB13F63175502F6CA812D70789516E8E3E3C
SHA-512:	E558E5F2BB2F78FCF54B6BF0595BF5C7E40F7437969169A01244EEB87D33CF1D258ED5AE886E7588FB8864ADF70F11525D25A42715A9D4BA3181A923DA8B7AAE
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"E") != 0){ .. return; ..}..if (strcmp(#3,"0") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMOrderPer(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.885530604025141
Encrypted:	false
SSDEEP:	6:TFCwxXls8mFErV2g/Ils+XGjq0px4BvTHf5PYd4qLR1MY+:TUwls8T2gglsQGjV0Bb/dYd4M+
MD5:	79036DDB917F184548AE33BBDDC030BF
SHA1:	FB173A6E057A9582BF153F60E35FDE29C5DEF4AA
SHA-256:	C23FD1A6F7BAEB32883E5FD740953A62616AFFE5FEDBA580199ED6D19DFC1DEF
SHA-512:	8056EE7F4D727E6C4EA92BCBB179398D850EE633A1A153D6DE9EE20F1DBDB04500B4AD5BDBE2E7B984B18C1CA4526950D354423379B13F0A1574318D4A5B904D
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("%");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMOrderPerPS(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.896989780134464
Encrypted:	false
SSDEEP:	6:TFCjCls8mFErV2g/Ils+XGjq0px4BvTHf5PYd4qLR1MY+:TUjCls8T2gglsQGjV0Bb/dYd4M+
MD5:	72C5D166C12972873F980F557419F829
SHA1:	E3FCA300B735B406F3DBEB351C18BE4B6BE21C74
SHA-256:	E2CE0F7F214E886C207887EC94B9B74DBDAB83E864834E345F675FB9375B3704
SHA-512:	B3317538495F838FD03E8A3D42B830D3B2265A73E99C298932E116F0F7A40EC369F0C086A054D30891182C1B3BA27919FA62DFE73B20DA81D11AC20DA18A973A
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("%");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMOrderPerSB(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.890640573785258
Encrypted:	false
SSDEEP:	6:TFC5ls8mFErV2g/Ils+XGjq0px4BvTHf5PYd4qLR1MY+:TU5ls8T2gglsQGjV0Bb/dYd4M+
MD5:	CC0DCCF7D856C09226307E643DE76305
SHA1:	7DBC9846AB12E144424603FC38B5A4393EFA85DE
SHA-256:	3FF791F5DF797F7D2840960CC389C543E9A1E7F2B96343A5D146FB8B99CCEFB5
SHA-512:	22CD718C9CC08F3EA4C33A675262F2969839AA72503FD7842BD1FDF198FAA70B2EA9CB5AB737F8571768CD1C1B836F49B3070EA1EABD703A8FEB1F338B04CEED
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("%");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMOrderRpm(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.907508515861056
Encrypted:	false
SSDEEP:	6:TFCwxXls8mFErV2g/Ils2Gjq0px4BvyeCSPYd4qLR1MY+:TUwls8T2ggls2GjV0B650Yd4M+
MD5:	5AE61942177BC1E17E8CB148F706AB18
SHA1:	2B9B46E110EEFB0632B7D98871543008506A1036
SHA-256:	C3962CC40C125B15E64F6231A707319F9F898B60789FB86977C7A5E82C919C1E
SHA-512:	2581E512B6A680C106BBBE64FCB23902646467D0EDAD10D3BDA915CC83D473A7EBDD91432CA7D15C6423FF9D6B366BD1700C5EE04C58307914483B803F2B711D
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("RPM");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMOrderRpmPS(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.918895394329311
Encrypted:	false
SSDEEP:	6:TFCjCls8mFErV2g/Ils2Gjq0px4BvyeCSPYd4qLR1MY+:TUjCls8T2ggls2GjV0B650Yd4M+
MD5:	C158877E9F70A03033A28157E1BE60BB
SHA1:	4E259E51F4F5CBD9BAD10198CA724D53D3993FF6
SHA-256:	004EACDB36E02A78A6D51E673D151FB356FB8BF473F8BB447105CE07F661519F
SHA-512:	A4481DFFE421FBF812463F3C36C0FA7F21863E0B8330E1FF7C82D512A962CFB0C57CAEA4D75B780B67F6FF0E98909F0366F9E8BF3647D39F059720F6DF3B10B2
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("RPM");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMOrderRpmSB(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.912586246064327
Encrypted:	false
SSDEEP:	6:TFC5ls8mFErV2g/Ils2Gjq0px4BvyeCSPYd4qLR1MY+:TU5ls8T2ggls2GjV0B650Yd4M+
MD5:	B8430B79CE251F89B1534B98418498BC
SHA1:	8A292670591AA78C62A87D51E6E41DD787B0A27E
SHA-256:	C3E96DD2524A7E5415D61980AC213DB59963313A11ABFE5A5B0442E3B32A3C25
SHA-512:	4D89BF1BB1295C527B78A5F3A6C6AE0A991C380FA91B5F2665445CE40163BB4D76C7D92A4D6C885BD8EDC8B6BE3AA6B2FE1C7AA4501006833A2045B829AA613E
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("RPM");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMPSEngine(RPM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.788075985119281
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJgeuo+UoU6X9PS+to+3AGXKc31+CQHFL:TFaoEFcrV2g/Itge9vfqjCGfkCSPmW
MD5:	ED512594A6B1D055E41D4CFAC5FA8CAF
SHA1:	F326D38EDA978FCED24FE6CBC86E06403D9163D0
SHA-256:	2F0F977108A9734B7CCBDAEDD65CC7B8FBE9048404C9E0542C1AA8B4065426C3
SHA-512:	CC9255CAB2AC7838084175B678A8C78BAB755FCE04EF5FE7E3526BA7AAF57255915E8020E4F3E05C5E76CACB37BD06D7A7933AD4B79BC97269F33A880ADB268A
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"E") != 0){ .. return; ..}..if (strcmp(#3,"2") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMPSShaft(RPM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.778943565027957
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJ2euo+UoU6X9PS+to+3AGXKc31+CQHFL:TFaoEFcrV2g/It2e9vfqjCGfkCSPmW
MD5:	88E1B4B292F87F83F482E5C26F9BEABC
SHA1:	5F59935A09B59E777292C46EBD0E1F7B1C1F3FED
SHA-256:	1E9374F7D33BC20C485DAA4929CA60945691E9051E37F78228F7D8CBCA2838BA
SHA-512:	34802ABA470D375E6D657DF8386FFEBF773D43A28826D040943B737A1DB4BCD83F151BAB22CD143D0749285B5A20E18DE58D3813DBE7F1603140F3658329F3ED
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"S") != 0){ .. return; ..}..if (strcmp(#3,"2") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMResponsePer(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.888405210518773
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/Il0XGjq0pxMeTTHf5PYJIMgeLREH0Yu:TPT2gglmGjVXv/dYJIhdNu
MD5:	2B6A2E4669C06EC60E2DFA766585A701
SHA1:	14960057EB91A9DC6093BB1A8CA47D320230BD15
SHA-256:	F95961BBBEB9530FC34B559885AA08770986014D1D17292B9F4D9B2EB324F441
SHA-512:	139A2B6CECEE0DE8859F85867E4AB8FD962CF82C6C0B0D9DF0D1C50A6B72A3B435480454B49D0D854F9F8FC28AC372C5346EF13DC98A75113A35637B52BD5554
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) < 0){...print(" PS");...return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMResponsePerPS(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.888405210518773
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/Il0XGjq0pxMeTTHf5PYJIMgeLREH0Yu:TPT2gglmGjVXv/dYJIhdNu
MD5:	2B6A2E4669C06EC60E2DFA766585A701
SHA1:	14960057EB91A9DC6093BB1A8CA47D320230BD15
SHA-256:	F95961BBBEB9530FC34B559885AA08770986014D1D17292B9F4D9B2EB324F441
SHA-512:	139A2B6CECEE0DE8859F85867E4AB8FD962CF82C6C0B0D9DF0D1C50A6B72A3B435480454B49D0D854F9F8FC28AC372C5346EF13DC98A75113A35637B52BD5554
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) < 0){...print(" PS");...return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMResponsePerSB(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.820695328857707
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/Il0XGjq0pxMeTTHf5PYJIMslFEraSHK:TPT2gglmGjVXv/dYJI5/0K
MD5:	00D0C1AA23541567F7D27A9C4694C5C0
SHA1:	62E0CC2DB021F8A854659287FB36A857F43B2F4D
SHA-256:	83E355D7F49A7FEFB1892709E44285151C7E7A022EA1CF2B94096ECE4A7AD7DA
SHA-512:	390351EBD5A01A1F6F34B57E4F8C3A89589721A671B539D95E143A544CF16F3BCB16F44AE8A67224127E200C691F739DC236BB4CC9B6898AF141490E3FE6044D
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) >= 0){.. print(" SB");.. return;..}.....print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMResponseRpm(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.8278508748908555
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/IlAFpGjq0pxMeTyeCSPYJIMgOFEruHhGu:TPT2gglAXGjVXu50YJIhqhGu
MD5:	995E52AB6AD1D2A7C3793A3E6F513BFA
SHA1:	8B962E4C6F76E2D164299FD30A6E5B7F6042CD8A
SHA-256:	4959AE465C17A30F1A8DF980DDD64690DF07BF83BE96B4E59B464E5CA48986A8
SHA-512:	7C999E6C6A271C55229F7042AC9A6E88F014759EA465F5D24ADA9E33877395B9E0132A766E6A94916F5545BC1C3EAC6F345D33D1616C5C8A42E8ED1C21A48698
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMResponseRpmPS(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.8278508748908555
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/IlAFpGjq0pxMeTyeCSPYJIMgOFEruHhGu:TPT2gglAXGjVXu50YJIhqhGu
MD5:	995E52AB6AD1D2A7C3793A3E6F513BFA
SHA1:	8B962E4C6F76E2D164299FD30A6E5B7F6042CD8A
SHA-256:	4959AE465C17A30F1A8DF980DDD64690DF07BF83BE96B4E59B464E5CA48986A8
SHA-512:	7C999E6C6A271C55229F7042AC9A6E88F014759EA465F5D24ADA9E33877395B9E0132A766E6A94916F5545BC1C3EAC6F345D33D1616C5C8A42E8ED1C21A48698
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMResponseRpmSB(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	4.833196467872089
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/IlAFpGjq0pxMeTyeCSPYJIMslFEraGDHK:TPT2gglAXGjVXu50YJI5/GbK
MD5:	DCBB8966C598445E9E7E9047EBA61301
SHA1:	24AD81B8350ACF000AB9298CF58585778638D8BA
SHA-256:	A269FA98F93ADB6E40020104D7CF45345ADF5347426EB7B5AE2BC7FB1716F009
SHA-512:	27BD8711D405B288FCC5A6E9BE6F4D38F4C49C49447B910D385A0E845DF36123E6C3AACD820913B6784F8862CEAED6C7EAD9EC7508559787B1FB07FA32201A9F
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMSBEngine(RPM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.797208405210606
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJgeuo+UoU6X9PMMco+3AGXKc31+CQHFL:TFaoEFcrV2g/Itge9vfq5GfkCSPmW
MD5:	907BE00AD69828BFAFC26D4634EE73C5
SHA1:	017B1E0D8527780664D4A0C7E362742146AF3FF2
SHA-256:	EE954B4AA9CBCE49BE03A298E3BE24993CF503ECC655364986AA6B3A401470CB
SHA-512:	B691A5868CAB244F2B0F8AD8862E52ACF13A17E681A9C6E47C54FA3CE13941C520746A11195D985B8C1245B7289D392E63A3CE02646B074D101B0FC4825D8156
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"E") != 0){ .. return; ..}..if (strcmp(#3,"1") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMSBShaft(RPM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.788075985119281
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJ2euo+UoU6X9PMMco+3AGXKc31+CQHFL:TFaoEFcrV2g/It2e9vfq5GfkCSPmW
MD5:	1F0EACFA3C4DECA6E43B4D7E8985292C
SHA1:	42309AD550D90C8146B4E8C05702D969A61367D3
SHA-256:	7ECA65CF1D25A6477A8BEA0171B2833A1CCC1F5974AFF8E1AD86CEE0D4126E59
SHA-512:	325274795B4F84694D1B262FAC2F5CB4544EA952A1C0E2891DF2A1DD6BA9490C18283AEDEBBBFF0E6CC8961E33DAF5D8A6A670A133ED3EE1CD0B76FE53923C94
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"S") != 0){ .. return; ..}..if (strcmp(#3,"1") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RPMShaft(RPM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.773258119832358
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJ2euo+UoU6X9Peco+3AGXKc31+CQHFxx:TFaoEFcrV2g/It2e9vfqeXGfkCSPmW
MD5:	12427EC22AC35F74D8BAB06D46C3B4A5
SHA1:	69B92FBEDBEEF6CA2179BB8BDB85CC0A081877FB
SHA-256:	3809C1D2ACA043DD79413D1025000C917FF0E677D6CA7BF2DC59C929CE402330
SHA-512:	CE9D9126C4C1403338FFB442BF400ACECFF5BD5392C215BCB0A6E92AAF1460F5FF65D079B7488A364AA294B585023C8199BDC497916FFC8482FB46FEE9C84C74
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"S") != 0){ .. return; ..}..if (strcmp(#3,"0") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RadioMessage(VDM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqPXMlKfovn:TFeXZyn
MD5:	5C8DCD9179885FE6D742799CAFFA63F0
SHA1:	5BC1F7D2B8876BCCC21371DEEC4218A74590E6A6
SHA-256:	E6DED4BC055FDEB2B480E6CBDF8FED365B6797B5434BE6E5D2B37BCD036229F8
SHA-512:	1C9AB517A20526BCD34D53981A838F90E9401FB117FF9E52A767137BCE7D289CAFCC6D6F92B0B8D6ABC7DAC67A483D0EC410A88D3A7A6A45970038E150BC3E1B
Malicious:	false
Preview:	Search for VDM..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RadioMessage(VDO).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqcKfovn:TFoyn
MD5:	05BB90FA5D5E4616B9D935D418A08574
SHA1:	1E08D8209AC1C44A92B6550FF7B5FB941D6CCC7D
SHA-256:	62AD1D580F42EB1890EF1CD15F2DA204472613B1C6F274EC6D1249E89762F2DB
SHA-512:	C1D7224EA9277C26E4E0F20D3626812013871D1D6E5C747D2868007B216DEF14E4642EE577A4DF2EFF3B4B9131773746CFF27C961E8B0B0C502C8E41C378ADB7
Malicious:	false
Preview:	Search for VDO..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Range(DPT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.547247342260632
Encrypted:	false
SSDEEP:	3:5NFDMoN6RfvGHFxiGRMAv:TFwoIAP4K
MD5:	EFC4BA968837B93D46FCDB3080554045
SHA1:	F8917DAD98FE6F5CB65872C1FAAF8ADF688E4E7F
SHA-256:	8EFDC48C1B9FF679C502F03928EF01B0739128FDA0D4FB10F164E1F600F9F253
SHA-512:	B41BA7889F78655C0F7E8DBE3EE951283A838DD19971C80DF9B1B0D29EF4A2CDA6F2DD19291BDCC50141EE1CCDD10784187AB46E4C259D658B1A195625EF46F0
Malicious:	false
Preview:	Search for DPT..print( #4 );..trend( double(#4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RateOfTurn(ROT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	123
Entropy (8bit):	5.054077384236297
Encrypted:	false
SSDEEP:	3:5NFD1dWX9PqCeLR32g/pUAGXKOJfKpovRQHBlgNpMfn:TFJs3eLR32g/pYvfKpoJSPIif
MD5:	11515FB148E97C90EEAF15E57471B18E
SHA1:	3369BC47ED0ABF75B6ECCDD3693F61275A7EAB39
SHA-256:	838BC3047172309AFCA3E8848E7F6A1384070DB849DE7349B400BEEBD8E94A43
SHA-512:	D6F6E7D178C281C3548EF75CE0C08934061BF96932D7D2F56E96943A83044F86B1CA1D8AC44F5B5B07268A9E3D7534F64DA629363BE13EC985DB24B9DA0AF160
Malicious:	false
Preview:	Search for ROT..if (strcmp(#3,"A")!= 0){...print( "Data invalid");...return;..}..print(#2,"./min");..trend(double (#2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ReferenceDatum(DTM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	4.7880691031424485
Encrypted:	false
SSDEEP:	6:TFiQHMWFEr8JlgzNFErFceoIlgufOFErJlg7aFErDAIGBk/y:TMStlgz6JlguTlg7VAIGeq
MD5:	B708EA3E73CBF55FF166942B01052100
SHA1:	1DBE8982035D989E1E215D3E653CA84FE436C73B
SHA-256:	0714474B8A3A21A367D5E81AA714FE6C668DB8BF5883F29E3B8E077EFD7D4852
SHA-512:	E88567E971B1109BE1D7D1E589A8471FE43E2FBD73C18A02087CA7952A095E91AF815E2652AF51CFB9F290D8AD0658F1FE88BF4E0346F2A2FD072386C78739BD
Malicious:	false
Preview:	Search for DTM..if (strcmp(#9,"W84")==0){.. print( "WGS84");.. return;..}..if (strcmp(#9,"W72")==0){.. print( "WGS72");.. return;..}..if (strcmp(#9,"S85")==0){.. print( "SGS85");.. return;..}..if (strcmp(#9,"P90")==0){.. print( "PE90");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ResetGroundDistance(VLW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDi7FMLRELr6Mfn:TFmHr6Mfn
MD5:	B3FD817269C8C96FA68A5701FE307F54
SHA1:	30BC7D02FBF9527CE0BE9E9D274EAFEBE04505EE
SHA-256:	D857547E1B9124579116F2422BF1FAA0D93F8B0BDA6A236FBC4D3547AE3CC9B5
SHA-512:	2B5FA78893ACC04BCB53447DAAAA0B823275E0C3B2F21BD7FBBA9345A36AA47791F21C0F483EC5FBCB0B879A2C2797E5458FEEADD8B95F212371CC399D69ECE3
Malicious:	false
Preview:	Search for VLW..print(#8, "nm");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ResetWaterDistance(VLW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDi7FMLRIz8sfn:TFmIsfn
MD5:	3039D1981F5D297111DB324EAAF6B756
SHA1:	E7479A5AA7884C57DAC04D19E43FAE161F924193
SHA-256:	208DA161B12CDA3506A5419418A748630A041ACD450CE2C652012BFC0292291D
SHA-512:	26469E329C0FEC98AF0A64E0E7457DD977846FEA3DCFAA2CCDA00D95FE3F44754198B6FCD92DC30E24D6509BADAF702DC5ACB33D1969D0E936E31C01A8D46D38
Malicious:	false
Preview:	Search for VLW..print(#4, "nm");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Roll Period(HRM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.499597622210291
Encrypted:	false
SSDEEP:	3:5NFDkAL7BloFf:TFQiPYf
MD5:	DAB5ADEE0D5F624790F29D4A70E421B1
SHA1:	C6E5FF51255A8F40140E586049BB6E90C3E5C9F4
SHA-256:	F3486E5CC545C222D3C3ECC2D8A1C2B61F6EB9B7BAA7AFBD4976D8E381ABDFB6
SHA-512:	2B04D2D16459EE24382588440CBFCE07502D96D3724E40B89ABF6F0E3C20507F3413377501EDBD332BA9B86FF97B34E58D301CB4E2BC5CB811D3814CA8D8980C
Malicious:	false
Preview:	Search for HRM..trend(double( #3));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Roll amplitude-Port side(HRM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.499597622210291
Encrypted:	false
SSDEEP:	3:5NFDkAL7BloFDy:TFQiPYW
MD5:	B3D38B9D6483A209DFEE908D7D21C6FD
SHA1:	9D48D47956B29C829D56A520CB4879F9C5168678
SHA-256:	90A07A943F0ACFBCA43BE1747C94C84F1A9E4479F4F397B013BBFEE11C2EF563
SHA-512:	8BE68DE74D1E0A170BFA96CD3F7C6D5F749C45D04BA46A6DC3B20A76C95632F1D8979638A09E74EE750229153FBAEFB48876F8031ADA73ECD4F5CF4714ECE71A
Malicious:	false
Preview:	Search for HRM..trend(double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Roll amplitude-Starboard side(HRM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.499597622210291
Encrypted:	false
SSDEEP:	3:5NFDkAL7BloFsy:TFQiPYsy
MD5:	658DABF5C8BACCB231D0589555F60A4A
SHA1:	E29F03A77E73112C591E092EB6E2667470E5C07F
SHA-256:	1DF09B4831F0082B4956E4B23181C9329F326078AE891A0B3BAA2FD270762174
SHA-512:	D2F80DF5E24CE19C96B005E06B77658C2EF12EE754AE5F99295A220B45F9DA726B76D7623007580980AB16CE55C29185F5EE87BCB479E354A3CA43A0CF5BC0BB
Malicious:	false
Preview:	Search for HRM..trend(double( #5));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RudderAngle(ROR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.773679354006836
Encrypted:	false
SSDEEP:	6:TFJPD2kcrV2g/I9eMFEr+1FeCFErNqwPmif:TXE2gg9P1F4jm0
MD5:	6131F5912D888B83F4BEC2E1D90AD5FE
SHA1:	ADD0060450D1B884DFDF48C8B54BA897F50E8BBA
SHA-256:	ED5E2131D942E1C14249A30192654AD6B48535CA7836C33B61ADCAF842CADFC1
SHA-512:	1408E8422FE1FB95A87BC33270AA7F513045229B35BBDB12E6DE8A9B200315CBB8A3007126A8ED41BB3BE5618F139B2FDA839D5A30118183F9E4BE19E008B65A
Malicious:	false
Preview:	Search for ROR..if (strcmp(#3,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#2) > 0){.. print( "SB ");..}..if (double(#2) < 0){.. print( "PS ");..}..print( #2 ,".");..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RudderAngle(RSA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.75886148871991
Encrypted:	false
SSDEEP:	6:TFVTkcrV2g/I9eMFEr+1FeCFErNqwPmif:Tz2gg9P1F4jm0
MD5:	C26B9D0CE5EA6FCFC72F9C6A1C6CC555
SHA1:	E6CE74625BE91C88564BC46960F8D289AFF50DA1
SHA-256:	6BFBF38963369154353C9C11C6AADBE694D674B958B74E7A24D82D80AAD20DBD
SHA-512:	7A0FAC80933E672E99230CB87B042B489355B11CCDB5F85B286B1272599CBD1B4FA88C7C898F4CED562312812D04DA564D312FC9E1AD8E128C974FB3E14F58CD
Malicious:	false
Preview:	Search for RSA..if (strcmp(#3,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#2) > 0){.. print( "SB ");..}..if (double(#2) < 0){.. print( "PS ");..}..print( #2 ,".");..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RudderAnglePS(ROR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.773679354006836
Encrypted:	false
SSDEEP:	6:TFJPDwkcrV2g/I94MFEr+1F4CFErNPUwPmW:TXwX2gg9461F47VmW
MD5:	EC6177B83046D6EFB48F26746C652833
SHA1:	F2ACFF365D80311FD2B528B65822498995D5676E
SHA-256:	890EF13CC022F2BC4A42EFD68FA8CEF8DFEB242F9AEDF19629E44D78FBB868B9
SHA-512:	A50FF6CC380C8FDD5AC3916924F85A93EF909CD0907B9434B8B255F71CAC297B62F79BD86C5BEEA5979359FDF1873C75045DC1D172140B103B19D87EFFD3E536
Malicious:	false
Preview:	Search for ROR..if (strcmp(#5,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#4) > 0){.. print( "SB ");..}..if (double(#4) < 0){.. print( "PS ");..}..print( #4 ,".");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RudderAnglePS(RSA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.75886148871991
Encrypted:	false
SSDEEP:	6:TFVVkcrV2g/I94MFEr+1F4CFErNPUwPmW:TFX2gg9461F47VmW
MD5:	54111E4B678A5D098A495B48673B9FDD
SHA1:	E92BE2EB743137A11DAA5DA02D11533478A95E77
SHA-256:	FA7342FA849DBF3491DE8B6718348940902E89D72A36F337D769B1CC477BBB35
SHA-512:	42D61B2185E834A8B8A2CD674037F61EA184FB590B964ABA86BD083714E788B9366E9486C43E2141E64411FA565A987D1369B2D6A55E988F7134340F400EDC74
Malicious:	false
Preview:	Search for RSA..if (strcmp(#5,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#4) > 0){.. print( "SB ");..}..if (double(#4) < 0){.. print( "PS ");..}..print( #4 ,".");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RudderAngleSB(ROR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.773679354006836
Encrypted:	false
SSDEEP:	6:TFJPD2kcrV2g/I9eMFEr+1FeCFErNqwPmif:TXE2gg9P1F4jm0
MD5:	6131F5912D888B83F4BEC2E1D90AD5FE
SHA1:	ADD0060450D1B884DFDF48C8B54BA897F50E8BBA
SHA-256:	ED5E2131D942E1C14249A30192654AD6B48535CA7836C33B61ADCAF842CADFC1
SHA-512:	1408E8422FE1FB95A87BC33270AA7F513045229B35BBDB12E6DE8A9B200315CBB8A3007126A8ED41BB3BE5618F139B2FDA839D5A30118183F9E4BE19E008B65A
Malicious:	false
Preview:	Search for ROR..if (strcmp(#3,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#2) > 0){.. print( "SB ");..}..if (double(#2) < 0){.. print( "PS ");..}..print( #2 ,".");..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\RudderAngleSB(RSA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.75886148871991
Encrypted:	false
SSDEEP:	6:TFVTkcrV2g/I9eMFEr+1FeCFErNqwPmif:Tz2gg9P1F4jm0
MD5:	C26B9D0CE5EA6FCFC72F9C6A1C6CC555
SHA1:	E6CE74625BE91C88564BC46960F8D289AFF50DA1
SHA-256:	6BFBF38963369154353C9C11C6AADBE694D674B958B74E7A24D82D80AAD20DBD
SHA-512:	7A0FAC80933E672E99230CB87B042B489355B11CCDB5F85B286B1272599CBD1B4FA88C7C898F4CED562312812D04DA564D312FC9E1AD8E128C974FB3E14F58CD
Malicious:	false
Preview:	Search for RSA..if (strcmp(#3,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#2) > 0){.. print( "SB ");..}..if (double(#2) < 0){.. print( "PS ");..}..print( #2 ,".");..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SBPropellerPitch(RPM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.124816335558512
Encrypted:	false
SSDEEP:	6:TFad5EIeLR32g/pMsbBzV9Aejq6KGTHf5PYedYsgKEZGLRcYe:TAzJy2gPjSQ/dYYYzKEae
MD5:	9EBB4B5C98D682A6FF7CB88C82737EA8
SHA1:	311D639BAF7FD13ADCE90359F4C227C65FFE58D5
SHA-256:	DE2E0B0A72C77E11AA89F9F015DE9F855457DDFD55FEAEB6450A80F8BD2A4172
SHA-512:	A818B70734C1C4A1E38D30D5DE8AD2566EE8ADC42B5F3BE442FE2AFC117A8E92C0EFA920AAE89E5D25F8A5DED0EE6B0540F935C21BAF8FB314CDEF49DADF6F5E
Malicious:	false
Preview:	Search for RPM..//If #6 <> "A"..if (strcmp(#6,"A")!= 0){...print( "Data invalid");...return;..}..//If #3 <> "2"..if (strcmp(#3,"1")!=0){...return;..}..print( fmt("%2.1f",double(#5))); ..print ("%");..trend(double( #5 ));..//If #5 < 0..if (double(#5) < 0){...print("Ast");...return;..}..print("Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SOG(VTG).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.671877762033242
Encrypted:	false
SSDEEP:	3:5NFD6b4Sl3vGHFxiGTMFK:TFMBlwPCFK
MD5:	BEA259EDFC463A9EC43FBDC4E207ED2E
SHA1:	C1601AC8E182A9D4551F27B8BCE4CB0F63976837
SHA-256:	91532963896577B118F6F6BC8B1F0C7219F0339FB79D0B6E06017C63480F7F76
SHA-512:	ADBB482FA9220796C8EF06E364B6C101D664D9299412C22C670F4D28EDECD4FFB6D61AEE1FEDFB79B2418173CC5337920672D8B229B3A23B39004A72B8D1A0C7
Malicious:	false
Preview:	Search for VTG..print( #6," knt");..trend( double(#6) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SOGCOGIntegrity(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.770310755768087
Encrypted:	false
SSDEEP:	6:TFJPDGAVk1FmFErUd6lqAD6mFEra6lqABk1FmFErzzIlqALsi3FErpKyGBk/y:TPDkPuIlQ3lbkPZEl3SKyGeq
MD5:	627D3AEF5A8A52B7DCF30426B8083B8E
SHA1:	083449D0C619F9E22C87F12EFC276BDFF7D5566C
SHA-256:	7308972A4068637EF8AA827922C38FCBB41B71B31E7A1CAB71571F5BD1C0732E
SHA-512:	F4677E0AAF838613B94717EFDE2920209C9B1FBE9A45EE072F45E83A829F1270445324FDCBFA318612B600AD83D616D88C0F80DCA64E7077BDDFAC8B44161727
Malicious:	false
Preview:	Search for NSR..if( strcmp(#8, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#8, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#8, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#8, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SOGCOGPlausibility(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.691435688769648
Encrypted:	false
SSDEEP:	6:TFJPDGFsFErvIlqFfsF1AFErYhlqFHR3FErpKyGBk/y:TPcrIlQU7qlQxSKyGeq
MD5:	1099F9D77704C38755C4E0E9257561CC
SHA1:	E3A5EC8B5A09666EEAA6F5E3FEB7677CD8A3C6AB
SHA-256:	0F33ABE013C74A3136164DA66CEC2BEF7285AD88165AE5E2615FA90FDBD63272
SHA-512:	0469708CD802E0A1784E7DA7E1A77CF4E8B91A2E2F1E11F07D2CF7949C2C2B4AEA55D6C3369BF790E73479C5CF263B87D1E27F89918D1EC6926460246D02046A
Malicious:	false
Preview:	Search for NSR..if( strcmp(#9, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#9, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#9, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SOGK(VTG).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.77613097283397
Encrypted:	false
SSDEEP:	3:5NFD6b4v9HfZHFxiGdM5yn:TFMuf5PsIn
MD5:	F5068C709E83311C9DD93AAFF147BD09
SHA1:	37A17F759519906131602B0C72804BC66CA3F8F4
SHA-256:	57C71F0DD2C4CFF99FF66FDB578BE6E4FD1835647D7A453C29FE2E079E724AF3
SHA-512:	A12EC7243EF4E5BE9EA8819070ACC8AB46ABD57E9B3E3561A16F9D5E8CAC5EA6B3D4FF0C5756935C409FE553E995E7C41D32ADCADB19478762BACF047BA9060A
Malicious:	false
Preview:	Search for VTG..print( #8," km/h");..trend( double(#8) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SOGLogitual(VBW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.958034016114698
Encrypted:	false
SSDEEP:	6:TFWJ0LR32g/p3FKEbIOFErWq6KVFrSj4FKEZAFErWq6KVFrSjkWV4iP0B:TJ2glFKEbLSVLFKEwSVlW2E0B
MD5:	46A9AE915CD2B1027977A2F11036B524
SHA1:	D4199CF94EC0CC502A99DFBCC3BBD0A0DA4CD65D
SHA-256:	00DC2C6834C7DE23CD0FAB276748A2F3903C961BD4E8FDC293BB995B8F0E26E8
SHA-512:	49167AFFE268C59D4C4D0A2AD54B2F48B227606CFACA15D62331ACA5D31C0CA54C6ABF7B35D91BB1723EF47AA54D0E0FF0B9D4F6D840689BEBD99375D4F3A412
Malicious:	false
Preview:	Search for VBW..if (strcmp(#7,"A") !=0){...print( "Data invalid");...return;..}..if (double(#5) >=0 ){.. print( fmt("%2.1f",double(#5))) ;.. print(" knt Fwd");..}..if (double(#5) < 0 ){.. print( fmt("%2.1f",double(#5))) ;.. print(" knt Ast");..}..trend(double(#5));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SOGN(VTG).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.671877762033242
Encrypted:	false
SSDEEP:	3:5NFD6b4Sl3vGHFxiGTMFK:TFMBlwPCFK
MD5:	BEA259EDFC463A9EC43FBDC4E207ED2E
SHA1:	C1601AC8E182A9D4551F27B8BCE4CB0F63976837
SHA-256:	91532963896577B118F6F6BC8B1F0C7219F0339FB79D0B6E06017C63480F7F76
SHA-512:	ADBB482FA9220796C8EF06E364B6C101D664D9299412C22C670F4D28EDECD4FFB6D61AEE1FEDFB79B2418173CC5337920672D8B229B3A23B39004A72B8D1A0C7
Malicious:	false
Preview:	Search for VTG..print( #6," knt");..trend( double(#6) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SOGTransvers(VBW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.949310848764217
Encrypted:	false
SSDEEP:	6:TFWJ0LR32g/p3FCF8mFErWq6CXMrSj2rFCFjOFErWq6CXMrSjviP8K:TJ2glFiUUFKEURER
MD5:	5A1D625F892928ECBD91AEA70C898980
SHA1:	F8740C0E494EC1DB4C7D3CA270CF5530CB3D86EA
SHA-256:	AAF34D34210DA91821AD182645B146C6209B88F5E4A056BAE3830A210D4F8EC4
SHA-512:	4A3048B94FE8D7E7592430B2256263509582EAD85DB3E0DD4522A929B2C3B3EC2160D43B47F796119EC890B1277164FA8EA0FC9AB80DA417BE7F6081B37D9904
Malicious:	false
Preview:	Search for VBW..if (strcmp(#7,"A") !=0){...print( "Data invalid");...return;..}..if (double(#6) >=0 ){.. print( fmt("%2.1f",double(#6))) ;.. print(" knt SB");..}..if (double(#6) < 0 ){.. print( fmt("%2.1f",double(#6))) ;.. print(" knt PS");..}..trend(double(#6));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\STW(VHW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.7261033495736084
Encrypted:	false
SSDEEP:	3:5NFDmB6RK6O3vGHBloGTMMf:TFoZwP8K
MD5:	73F8A302CC3C78B4261A50EEF951C167
SHA1:	FD6EEAC1F239C10B59DE6DED07CE080C43EB0DE9
SHA-256:	2688E08E0294A745DA91E029C564D67DC4CD21776CA4834EF3C637C2764CBEDE
SHA-512:	094459E956BC92567F100902FCD687AFB233530B4C97C09DD873AD9F7002E4AD8F8306C58510BA669707A7B87EDAA4620BBAE9EF7F758035422799E849B3FFE3
Malicious:	false
Preview:	Search for VHW..print(#6," knt");..trend(double(#6));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\STWIntegrity(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.770310755768087
Encrypted:	false
SSDEEP:	6:TFJPDGfF1FmFErUd6lqLmFEra6lqjF1FmFErzzIlqE3FErpKyGBk/y:TPyPuIlq3l6PZElpSKyGeq
MD5:	D45BF2B23FC219CFE1E53490B14C1B57
SHA1:	91D9CAED7E5A60870C2C82EDD7A7056C895A7D6A
SHA-256:	2EA166883665B1B41FA0473935DC5FFCD67A3D0AFD0F0A74B7CF389FFDB7FC06
SHA-512:	A63E95AD266321DF8CFF811F927B7BD55151085783D87ECF2C40483B30D54A4DF8A21A145EA9D5C06DAFDB3AFA1D8A71DB8DC63A9409EFFCB75E5A958872659C
Malicious:	false
Preview:	Search for NSR..if( strcmp(#6, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#6, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#6, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#6, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\STWLogitual(VBW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.936378661347794
Encrypted:	false
SSDEEP:	6:TFQLR32g/p3Fe6FOFErWq6e8rSj4FeUFErWq6e8rSjkWV4iPgK:Ty2glFHFEPF9RW2EN
MD5:	C10509CFFD8B49DF4E1692D33936FFBD
SHA1:	3F76CB5AED22423D637568F4C20620C8C0F41357
SHA-256:	1165850372C4BF50F5A3133EE7A6E02DF660728987E7C39E8B61BEB5A80B5D9D
SHA-512:	72388FA50648D6D8AA0C21C8612157CCC36AF5BDC0D7AE79B03731520C24886329A91CAE7B31B262B63EA846F94F3EE7270D87505097E974343A7B7376BE4B33
Malicious:	false
Preview:	Search for VBW..if (strcmp(#4,"A") !=0){...print( "Data invalid");...return;..}..if (double(#2) >=0 ){.. print( fmt("%2.1f",double(#2))) ;.. print(" knt Fwd");..}..if (double(#2) < 0 ){.. print( fmt("%2.1f",double(#2))) ;.. print(" knt Ast");..}..trend(double(#2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\STWMode(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	335
Entropy (8bit):	4.848546118228948
Encrypted:	false
SSDEEP:	6:TFJPDGNZF1BmFErQBeyglqNZFvsFErvyglqNZFsFEr1JlqE3FErpKyGBk/y:TPUxIeJlYLTJlYHlpSKyGeq
MD5:	F0082F8B93998C20DFAE09D908FEEACC
SHA1:	4D667ED0366AC156C853852CAD0E8CFD8E8A56C8
SHA-256:	E065EEB1841342576E9310B55E6748A4DEE302BCEBB4EB12D7D7F43A5E843D8A
SHA-512:	E097BE83C46A5525941A9DF3206F1112FEA6F0CCD63D7E8DC3CFDB5CAAD8A4BAAC1017002E54A4BD2992ECA93701F153A9C4A8DAC7C43A91D948E865444B7B1D
Malicious:	false
Preview:	Search for NSR..if( strcmp(#12, "W") == 0 ){.. print("WATER REFERENCE");.. return;..}..if( strcmp(#12, "E") == 0 ){.. print("NON WATER REFECENCE");.. return;..}..if( strcmp(#12, "M") == 0 ){.. print("MANUAL");.. return;..}..if( strcmp(#6, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\STWPlausibility(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.691435688769648
Encrypted:	false
SSDEEP:	6:TFJPDGLLHoFErvIlqLLHo1AFErYhlqLLHd3FErpKyGBk/y:TPu/IlCCqlC9SKyGeq
MD5:	303D0D2F4C32C22534533881243D5267
SHA1:	A13171CC51C9350A9164A04BB81DB05561C4BDC9
SHA-256:	CCC23DE69153FDAF2E8E624193C3273ED32C1735B2B05C698518024B9C022A3F
SHA-512:	593BDD59B7286C1A41E036FA9C63A19BBAD74DCA76C920DEA271C318A5F3F8027E06051C8A17F87C3DD281A22D4B70E2E59D581BDE5F51F173191C911CD4DD4E
Malicious:	false
Preview:	Search for NSR..if( strcmp(#7, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#7, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#7, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\STWTransvers(VBW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.949310848764217
Encrypted:	false
SSDEEP:	6:TFQLR32g/p3FM6FErWq6MeOrSj2rFMg4FErWq6MeOrSjviPyMy:Ty2glF/7WFh27fEi
MD5:	43D922357AA1E841BAFFE7EAC7C3B85B
SHA1:	3492AF3DB18683C09F0593DC55B5173478E5511F
SHA-256:	2706E6405583564C001DE50314807E030FE92F9397661CA24A1273F826096913
SHA-512:	D486102B6F4C56D298DF511344968AC44512DF7C33B53F20D354F7C71FC23AEE75A72F9032D30C4686D5356FABDC842594458493029227F532E3A97AC7321A59
Malicious:	false
Preview:	Search for VBW..if (strcmp(#4,"A") !=0){...print( "Data invalid");...return;..}..if (double(#3) >=0 ){.. print( fmt("%2.1f",double(#3))) ;.. print(" knt SB");..}..if (double(#3) < 0 ){.. print( fmt("%2.1f",double(#3))) ;.. print(" knt PS");..}..trend(double(#3));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SecondDivision(DOR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLKfovn:TFGyn
MD5:	DCD024731D315ACF2429111647974FD3
SHA1:	EDB4FAE8971B8305B21B3F6C52FC009E2E40CE8E
SHA-256:	6930C0F5CEDF590B8B11A78DDD1F13BA5F73907F674C19302A3C92428CB36F4E
SHA-512:	205E4C1AE87AEE661E35FA0C83DA8DF864C5B81B0A35AAE5EE7D463D14FA44DC0E4ECF1E081D4ED1245C77F7B1F035580FC808DA8B97877429B650C5AEB77776
Malicious:	false
Preview:	Search for DOR..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SecondDivision(FIR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlKfovn:TFLZ0yn
MD5:	153BE4B716EF953E78A1A2FB9E68A2BF
SHA1:	444815C287BA6A4CBA6A4051100720AB3A511742
SHA-256:	ECDBE6942C3D434A9FC62DCA2E2EDBF39367C9E4FAEBBF5540C615BC131E15E8
SHA-512:	7D999C101700C0E518A2BBADFC5AF004B8AEEFC76F7EEE4BA4D41A6CB7AA953A31A9F4CCB0251A8F63AF29DF5C88C709FFED7EE9830403CE9316ECFBB170C303
Malicious:	false
Preview:	Search for FIR..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SecondLocation(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRKfovn:TFfc0yn
MD5:	6291E0C418465725AA8DC0596F72D89D
SHA1:	3C25D40E1469C1D09A5447F336A6708FF1A3F3D6
SHA-256:	4DDEC872E951445E2C3F4A6AC01DECDC065717BB52B31BAEFDBA28B1E497BEC3
SHA-512:	92E709D888AAE0DFB747CBBF77FC3E8F90672EBDE40522590C5BA6D2B8079C9DF806228AF59AB5659A75315576E6F759AB072F0ED47B5ECCF5BA3F678D686060
Malicious:	false
Preview:	Search for WAT..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SelectedSteeringMode(HTC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.806183542158471
Encrypted:	false
SSDEEP:	6:TFkQFErjjsGFEr53shFErhKms1FErpmsjFEr6BwHW:T6/svsSsimszi2
MD5:	32A1DC8B3652E59ADD74501D5A8B64A5
SHA1:	91A0DE499177B94B410B3EECF47B05FE9274F2A0
SHA-256:	05F653DBCF9ED799116AED812386656207D7941AD30FB453248A27CC7DF30FEA
SHA-512:	961CA9FFB5DBA87661BBE6B94CD5BD0EB77A3C39015D025AD93D6E9CDADC3C23905BAAA70C0CE021ED15D055ED7640477F093D77FA0AE716ED9BE8BA233B1A1B
Malicious:	false
Preview:	Search for HTC..if (strcmp(#5,"M")==0){.. print( "Manual");..}..if (strcmp(#5,"S")==0){.. print( "Stand-Alone");..}..if (strcmp(#5,"H")==0){.. print( "Heading");..}..if (strcmp(#5,"T")==0){.. print( "Track");..}..if (strcmp(#5,"R")==0){.. print( "Rudder");..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SelectedSteeringMode(HTD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.806183542158471
Encrypted:	false
SSDEEP:	6:TFtMsQFErjjsGFEr53shFErhKms1FErpmsjFEr6BwHW:TT/svsSsimszi2
MD5:	2AB5032736D63DAB0B66B76D0A16E8CB
SHA1:	8CC8734D81A410A45B2980D5EDCBCE2A67C809B8
SHA-256:	EB57C7FCF5C6B65246203EEED07EFD504945D8E82A7755614943F283FA9C3896
SHA-512:	C60F5DCE92723A6BA593E3D62029740274404D4EEC695E3BC93F044E8423F6E4EE431578F455DDCE4952589488841ADAE37A95B27F2654869A06A1FE17CE4B8D
Malicious:	false
Preview:	Search for HTD..if (strcmp(#5,"M")==0){.. print( "Manual");..}..if (strcmp(#5,"S")==0){.. print( "Stand-Alone");..}..if (strcmp(#5,"H")==0){.. print( "Heading");..}..if (strcmp(#5,"T")==0){.. print( "Track");..}..if (strcmp(#5,"R")==0){.. print( "Rudder");..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Sentence number(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.465311532225101
Encrypted:	false
SSDEEP:	3:5NFDiLPJK2fyn:TFyJxfyn
MD5:	BEEC164D879B76B8CEF36CF65E5BD193
SHA1:	31147658B8AABF30E8116B4A75D88C4135E1A733
SHA-256:	89A2A2D05574C50E23C202297EF8F324C67CE3D797E1A85DEA66FAA1BF0BA16C
SHA-512:	1452122D38BB9D21A696D513CE1D01125DFB31A1B96098C0C84C89F68F74AA74A3E65D7813172F9C60EBB08922FC86E9B70D6C090A0AA461FEF4D5F74B9BB851
Malicious:	false
Preview:	Search for ALC..print(#3, " of ", #2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Sentence number(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.465311532225101
Encrypted:	false
SSDEEP:	3:5NFDnLPJK2fyn:TF77Jxfyn
MD5:	8E1B99A19EFCD62F7EB311B674E77503
SHA1:	EF31D30BB09E3D5C59655FD12C8BA30B57E7C16F
SHA-256:	8C275429A39FA842B1011EF688D1A9CF64D1B176B57A5BD2F30273E3C2AC1780
SHA-512:	4236CDAA60778D18B833774A0E56F3C9880A3C0D6BD32B502F9CBDF587CF0117C6DAD12B990025E629A560FE0F7118F4C0FFDBBAC111FAD00494B40E02D4FDB5
Malicious:	false
Preview:	Search for ALF..print(#3, " of ", #2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SentenceNumber(VDM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.465311532225101
Encrypted:	false
SSDEEP:	3:5NFDqPXMlPJK2fyn:TFeXgJxfyn
MD5:	311CF8DF24955815B91CD1393F535F79
SHA1:	931F4E48C02352D819E96762301180AEA5DEABCE
SHA-256:	6FC07E0BCE5A643DE730468BBEE08A4786D4AA4FFCEE8AF6BEFF553A878FE03D
SHA-512:	BCAD90CE973F2D4C2D22A82B01CC8120D1F28113E696796512411D09613211A2443B2634DFADA668E07538F32E3594965FFD06653DF42CDEEE4DCD50C1AF0A48
Malicious:	false
Preview:	Search for VDM..print(#3, " of ", #2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SentenceNumber(VDO).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.465311532225101
Encrypted:	false
SSDEEP:	3:5NFDqcPJK2fyn:TF9Jxfyn
MD5:	3DA47AE3CC1B63DBB0E5F9350F8784BF
SHA1:	76416146643BB0CF86AEFC8B16E2B4E54587DBCB
SHA-256:	6DC4CF4218FB43B8AB9A84D0B76AAA04BB46B5F543269D4E82FDC9DCF70DC935
SHA-512:	7B3C2AEFFC0E1565C0B2AE29CA376A87A59A907065F14B9BA7A8F5722D00459A4FA99277BE4F063D0F2500732745EBA849A13D3F1220980E4E0C00E5144DFAD3
Malicious:	false
Preview:	Search for VDO..print(#3, " of ", #2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SequentialMessage(ALC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDiLIK:TFY
MD5:	9CB7C3DF11E3C07CE792D7CD9698DB1B
SHA1:	AF6267D61A07420348B8EAA6F6485A6F83FA7B43
SHA-256:	8470802DD4CC21ABA24100A2EBF6BB7C5E5EF1F3A86AA29E5FD440B7DFD52D60
SHA-512:	49E9E762B70CDC137DA4BA16E28CBF2459A55C3DA5AC8CA50C1F3891D5193B99028F620477EF1CC3BFF3780ED54666DCE7FCB86E11CC8BC1A5183B632EA23AFD
Malicious:	false
Preview:	Search for ALC..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SequentialMessage(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLIK:TF7R
MD5:	EB99A7F3B37578E7415C92E9BD17EBDA
SHA1:	8E3FCD81FAE1A843490899E10FA2D5B046FD22EA
SHA-256:	F08D607372A08BACE7F7F8109F50E2DE63C57642120249DD10554F9841CB453A
SHA-512:	7EB56E2F8CCF7D5BFFE779AD0C7B9F3C81C37F4CC40BA4FEFD736AE54298F334CB69305F790ADF70C233B9D62A0026279B89B4BE1D87C0D3F856E173C4E42E6D
Malicious:	false
Preview:	Search for ALF..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SequentialMessage(VDM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqPXMlIK:TFeXK
MD5:	106F6AF804F815B13FC1EDDCC7105C18
SHA1:	5BB342EBD10D48BECCECFAE3E9C784F73E930DA6
SHA-256:	9BFEC9C5321E993AA678460F6C390A2C327A76251DB924A62F91D2DD41407D51
SHA-512:	4083EF6198B813D263E6CDE4D9B0198FF595AEDCCAA5449B745EC4DAEBAFA78F3A49903C435D313CC1C878A7F498CC807A2BD1FEF0F731E1001F28EC58B84663
Malicious:	false
Preview:	Search for VDM..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SequentialMessage(VDO).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqcIK:TFf
MD5:	3F300171A267CC1409DC682342E080C9
SHA1:	5FB50EFF809496DA8E79183E7EF88D0F5A65D0A5
SHA-256:	9BAA017CD4543ECD5703D5897E949DD4E0F2BB6534A965A4D0D66F78A1002EC3
SHA-512:	8C9E69B069820D213EEFCDBC07388D39C07103BD38E89B5B5E914BB6B03D25A42282D5A701C7E0270AABCDA0ED47DD9B676251AB0525665696EEC9A40C27C394
Malicious:	false
Preview:	Search for VDO..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Speed(RMC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	594
Entropy (8bit):	4.8312639140233395
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloAYRlo5YRGtqmYIf8Bloololc6GZ:Z925tjyVRy2RNI0Byoylc6i
MD5:	FA41B00F6D1F8D9286BC72DEF5F2F28B
SHA1:	AA8C347E287153E8C1D8EE47766B1FA01EBE2A88
SHA-256:	84EE43A66BC7208FB0A06C535407CC492E141E57B325C869F899F5089FE152B7
SHA-512:	1DC69BD27BD88C023A197320B4243A5D1E4EE6EB590D5A92AA740E55D31C8060CFA7B50A05ECC35A669A583EFB8003BFDE36C78BAE944D2F4AA25040A95546D9
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){...print( #8," knt");...trend(double( #8));.. return;..}..if (strcmp(#13,"D")==0){...print( #8," knt");...trend(double( #8));.. return;..}..print( "!");...print( #8," knt");...trend(double( #8));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\State(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLEK:TF79
MD5:	9976EE3E20704DD69F942997FE05C470
SHA1:	723E846ADADA1CC7B0D24FE96CE970ABAB562D34
SHA-256:	8F1335A61072B2C426A4990EE39B1AFDCD56875D980A1270ADC898BC84260301
SHA-512:	7EFE1E24ADF7BDE14068E56731F9097F2D82620BCCD54DACB5728D4E808126DAC2CD1F9200BE11C59B36748DD7473740D2A2E95657E363A26EF12A2EE1E0691E
Malicious:	false
Preview:	Search for ALF..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\StationID(GGA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDWkov4NQKn:TFXogdn
MD5:	DFA5A32BCB6104366D1A27C0BA4615C5
SHA1:	B1EC35FDEF5B30D7F8DF219D3FAA0E6CA67972A6
SHA-256:	908B5C6BACD5839305A8ED38504286F3860D53A334DC670F8C2D7532CBF5B542
SHA-512:	2B85AAB7558EEF5E89D93EFC3A9A7C164BB2DBBCC7CB7CB66C36C5594BDC3E417874E2379023FB8F3FDC87AC1ABB9F3A33FBC8DCC32959915CA5FF159CBF39D8
Malicious:	false
Preview:	Search for GGA..print(#15);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\StationID(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDf2plNWfy:TFbYqy
MD5:	8C1A5A9E9F42D951B259BE2A08DC8A74
SHA1:	CDF3E78ACFA578CA6FB5DC61818B70B3B18DC992
SHA-256:	ED5D5931D4509F2FFD5497FE5EF5FB560C9D6B4F12F863F22AE2DA4BCD263D0B
SHA-512:	9C4EA0C975179D17A3D8293678C996E92FF46ECBD28B07DEFD124DE6FB99FEFCD73A89B493769F2121FD95BD30BAB0E76278B6904100EDE80E1659FB20FC4BB1
Malicious:	false
Preview:	Search for GNS..print(#13);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Status(DOR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLEK:TFh
MD5:	7AEE1F49FF9CD9CFC3813827D5686343
SHA1:	75330E372345037B5B280E029775D0B8E333C0D9
SHA-256:	F9E3D63084FFDF00A2B73944D3F3169FBD050E344E5258E7E0A8DC9C2F510F20
SHA-512:	5947F7325551EC499BF4524F7697AE9AC348005B80EC013DC30899D4B77F3277A9FD20EAF2F194ADBB58972A3C4557E15CD336DEBF79E1843761F6EE97994FBB
Malicious:	false
Preview:	Search for DOR..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Status(HBT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD9XKRPMf:TFZgK
MD5:	E95C5993F098E886BD6C41E43A693F2A
SHA1:	4AA814B4535550101591080384619CBF80B00B8B
SHA-256:	ED1FAD38356DC3708A188DD03BE161B4137A59F92ABBEDEC40BE8E9B6E1E6F1F
SHA-512:	9E45CF10AC8DFE603BDD90DDA30F41C935EF1F24CCA5A70B81EC37BEEB07471BF7CF01AA9FA581666546DC0070C17852181D915BDA868914F93BB9CD7EA0805A
Malicious:	false
Preview:	Search for HBT..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Status(HRM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.916832398504472
Encrypted:	false
SSDEEP:	3:5NFDiX9KdY7vFuLrVJJSiYgaQ9KwVKXMLrVWEBiYg3sLrX9fLy:TFpYryrVqi3oKrVWEBi33qrBe
MD5:	9383C4474395637C879AC50FDFB42160
SHA1:	D184B1A8926F6764190D97D01644998907ABB5ED
SHA-256:	2470E62B8A609575A955AC7D404C265AAC73830A2BA469CB611DC4D280790683
SHA-512:	1DA884932ED46FB6E25A7F597F1BA00547CDC8FD388962809ABEC991407C43B3001B9812CB827F3B9723B461D15560B099D75D3BAD7AE73690CE5AE50E8D6DD6
Malicious:	false
Preview:	Search for HRM..if (strcmp(#6,"A")==0) {.. print( "Data Valid");..}..else if (strcmp(#6,"V")==0){.. print( "Data Invalid");..}..else {.. print( "Unknown");..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SternTransvSOG(VBW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.926593677728287
Encrypted:	false
SSDEEP:	6:TFQSkXLR32g/p3FOmhIOFErWq6Om8rSj2rFOmjAFErWq6Om8rSjviPwmK:Tml2glFO9EW/FOKuWcEwT
MD5:	85BC2149799AFA3B2385521B3552C44D
SHA1:	DBB19E140D682C1614EF65B220D1A6327DD538FB
SHA-256:	5C66CC331BE38A2C573AF61BA0F5CF87EC8270385B2E315A3191AE2218608B68
SHA-512:	56773DF5B4E4DE02F0E3A34C7A06AE26550D76F8A99EFC31376057ECB1636394783D1718AA1C8B146B721BFE9F8E0CF64EE8C0C1AF1BFBF1FE08FB2519A75BD5
Malicious:	false
Preview:	Search for VBW..if (strcmp(#11,"A") !=0){...print( "Data invalid");...return;..}..if (double(#10) >=0 ){.. print( fmt("%2.1f",double(#10))) ;.. print(" knt SB");..}..if (double(#10) < 0 ){.. print( fmt("%2.1f",double(#10))) ;.. print(" knt PS");..}..trend(double(#10));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SternTransvSTW(VBW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.949310848764217
Encrypted:	false
SSDEEP:	6:TFYSLR32g/p3Fs64FErWq6s8rSj2rFsUFErWq6s8rSjviPSK:Tuu2glFsVkEFsCkBESK
MD5:	5A81B150E09A0F9F93F3A4DEB6DB92BD
SHA1:	175364DA54063685E292EDC910723E41649C1835
SHA-256:	5EF8606077590791B4FCDDC4A302D8D9810B9BD23DED5EACA67A8A8F733DD19B
SHA-512:	1C06CCD27BF59FC69E19535F01EFC78B4C53DC54121389CC481AA033E275AB8AEC36AB367699BD08CDAF991DABCCC7E00D195D34FD1AE6A774C858ADAF6D9CCE
Malicious:	false
Preview:	Search for VBW..if (strcmp(#9,"A") !=0){...print( "Data invalid");...return;..}..if (double(#8) >=0 ){.. print( fmt("%2.1f",double(#8))) ;.. print(" knt SB");..}..if (double(#8) < 0 ){.. print( fmt("%2.1f",double(#8))) ;.. print(" knt PS");..}..trend(double(#8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SubSystemIndicator(ALA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6IK:TFO
MD5:	9982D3476BA740B1E79F71D354F83DFE
SHA1:	BF7D761844B4847B22B2ADCADC5A20C4FB5A1A9B
SHA-256:	68DDA0C77DB9134AAA8FA8BCDB40EA52A755E422A272AAFE39970A037BA81899
SHA-512:	A50896B7AAAD236198639C0E39DF3D3C18BD93C9D09E4F56B254471375EDDCE14050472CBB5B6768643E30AD068CDAD5B05B380EB0C93E9C3444E988760CD122
Malicious:	false
Preview:	Search for ALA..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SubTelegraphAnswer(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.796709424428437
Encrypted:	false
SSDEEP:	6:TFUJVHqXlqJlsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TOElilsAPlsKeEUhlsj4K7qgE
MD5:	0B0334E19C27A5058CA4696C373603C5
SHA1:	E7B44214BE0A1C4433A9D50C98129FFAF45D1429
SHA-256:	A8BF5E7C2B9D9CB4330F8CFF3DA6DE3135A6E5417CCFDAE8CE9D9EFFB6588A37
SHA-512:	C39C7B055990B9167FE62CD862FBDBA447FF25B158D346CE043EF601D8426EA17F4651FC9F2A14676A6A7A7B7B31EF68332A0BE53C2390C08D26EEA126578398
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SubTelegraphAnswerPS(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.804764599629013
Encrypted:	false
SSDEEP:	6:TFUJXHEEClqJlsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TmkEClilsAPlsKeEUhlsj4K7qgE
MD5:	642F5F9D503FC5674D17A60D6C8F4F16
SHA1:	368EB9DCD9BAEE628A3378DF165D2240ACB98C06
SHA-256:	19CE82AB8217AA350FD6F0FF6E3898EBBB1CF1FFD5BAF3F1D04207C64CD5D5CF
SHA-512:	EA94407BF291FAD2201E97DB62595903CDA6E22075B47B8057D40E888C430D57A6A90F8A5319D7779EE9D838CB31175B36DDEE586B3BBE9EADBF571AD5802C2E
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SubTelegraphAnswerSB(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.811134026380605
Encrypted:	false
SSDEEP:	6:TFUJLlqJlsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TKlilsAPlsKeEUhlsj4K7qgE
MD5:	E7781A5164D29E882DAF04DC07B819BF
SHA1:	3478FC4D51CC905411A0D8D4A4586012800A5277
SHA-256:	199BED5349856E4E8CFBA77D53C88B6BF37DEAF8610FAF5D606E99AC9BC03C94
SHA-512:	ABABA3C51B51E940CF01A04C33A39AC6F637856D5C06C7AB4BC75E8709DF37159FF2FD203743072B9B0A3334654F0546879C04CE1D663EB0DB3C172C84F80A4A
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SubTelegraphOrder(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.80307885118003
Encrypted:	false
SSDEEP:	6:TFUJVHqXlqaClsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TOElZClsAPlsKeEUhlsj4K7qgE
MD5:	9A49C5363B3F147F5CA5D397FB2AAA1C
SHA1:	DDE4105F41E0F57BC8FC6CCC8621B1342F9EAED9
SHA-256:	5F95A7F3FB33CDC23D9E4F5A296CED223BD5CE65A7F0E4D92820777874E6ACE4
SHA-512:	4CA5C341EC0C440E7E1630069C50B6163C7FD99F769E919EEBC69A8EDF27531116692F879DDBA982B2F2C2A4F6FC4CA1920AAC2001D0AFE52A4C6581673E1FE1
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SubTelegraphOrderPS(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.811134026380605
Encrypted:	false
SSDEEP:	6:TFUJXHEEClqaClsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TmkEClZClsAPlsKeEUhlsj4K7qgE
MD5:	0C622F398B7FC462BC237C62E7A47E6D
SHA1:	998126C4F016459F3641852B5F37FDCCF647A8F2
SHA-256:	AFF6FA8ACB4E7815654ACB4031BEC577489691C4FE4C8CF46A1371E5EB6D3B29
SHA-512:	B7B1B57C6911631BD3D5E757B82D82ECC6518F7C25B718684826E108F7BA4080F4D72B2EA302564FB30C5CF661D1CE0EF3F4E87B86782680EBBFBD3F34AEB415
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SubTelegraphOrderSB(ETL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.817503453132198
Encrypted:	false
SSDEEP:	6:TFUJLlqaClsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TKlZClsAPlsKeEUhlsj4K7qgE
MD5:	B6EF21247E9C10DFA344FE31BA228D1B
SHA1:	45B28D423810630D17A299AE08A9F2A007FD3E7D
SHA-256:	4FA769729185DA8D6385EC4726ECA7F5007854C3FD80A7C899630E24D108A960
SHA-512:	F75351F6A8E37E26F84F6BDAF48FF211D8D85D574270A115B75302BB27A626F1226DE1639B3C1473DFC5660EEA33C808BC9CC2089CC0C20D4161CF9E1739B61A
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SwitchSetting(DOR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLFMf:TFtK
MD5:	062FEB1C571A7332BC08415042F275FB
SHA1:	AF8AD4EAD43F3205E04D47823821DED5DC29990E
SHA-256:	83204B37378371B4D8633E1CECB21C4BD73C435650D98BA76FF3B962D041B01C
SHA-512:	CAACB1B55E1DB8C8A250BF8C8613B3C31A46B3F68E7E59AF17B772EEC54019149BF8B7B0B2E04B1CC9714291C4DE1A381CAE31FBB7497F626A26823380413B9F
Malicious:	false
Preview:	Search for DOR..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SystemIndicator(ALA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6PMf:TFUK
MD5:	E014B68BD9F230E5F1CD664E6F4AE950
SHA1:	479BCC713D8443B949BB1C264ECED98EBED95226
SHA-256:	9BF47AF00D28043F2F9F30C1A6DAA5DEF77F87F694A828FEB3D05F8DE0734064
SHA-512:	FF167C4369BFC390B759321ADDB6EC7B0B96BCE506EE4EFC8D5246FD724AD0A9FE8454F48FEB4EA7E59AC900425D61C6DD204A054921901A25EE2B12794F8217
Malicious:	false
Preview:	Search for ALA..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SystemType(FIR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlIK:TFLZj
MD5:	4FA0E6DBD6C83092E9E357AA1655AC38
SHA1:	AC4E86F67BB423A486ED92DEBDA1C427F9585AA9
SHA-256:	09C86C919F4F2218117710D555280EB0B4E920581F57A3A6273E3D069764A70E
SHA-512:	8FE18F3FC4135E494162D3EEB8840C6981709067A14E9AAE3B23AEB7E51E5B7BCA34DC3312C7CB2AB216EBF519CF42A43977E5DADEF7B2361E97AEFBA30F2C6F
Malicious:	false
Preview:	Search for FIR..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\SystemType(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRIK:TFfcj
MD5:	153B2B9B02A864DD4D86C6B54E52F5B7
SHA1:	DF94C228F0FF99E05F005B1D24648E29A7B41BA2
SHA-256:	7E92C542E0DD6396EDDB300578F50B64387B03C79BC0AE0F164379D759610C0F
SHA-512:	E8BE14938F26FBA21F4B86E4F7F2ED9D0B01F57D6DECE5503DEE407123293B1C1DAAC1519507D815EA47D3751A970F49425837FBB7DE09950B203DEAC7850155
Malicious:	false
Preview:	Search for WAT..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TelegraphDemand(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.905169351698
Encrypted:	false
SSDEEP:	6:TFCwxXlqFrV2g/IGjq0pxeZTHf5PYq4eqLR1MY+:TUwlk2ggGjVW/dYLZ+
MD5:	0B6EB7BF695BBD06EFF4874EEE463599
SHA1:	78847119463DFB851E9394F01437759FBF1E9B97
SHA-256:	BB923AB81B9A95FD216613DD31E15A6C897EB3B3FB0C7C4555610603EDCCD97A
SHA-512:	891FA578BC6851F2CFE81CE8F8DB7718D3336802ED91E8A088630CBDC0D928743B11165599C77B72EA4576119C8E509953251DB37D9D73F40F4642AA07F50BFD
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. print( "Data invalid");.. return;..}..print( fmt("%4.1f",double(#2))); ..print ("%");..trend(double( #2 ));..if (double(#2) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TelegraphDemandPS(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.905169351698
Encrypted:	false
SSDEEP:	6:TFCjClqFrV2g/IGjq0pxeZTHf5PYq4eqLR1MY+:TUjClk2ggGjVW/dYLZ+
MD5:	A8E34DFBBCBC0348865279E4E1A659FC
SHA1:	9D01AA19F6D08540E6AA23D6010949604B9B58DF
SHA-256:	64C4D4C12800B710AD1AF52A215DD759A257490914E85284C8E2F6FC301CFF3A
SHA-512:	E85E1BAE64DD0F0902F32DCC21A93A6F8015FCC2F263A250BFA122F4EBCC242D684EEF67175464A3952022FC7B99CDE56F4A255B295EBCF83111F2A977966E6F
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. print( "Data invalid");.. return;..}..print( fmt("%4.1f",double(#2))); ..print ("%");..trend(double( #2 ));..if (double(#2) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TelegraphDemandSB(PRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.90974697117534
Encrypted:	false
SSDEEP:	6:TFC5lqFrV2g/IGjq0pxeZTHf5PYq4eqLR1MY+:TU5lk2ggGjVW/dYLZ+
MD5:	507B4F77086B1C66594A122C2FA9A615
SHA1:	A02B83F06CB01673A464482FA59B8DD7FEDD18AE
SHA-256:	B413A64A383DF97962916B8D87CA28F6830BD9F029BB9DA6802CE6D709B00A0B
SHA-512:	D85E57E73F730579C9493F5A6FD9ED0C371918A2C0D419783288EA49BB31EDD359ECEE806316BDFC650037F3DEB2D958EB72EFC43966613C0548CFDE72F98200
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. print( "Data invalid");.. return;..}..print( fmt("%4.1f",double(#2))); ..print ("%");..trend(double( #2 ));..if (double(#2) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Text(ALA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6FMf:TFeK
MD5:	DAF2BEB67F4121F51E890D9979FA2179
SHA1:	CD4BBA849DE3ECD537D3DF560F422BCEF08F3329
SHA-256:	55F389FD218D71EFF9BAAF45EB771411C55424E4E9322E8B5F783BE5763C9992
SHA-512:	A410D094141B292822955C6B4E4190778726EC9CC540F17808F2FB3F4038E2FBB85F1C359A438771FB4184F7DC9AAFB57DCB8498D7BE360D672CC64B82A89974
Malicious:	false
Preview:	Search for ALA..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Text(ALF).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDnLNRMeyn:TF75Rfyn
MD5:	965237C363756B49BC20C985615F4425
SHA1:	35DA31333BF9F73F40892F97455E0FA334D03341
SHA-256:	E843FF7436F5F339928D0C2F1ACC667EEF8426A6A89AB9516BBB77098FAAA819
SHA-512:	48F00AD7615B940CDA2E82B42A1B16583129B4072A6F41FA721BF16160F4F1B07F16DAE1B4443BF4715F968C76E9C2FD344D81A68A6DE052C98EF166FFC9380A
Malicious:	false
Preview:	Search for ALF..print(#14);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Text(ALR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDzLKfovn:TFvyyn
MD5:	A6D29947E6D1CCD1A80D7B498DEC57BD
SHA1:	6A4732289382E2D3ECCC008C9143382DE9DA07B0
SHA-256:	EB697D5E0B8899152BFB76B218ED20B7CE82E2FC4B3B726568FA1CB12B57522A
SHA-512:	73B7131ACC17CDE1413F4F31DC501BA03A38F0BA7574976FE67F4559FDE6BB1783D468E29769E9A8BCA8460F48DFFF0D6F3CEE877B3A518A2B1D4A670E3BAFB6
Malicious:	false
Preview:	Search for ALR..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Text(DOR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDLNVM3v:TFlVAv
MD5:	8F3A409F27D0EBDB6121DE1190AA2A0A
SHA1:	2F9031550CF93A7E318899919C018840E178EC39
SHA-256:	10054F2F458EC23770F85238708D0137AFA553E5B1853935559C12A27D81768F
SHA-512:	62EA7E67E5A7B0405730396E2EB757A752660AC65B5B3BB604CE01091059A6C49402AA05D4971F794A6A17D427DE95CA278AAD4E94AC96F716D07FDF96613448
Malicious:	false
Preview:	Search for DOR..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Text(FIR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFD3QMlNVM3v:TFLZTVAv
MD5:	852A3F8597B0F63B366EDAD6C1296769
SHA1:	E3F0BFF85CECD26D4A661DF26278B676E5065721
SHA-256:	D4627E9E620E008682365F9D797BE677C70B3588D28F30ADD2341657D96D68A3
SHA-512:	3C862EF24BD158B3478C38963D8297C0925C2006F47E76499B267E34BABB66BEAF470CC783358354C0F22ACE886AAEE13677D00F5C51B0B01FE83229A73E13F8
Malicious:	false
Preview:	Search for FIR..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Text(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRNVM3v:TFfcTVAv
MD5:	1091EAD6B82E5FD88C464BBD61CF97C4
SHA1:	222DE85BC4C17C273B19605376198918743FFFEF
SHA-256:	4EEBE6BF27E678E4CCBC42F4FDA2051BEB2E461AC98AF469B765C7A3C8F617B6
SHA-512:	ED33010C64A2152C865FA8867689F3917D5C3869C6F1E76628CAFCBBFAA17FE2ED034AC35D8CC25259830C2262C88A0C871FFE8E30C709D04DC3B06BC0565D5A
Malicious:	false
Preview:	Search for WAT..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ThrusterNumber(TRC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.705744211903336
Encrypted:	false
SSDEEP:	3:5NFDFDmX9OJea4FFErQJF6+3Af6X9OJ0YdFFEro4HM3vg+3AGXKd9fy:TFrtIFErQJF6lF0YHFEroXYGMy
MD5:	592C445498BE858292019E01B1EFEEB5
SHA1:	026393944C0C5698E62C2B454D7DDFF778DB5DE5
SHA-256:	CFA5E8FDFC58649D89E252ABDABE22404F86D5B5C05C01B1B9070F12B3A94F11
SHA-512:	7BEB281F511CF59539B0B856FA56D628068A83E6774C69076240EEA3CE837215B24181F152BFF87E131D9E00C823FD238AC1751AF96F2403070363DAA48070C2
Malicious:	false
Preview:	Search for TRC..if (strcmp(#2,"1") == 0){.. print( "BOW");.. return;..}..if (strcmp(#2,"2") == 0){.. print( "STERN");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\ThrusterNumber(TRD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.705744211903336
Encrypted:	false
SSDEEP:	3:5NFDvX9OJea4FFErQJF6+3Af6X9OJ0YdFFEro4HM3vg+3AGXKd9fy:TFqtIFErQJF6lF0YHFEroXYGMy
MD5:	2715FF2911BA3A29D21249D405C0E5DB
SHA1:	590F19DA5DBBB40241C612206FB99702C7E1939B
SHA-256:	BBF9BA7EEB2C08053285249143E42358FD08B009EE95B808ECA6D05DAAE356D6
SHA-512:	8F874F1C34286A399C11E9707591AE9A8C2254FDBB731E25320BE07365A99EABFE7A4ACF8DFB478E5FB94FBB6C09E47E60883B3851E35A57B2106F1FEB8F41B3
Malicious:	false
Preview:	Search for TRD..if (strcmp(#2,"1") == 0){.. print( "BOW");.. return;..}..if (strcmp(#2,"2") == 0){.. print( "STERN");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Time(ACM).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulOK:TFR
MD5:	7D94B9C5EA25EC1CB6C4862EC031EC88
SHA1:	98A56F51EEC86E6E3AF0E5FAC1415248B58F93B7
SHA-256:	6BFF98AFFF0A207E9EECD61BAFA34F34A613D16355B939C6FD28402F952929C1
SHA-512:	EF0620E31EB2BD9785704964180149200C1B1973F6BA8DA6254721CEBF1B89024BE6320A58AF777B93D5E4B87A7B6EBCDADD3AA62BCDBC8E607AA343A1AE2937
Malicious:	false
Preview:	Search for ACM..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\Time(ACN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6OK:TFN8
MD5:	FCE46D2B885C1E263E7D8E838956812E
SHA1:	4EBF47ADFEB4151CE0DA698C2A112B2AAD8B2812
SHA-256:	941809195BB7AF5D78937CB4FDB05EA0C4700A78F508A9639FF8456A800CBA01
SHA-512:	7B93C087551A23FE8DDAC0A170B45796FFA0684EACFC71159CFD92D2ECC1754A22BA65C4CDBC9365623B34B88C8A26B6F5A57B71403DC361FF047C9DB113B143
Malicious:	false
Preview:	Search for ACN..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TimeIntegrity(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.807867658033499
Encrypted:	false
SSDEEP:	6:TFJPDGN51FmFErUd6lqNnmFEra6lqNt1FmFErzzIlqNti3FErpKyGBk/y:TPU5PuIlYn3lYtPZElYtiSKyGeq
MD5:	B4A8BE95942B1B265F754B6476BF004C
SHA1:	35B5BFB03E9DBFB446A35280AE4882EC21FA1C1E
SHA-256:	3DC66CB6BA3EA3C4931860BD6BA09B6B3B2828F60E0C496AB4055A7059BCA289
SHA-512:	FA0CCE4F924B4A5AE4DB4C6D0D6EA8AD786A4CD5329BC03A0CF50D9395E196B77398ECC373D59C7A7A6B7A112841110510942CBE6DF3AA191A7A383395178860
Malicious:	false
Preview:	Search for NSR..if( strcmp(#13, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#13, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#13, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#13, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TimePlausibility(NSR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.729821516759323
Encrypted:	false
SSDEEP:	6:TFJPDGNv9OVFErvIlqNv9YF1AFErYhlqNv9d3FErpKyGBk/y:TPUv9OEIlYv9iqlYv9dSKyGeq
MD5:	280B6AF1185F7B8B63C0ECE4DC27DCC5
SHA1:	F751FCDFB4D18B805590A04C4CD895F40C0A6D14
SHA-256:	F5FB506983D2B5E2E429812CF07ACB541C0D106548AFE19DED29E907869D48C1
SHA-512:	8DDE452FE3E6F32F0077477B6556F4D2CE80E9612718A137764F0941EFA1F3F9A04A679038545E6C35E0B8B6ECDF37338310A3EA8CF53AD57E523B6944C19426
Malicious:	false
Preview:	Search for NSR..if( strcmp(#14, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#14, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#14, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TimeStamp(GEN).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	4.650073120857778
Encrypted:	false
SSDEEP:	3:5NFDUq6oREWbaIF/HijUWZhJFHXjUWfAfov:TFd2WbpF/HijUWZhJFHXjUWfdv
MD5:	E1C8B31DC814B8417E03327B267B78AB
SHA1:	1729AC087E35A8AD1B9A36D3A1313CBF8D0B6160
SHA-256:	D38DCFDBABA423DEC7FB95E044D72379B2DAC1755CEFFF729D80BD37FE9985B1
SHA-512:	344F64E6695143268D216C8467DBB690D84D9614EAA59C49107F3A3DFA122E73240F8F65168C70394C4CDCADC8C02BA5442371C00B668B6141AE5E784F041A9F
Malicious:	false
Preview:	Search for GEN..print(substr(#3,0,1), ":", substr(#3,2,3), ";", substr(#3,4,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TimeStamp(WAT).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.667598710630501
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRH2XUWbaIHwQwUWZhJHfHYQwUWfAfov:TFfc+UWbpHwjUWZhJHfHYjUWfdv
MD5:	B31884CF90E9155D19E84B74595827C0
SHA1:	5ED62284A45E9D7242D369509CA25DC81018F29F
SHA-256:	0C58A0BB916EA381666F33839C4267EE8EC4B53FB3BCD8CB6497E44894F0204F
SHA-512:	49E90D1BB40D467F9923C27A19AC20D7FDEABF8C8957D11FBF03624F665073EFB0BF6E7F4DEAD5A6222D87697022D51A153CF4126CD2A31BD252D5B791720AAE
Malicious:	false
Preview:	Search for WAT..print( substr(#3,0,1),":",substr(#3,2,3),":",substr(#3,4,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TotalGroundDistance(VLW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDi7FMLRKnfn:TFmVfn
MD5:	3B2BA0673BAB6674DE41AB3D2731903F
SHA1:	049A104E14502D3EAFC05224B7B535E0343890AB
SHA-256:	C23E826935E7ECB53AE95445F788305C50DE77C746D279A1C521D40759E85875
SHA-512:	EC89B57BF325726DF0C50307031B132D052BBD976B2DDF4132B1F638AD6AFEC056E441620D3C7A7CA71459665BA895015B62AF331E0EB594F98180E8117E152C
Malicious:	false
Preview:	Search for VLW..print(#6, "nm");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TotalWaterDistance(VLW).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDi7FMLROLrnfn:TFmtrnfn
MD5:	C1C3E489BDFCB595936BEE9F23E07AB9
SHA1:	4943D56DFF09417E7556F046B21D0DE5502C4233
SHA-256:	AD6AAE11EDDF445AF7D2BC6374D739BC5201920F22DBE7605E2A90CED19CF27F
SHA-512:	DDA5098873EB253144154B00F6BE89AA634174EF4186480C2E7427A082B729328ACFA11F5FCAE81988E1683A14436272B430C946864AECC740CBDD69A776250B
Malicious:	false
Preview:	Search for VLW..print(#2, "nm");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\TransducerNo(XDR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDz4JMey:TFHsfy
MD5:	BC9416D7232024B3BD181FA9850DE070
SHA1:	C4480DF352811AD113342F14C1A2DE8ED5B7F5DA
SHA-256:	226627ACB824A4598BA288EDE98E7BA3CE8D829BDE59467CF0406F1A790ABAA0
SHA-512:	6907865D6B415D42D77B5DC3A4B30F5D28B0A3C143D4B29727BEA87F49084A899C34AF140DD5750A88984FE060820DF198B337AB1D9CB2FD02415A2673DB778F
Malicious:	false
Preview:	Search for XDR..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\UTCDate(ZDA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.499227541723358
Encrypted:	false
SSDEEP:	3:5NFDmkplPJLCGZ3v:TFTJLFtv
MD5:	30169015BD79435EFB5472B352C1A643
SHA1:	AD5961DEE451BDE3711DE8EECC2F5D5B4BEC4018
SHA-256:	8697BEA61BDB37FB7187D2F630A84B7015028D652F01AA4AC4E628EACE730DF8
SHA-512:	E3D117FE0E106A7126C73F7FE5833FC3E2FDAE5066682B9C614C0D4B95C95D354C651A976428A2D99638B8A1C8703709A1FC587521846D90D9A9D8DD7FAFF914
Malicious:	false
Preview:	Search for ZDA..print(#3," ",#4," ",#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\UTCTime(GGA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.823382565856403
Encrypted:	false
SSDEEP:	24:cS2hUEUEUFy3UEUEUFYUEUEUF+pUEUEUFsUEUEUFQ+UEUEU/HhIoS6F:criEUEUFykEUEUFDEUEUF5EUEUFnEUEL
MD5:	1E2B0B5C9B045D48E0157B70A99520CE
SHA1:	A56B170163D810456FE82F8AEC6E058130136F30
SHA-256:	3C724229D3EA1AC5E5368BF402C793C216A87B3C1B5729E7DA4A285BB0EE99EF
SHA-512:	BAAAD857AE11B3C598F4548E034770995662DF78AD1938502F875B4406DFCA071D1A8CB4F2AF6F3254B8B9C5C24EDC5409C5B2F19C0682358AC590A545C2E7B8
Malicious:	false
Preview:	Search for GGA..if (strcmp(#7,"0")==0){.. print( "Data invalid");...return;..}..//if #7 = "1" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"1")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "2" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"2")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "3" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"3")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "4" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"4")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "5" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"5")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..print( "!" );..//print #2 1:2 ":" #2 3:2 ":" #2 5:2..print( substr(#2,0,

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\UTCTime(GLL).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.97019263177749
Encrypted:	false
SSDEEP:	3:5NFDdGvM6X9LJE3HFFErQireJ+3A01XK8afX9lGYfPGef4vuLRoRETt7wQwUT3lo:TFZ4RJYlFErQWY2Y8UX9cy+AiurRwjU2
MD5:	0EFE37AC4B0C82A7546AE47F8AB7AEEB
SHA1:	931F675C695AE4F4B0605CFDA09166D2A2F652AB
SHA-256:	B4E864C01FC97691D3265B620016CE8F7496FB8192915FDA5143D95360F07E5D
SHA-512:	B2859CD939F1BF3ABCC85D1840993FC0845D2E311E315ADE5C546F41DACAD1BB6E770650C6238EED3EEC058576144CD738577DF21ED4599EC60CD01EA1900AF6
Malicious:	false
Preview:	Search for GLL..if (strcmp(#7,"A")!=0){.. print( "GPS failed");.. return;..}..//Print #6 1:2 ":" #6 3:2 ":" #6 5:2..print(substr(#6,0,1),":",substr(#6,2,3),":",substr(#6,4,5));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\UTCTime(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1252
Entropy (8bit):	4.842878802818841
Encrypted:	false
SSDEEP:	24:Zu2suUEUEUFSUEUEUFqUEUEUF6UEUEUFyUEUEUFQ+UEUEUcHhaw6Z:JiEUEUF5EUEUFhEUEUFxEUEUFZEUEUFc
MD5:	BFEADA53FE747FCADD84927E46E9E775
SHA1:	964F8E04A96EBB4C9FDFEA5E6A94482EFC552408
SHA-256:	7136AA01BB2349F5289836E792741789AE71BAD599DDE9F3971AB49A79B0C7A4
SHA-512:	86610580D35636DF840A2976B10355707B540BBE89727AE468125B66AB4EDBABC7147746B821E0414FA62964ADE12F989617A7C3E199C312F9BE456C3CF544EB
Malicious:	false
Preview:	Search for GNS..if (strcmp(#7,"N")==0){.. print( "Data invalid");...return;..}..//if #7 = "A" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"A")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "D" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"D")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "P" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"P")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "R" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"R")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "F" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"F")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..print( "!" );..//print #2 1:2 ":" #2 3:2 ":" #2 5:2..print( substr(#2,0,

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\UTCTime(RMC).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	4.846183953911797
Encrypted:	false
SSDEEP:	12:Tp392ggljjjlolUCjUCjUFlowUCjUCjUFGtqHUCjUCjU0f8Bloololc6GZ:Z925tjylUEUEUFywUEUEUFtUEUEU00B5
MD5:	367334065DF2A8F7557657163167B21D
SHA1:	4147CBF561874E173E39B2EF6C69EDFA2C7F3958
SHA-256:	81FB55F1857E7877CBDB722267D9DC4C995E5DE3730C71FD498634BB2E50BB92
SHA-512:	311F3991E319712C120E5F901DDF89DF9A4DBD514D6B2686CECC467B28D9715D4DA751DE54F8E6E90C2AC00BA5A6B4255A4E955879AB906D40313252826E2200
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..if (strcmp(#13,"D")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..print( "!");..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\UTCTime(ZDA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.652894470837179
Encrypted:	false
SSDEEP:	3:5NFDmksclFL/lG49dG2LRH2XUXmMJwQwUXVfHYQwUXW:TFRFL/c4u2+UlwjUlfHYjUG
MD5:	2BCCACE120AD02E4628F72D6B54D3204
SHA1:	4D9DE5A38555F5A558799CBBDA0A0FF25D7A3A2A
SHA-256:	5F19B6A38311C0D1F3B21A3E2F83A3D859D5C14DB50068437BE43752EE3972FD
SHA-512:	E3D5C70C47E8C505954DFDD8C5CFD5B50157B2A44125E349A2FB0F061795A008E6C1862F09AC27AFE5789474ACC03F3A13CE4A54DF5F3BA08CD53427712A0AD0
Malicious:	false
Preview:	Search for ZDA..//print #2 1:2 ":" #2 3:2 ":" #2 5:2..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\UniqueNumber(ALR).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDzLPMf:TFv7K
MD5:	E12A2F5C0E84A3C995FAEAE318CA5462
SHA1:	EB1A76F1519E803BFF8552AE0A43F0154EBF9FF1
SHA-256:	F0F1B7D2132B715C5725F4DC21CB986CD769B8FC2325FFE67059F8EA1F71D169
SHA-512:	6E25ED61F33D9845D119F78AD4FC62F4DBE56B09AF57863DA5823B792A6639ED2F0D638314A2BCBA8FD011A60D6AD6E9D129A72A785720F615FB824C1545C142
Malicious:	false
Preview:	Search for ALR..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\UseSatellite(GGA).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDWkov4EK:TFXo0
MD5:	9144A00B8E011154BABD1F2F5F3E2CC7
SHA1:	BB00596141A253C22DAC710FE386FF7F64592BAB
SHA-256:	2F2E531D5B52600A1233F75B00671479F7E60D98D9D578D253FF07C71541F47F
SHA-512:	95A37F16933EE6C8B911453DE5573E22AFB3D549645CC45B0705458648539605F3A89C67F97B11F78F8F156F3F89C8426B45B4E8CF020C1EBCFB0D4B77D1CDF9
Malicious:	false
Preview:	Search for GGA..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\UseSatellite(GNS).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551767
Encrypted:	false
SSDEEP:	3:5NFDf2plEK:TFb8
MD5:	1F6CD70375F87FF3A350C92AE34D4FF0
SHA1:	43E2817BE54621E72E39252B8049741E290A9AC8
SHA-256:	D4817EFCF6988298DC58C4DBCA8E8649958412E71AEA2186F96C1D101BD9DD3C
SHA-512:	8B7ABAC7C2182415531F186EDC970A3752B8FEDB89E56E146702D8AC0AAECEE13EF9CA588E797FC1882DC3840A99900CF5C3F4E0D1D95672F6AE5B601AD7CF37
Malicious:	false
Preview:	Search for GNS..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\WindDirectionMagn(MWD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFDVNXK0/ZHBloFDy:TFbNRPYW
MD5:	93EB038726D9AC6C83B85412B6256DEB
SHA1:	D51BED1D681BF12BB1F6C99FB3C101EB963A00A8
SHA-256:	630DB7A0D42E4223DF7ED891B830766E93EFCEDFCCE61363A64E9949D5B056C1
SHA-512:	E86FDB8C52B34E876BF13F9D4C2A95D7B05C98BB16CFC06BAA7501990D4196CD28FADD8126657A2DCE2FEDA7474CA6F7C8B89593E71513095A63686C145A0904
Malicious:	false
Preview:	Search for MWD..print( #4,".");..trend(double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\WindDirectionRel(MWV).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	5.045714737535048
Encrypted:	false
SSDEEP:	3:5NFDjUZNWX9KdFyLR32g/pUAf6X9P5HM2+AGXKsfZHBloFifn:TFI4LR32g/p3q5HqlPYif
MD5:	AFF3559A01746013C2191B049B2366B8
SHA1:	488684B9A290DCEFADDF1F5E7B9A35E5B2AD4C2A
SHA-256:	A7DEA449A7F1831B57AFFCD868B042C77DF67CD980746ADFD9904EC595BED66C
SHA-512:	E5D6DAD586447EFBE7CEE7A9E6AF4C02DB46206A2A2D7A7BDC4EE0AFC3719AB7DC12B4722E0E6D4C2F926E04A1C47A465F602DF54C856E510F0D6B0E7AEF09CB
Malicious:	false
Preview:	Search for MWV..if (strcmp(#6,"A") !=0){...print( "Data invalid");...return;..}..if (strcmp(#3,"R") !=0){...return;..}..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\WindDirectionTrue(MWD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFDVNXKsfZHBloFifn:TFbVPYif
MD5:	7BA784A590B079A52A765FF68F8B86F5
SHA1:	93FE08FFE5C5835DBBE8399C4FAF6F7EFB2CCFC7
SHA-256:	F573F57FA6FEC193C21899BC44B3BDA9CC399874535E1B595DC034716C93E001
SHA-512:	F0491621750438C19FB2C21B852CD7F8BF2E41948F9CA64EBB2C863B40A30CD0C2E3162E36F540E629D0088E3BB5B32036F8A1A40E1092C85FA071137535E47A
Malicious:	false
Preview:	Search for MWD..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\WindDirectionTrue(MWV).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	5.045714737535048
Encrypted:	false
SSDEEP:	3:5NFDjUZNWX9KdFyLR32g/pUAf6X9P/Ht1+AGXKsfZHBloFifn:TFI4LR32g/p3q/HtclPYif
MD5:	ED7D3B7DA5B88EDF32992DAD50BBFFFB
SHA1:	2D7D393E234CBE13725BF681D28EB4879AEC1CE9
SHA-256:	A8DC01D6D35DEE41723DD228174A899CCE6DDFEF466BA80999A9D957DF7E59FC
SHA-512:	2F09B997EB5B5E5E42C80AFED8641F77335019B40AFCA7CD268C37F246AD72C1FF5351D1886C498AD7BBC9E07828B2CF395FF50223DB3B5F6E806A2085F0EEE7
Malicious:	false
Preview:	Search for MWV..if (strcmp(#6,"A") !=0){...print( "Data invalid");...return;..}..if (strcmp(#3,"T") !=0){...return;..}..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\WindSpeedKnt(MWD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.712993984287172
Encrypted:	false
SSDEEP:	3:5NFDVNXKSOlgvGHBloFWv:TFbXOfPYo
MD5:	8A2C9B039CDBFFE8AD9AB28EA521E3EC
SHA1:	F26BB27B63231742AD316AD9E7C3C98438FF2288
SHA-256:	AC61D0772173E6853DEE105BA02B6B42C91EB5A9A7A3BCC99A677F71ADB7C9FD
SHA-512:	5DB3CC9604B9586F81081A56C803EA4F10E211D6A1D33888BEABAEC438D4BD43A012E6B72796D579BE48079C63C21B92B9D8F7F7137136A94E358922A5EEFE1F
Malicious:	false
Preview:	Search for MWD..print( #6,"knt");..trend(double( #6));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\WindSpeedRel(MWV).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	436
Entropy (8bit):	4.773758506889757
Encrypted:	false
SSDEEP:	6:TF/VE1lFErV2g/Ilq5HzlFQGz5PYLs+FErh6lsQFErQlsHFErj6lsGFErvT6G7:T5Vv2gglukGJYLsGlsolsLls9mG7
MD5:	9F2F2434AAD7E8DF20D6B23A6486C01F
SHA1:	ADDD6F5DA83DA0021DCB93FA96E1EE5227301F64
SHA-256:	3874E202B057A89954250C4F8A29B48A6C83E2A2D200758162D09899E8DD7FB0
SHA-512:	5709B0B0C6B63DF25D67A0B63A6005237892AF569F0ECE3689A113D1593550D0FCB4B315AEDFF5DC465CDF0EA4F2A31F08125E6B43FCC70E7794FE57C51673A8
Malicious:	false
Preview:	Search for MWV....if (strcmp(#6,"A")!=0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"R")!=0){.. return;..}..print( #4);..trend(double( #4));..if (strcmp(#5,"K")==0){.. print( "Km/h");.. return;..}..if (strcmp(#5,"M")==0){.. print( "m/s");.. return;..}..if (strcmp(#5,"N")==0){.. print( "knt");.. return;..}..if (strcmp(#5,"S")==0){.. print("miles/h");.. return;..}..print( "Unknown unit");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\WindSpeedTheor(MWV).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	436
Entropy (8bit):	4.773758506889757
Encrypted:	false
SSDEEP:	6:TF/VE1lFErV2g/Ilq/HzlFQGz5PYLs+FErh6lsQFErQlsHFErj6lsGFErvT6G7:T5Vv2gglaEGJYLsGlsolsLls9mG7
MD5:	4A500E7EAD5CC1B71D81F02771140D4E
SHA1:	A10DECD19848CA94FC2443AEC3FE23F1FB5FFE17
SHA-256:	A4538F68FF01A2689271F79C472CEDCB07B24F8B7BCD9F67C3744BF095891D54
SHA-512:	EF247AFEF9E6E5189F0C0E6F52CC7E36131397335FA27052D46E8A24BCF53DE023FA500B4855EF6F4300A13D4596A59FD3F3680657C49B9DE3CCAC381B2A8EC8
Malicious:	false
Preview:	Search for MWV....if (strcmp(#6,"A")!=0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"T")!=0){.. return;..}..print( #4);..trend(double( #4));..if (strcmp(#5,"K")==0){.. print( "Km/h");.. return;..}..if (strcmp(#5,"M")==0){.. print( "m/s");.. return;..}..if (strcmp(#5,"N")==0){.. print( "knt");.. return;..}..if (strcmp(#5,"S")==0){.. print("miles/h");.. return;..}..print( "Unknown unit");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\WindSpeedms(MWD).txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.811382823650154
Encrypted:	false
SSDEEP:	3:5NFDVNXKnseCQHBloFcfn:TFb1SPYcf
MD5:	54D1E096C3D62A6CA3A191BCD140B7B8
SHA1:	158AA8B50D5EA7339890FB39DA6D31B11A573195
SHA-256:	48CD274A46DAA8EDE920889CD4FD04BE1789855BA1534DE433958A908D329211
SHA-512:	698D1D11801C825ECED2899E9E8F86595BE0ED3C08AD380642F8BBC253009054F65E2C39A7E4F55A831776D6F50A00EAA61C7EA661D248178F15E0C55751E841
Malicious:	false
Preview:	Search for MWD..print( #8,"m/s");..trend(double( #8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-08D2L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	123
Entropy (8bit):	5.054077384236297
Encrypted:	false
SSDEEP:	3:5NFD1dWX9PqCeLR32g/pUAGXKOJfKpovRQHBlgNpMfn:TFJs3eLR32g/pYvfKpoJSPIif
MD5:	11515FB148E97C90EEAF15E57471B18E
SHA1:	3369BC47ED0ABF75B6ECCDD3693F61275A7EAB39
SHA-256:	838BC3047172309AFCA3E8848E7F6A1384070DB849DE7349B400BEEBD8E94A43
SHA-512:	D6F6E7D178C281C3548EF75CE0C08934061BF96932D7D2F56E96943A83044F86B1CA1D8AC44F5B5B07268A9E3D7534F64DA629363BE13EC985DB24B9DA0AF160
Malicious:	false
Preview:	Search for ROT..if (strcmp(#3,"A")!= 0){...print( "Data invalid");...return;..}..print(#2,"./min");..trend(double (#2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-0C6HL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6OK:TFN8
MD5:	FCE46D2B885C1E263E7D8E838956812E
SHA1:	4EBF47ADFEB4151CE0DA698C2A112B2AAD8B2812
SHA-256:	941809195BB7AF5D78937CB4FDB05EA0C4700A78F508A9639FF8456A800CBA01
SHA-512:	7B93C087551A23FE8DDAC0A170B45796FFA0684EACFC71159CFD92D2ECC1754A22BA65C4CDBC9365623B34B88C8A26B6F5A57B71403DC361FF047C9DB113B143
Malicious:	false
Preview:	Search for ACN..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-0H8VU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.820695328857707
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/Il0XGjq0pxMeTTHf5PYJIMslFEraSHK:TPT2gglmGjVXv/dYJI5/0K
MD5:	00D0C1AA23541567F7D27A9C4694C5C0
SHA1:	62E0CC2DB021F8A854659287FB36A857F43B2F4D
SHA-256:	83E355D7F49A7FEFB1892709E44285151C7E7A022EA1CF2B94096ECE4A7AD7DA
SHA-512:	390351EBD5A01A1F6F34B57E4F8C3A89589721A671B539D95E143A544CF16F3BCB16F44AE8A67224127E200C691F739DC236BB4CC9B6898AF141490E3FE6044D
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) >= 0){.. print(" SB");.. return;..}.....print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-0K035.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulOK:TFR
MD5:	7D94B9C5EA25EC1CB6C4862EC031EC88
SHA1:	98A56F51EEC86E6E3AF0E5FAC1415248B58F93B7
SHA-256:	6BFF98AFFF0A207E9EECD61BAFA34F34A613D16355B939C6FD28402F952929C1
SHA-512:	EF0620E31EB2BD9785704964180149200C1B1973F6BA8DA6254721CEBF1B89024BE6320A58AF777B93D5E4B87A7B6EBCDADD3AA62BCDBC8E607AA343A1AE2937
Malicious:	false
Preview:	Search for ACM..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-0NKST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6JMey:TFdWfy
MD5:	1B4B2960306A45519E5E11852A869284
SHA1:	7AF8439C3D682570B1C4B79533A9B08CA2564046
SHA-256:	449EF17819C0B49A9532442197BE043D66D26CAE169F59FFBC4DCCAA5BFA55B1
SHA-512:	45D8D52B0A22D81E62C06558F8A80B76FD2560B3DB6B14D2669D3BFB7C4C8495737E53B4F483B93DE0CD3092F2FC0B1278CD82DF5C2A5E96131E89842F03E1B3
Malicious:	false
Preview:	Search for GEN..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-0SB5N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.773679354006836
Encrypted:	false
SSDEEP:	6:TFJPDwkcrV2g/I94MFEr+1F4CFErNPUwPmW:TXwX2gg9461F47VmW
MD5:	EC6177B83046D6EFB48F26746C652833
SHA1:	F2ACFF365D80311FD2B528B65822498995D5676E
SHA-256:	890EF13CC022F2BC4A42EFD68FA8CEF8DFEB242F9AEDF19629E44D78FBB868B9
SHA-512:	A50FF6CC380C8FDD5AC3916924F85A93EF909CD0907B9434B8B255F71CAC297B62F79BD86C5BEEA5979359FDF1873C75045DC1D172140B103B19D87EFFD3E536
Malicious:	false
Preview:	Search for ROR..if (strcmp(#5,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#4) > 0){.. print( "SB ");..}..if (double(#4) < 0){.. print( "PS ");..}..print( #4 ,".");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-0UB91.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.601409765557392
Encrypted:	false
SSDEEP:	3:5NFDpLEJn3v:TFAnf
MD5:	F115DCEEF4C93CF8C4FB2663F6B84764
SHA1:	08512C44C65FEB5947D0D6D25D31700DCBB974D7
SHA-256:	52579E2F55AB543493A379A5C9DCF7E62276F8864634FC681F61BCDFB601679E
SHA-512:	0A331B3570985D7AED499B064E74B546C530776C4786321B4DC3362B51C4FDEB9A41807EA2C53CE626E7A700F510611DC34A288CA4D2264F095B0AF957693FDB
Malicious:	false
Preview:	Search for DTM..print(#8,"m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-0UP8P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6PMf:TFUK
MD5:	E014B68BD9F230E5F1CD664E6F4AE950
SHA1:	479BCC713D8443B949BB1C264ECED98EBED95226
SHA-256:	9BF47AF00D28043F2F9F30C1A6DAA5DEF77F87F694A828FEB3D05F8DE0734064
SHA-512:	FF167C4369BFC390B759321ADDB6EC7B0B96BCE506EE4EFC8D5246FD724AD0A9FE8454F48FEB4EA7E59AC900425D61C6DD204A054921901A25EE2B12794F8217
Malicious:	false
Preview:	Search for ALA..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-0V97Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDWkov4NXJZv:TFXogXJR
MD5:	ADC7822BCB7DA6F130C18FE1D9457049
SHA1:	C4CE03E919564C5D36C1F5974CD2268C7C4DACFF
SHA-256:	6DF23B4D69BF9ED2131D96B5135EA8029D037C925F61988779AD7DE617EDBDD6
SHA-512:	3B978498329EC86AB9E9855A8998F152371F52F0048AC3D073C177E5D5D5BD804212324FB95BE0A0ADCD9D36BF29C4D54F9746556B206CA03E0B2E2A12BC7614
Malicious:	false
Preview:	Search for GGA..print(#12, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-11H42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDi7FMLRIz8sfn:TFmIsfn
MD5:	3039D1981F5D297111DB324EAAF6B756
SHA1:	E7479A5AA7884C57DAC04D19E43FAE161F924193
SHA-256:	208DA161B12CDA3506A5419418A748630A041ACD450CE2C652012BFC0292291D
SHA-512:	26469E329C0FEC98AF0A64E0E7457DD977846FEA3DCFAA2CCDA00D95FE3F44754198B6FCD92DC30E24D6509BADAF702DC5ACB33D1969D0E936E31C01A8D46D38
Malicious:	false
Preview:	Search for VLW..print(#4, "nm");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-14JR3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFDVNXKsfZHBloFifn:TFbVPYif
MD5:	7BA784A590B079A52A765FF68F8B86F5
SHA1:	93FE08FFE5C5835DBBE8399C4FAF6F7EFB2CCFC7
SHA-256:	F573F57FA6FEC193C21899BC44B3BDA9CC399874535E1B595DC034716C93E001
SHA-512:	F0491621750438C19FB2C21B852CD7F8BF2E41948F9CA64EBB2C863B40A30CD0C2E3162E36F540E629D0088E3BB5B32036F8A1A40E1092C85FA071137535E47A
Malicious:	false
Preview:	Search for MWD..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-19B77.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.323161167392161
Encrypted:	false
SSDEEP:	3:5NFD1W6Rv:TFJN
MD5:	7D76484CB9ABD382DF414D9C975AAE4A
SHA1:	FD8EC1320FDD32B45BC18517DF680CD72A44BBA6
SHA-256:	BFEF15238F02F2C6A9B41E5AD2D7D58824E622B2D1B4BBFFC341C7EC6FC44ACA
SHA-512:	64CD59CA52E363912B82D4B290E0E9D9688F1641FDCD35405F8F51F7819DFDD630BCC752F74619A804C7FDF53F36515C88EA5AFC0A350526F6EB3618395F22C8
Malicious:	false
Preview:	Search for ROR..print( #6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-1ANNH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDWkov4NQKn:TFXogdn
MD5:	DFA5A32BCB6104366D1A27C0BA4615C5
SHA1:	B1EC35FDEF5B30D7F8DF219D3FAA0E6CA67972A6
SHA-256:	908B5C6BACD5839305A8ED38504286F3860D53A334DC670F8C2D7532CBF5B542
SHA-512:	2B85AAB7558EEF5E89D93EFC3A9A7C164BB2DBBCC7CB7CB66C36C5594BDC3E417874E2379023FB8F3FDC87AC1ABB9F3A33FBC8DCC32959915CA5FF159CBF39D8
Malicious:	false
Preview:	Search for GGA..print(#15);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-1FLED.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.8278508748908555
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/IlAFpGjq0pxMeTyeCSPYJIMgOFEruHhGu:TPT2gglAXGjVXu50YJIhqhGu
MD5:	995E52AB6AD1D2A7C3793A3E6F513BFA
SHA1:	8B962E4C6F76E2D164299FD30A6E5B7F6042CD8A
SHA-256:	4959AE465C17A30F1A8DF980DDD64690DF07BF83BE96B4E59B464E5CA48986A8
SHA-512:	7C999E6C6A271C55229F7042AC9A6E88F014759EA465F5D24ADA9E33877395B9E0132A766E6A94916F5545BC1C3EAC6F345D33D1616C5C8A42E8ED1C21A48698
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-1ICB5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.888405210518773
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/Il0XGjq0pxMeTTHf5PYJIMgeLREH0Yu:TPT2gglmGjVXv/dYJIhdNu
MD5:	2B6A2E4669C06EC60E2DFA766585A701
SHA1:	14960057EB91A9DC6093BB1A8CA47D320230BD15
SHA-256:	F95961BBBEB9530FC34B559885AA08770986014D1D17292B9F4D9B2EB324F441
SHA-512:	139A2B6CECEE0DE8859F85867E4AB8FD962CF82C6C0B0D9DF0D1C50A6B72A3B435480454B49D0D854F9F8FC28AC372C5346EF13DC98A75113A35637B52BD5554
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) < 0){...print(" PS");...return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-1QS7R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.770310755768087
Encrypted:	false
SSDEEP:	6:TFJPDGAVk1FmFErUd6lqAD6mFEra6lqABk1FmFErzzIlqALsi3FErpKyGBk/y:TPDkPuIlQ3lbkPZEl3SKyGeq
MD5:	627D3AEF5A8A52B7DCF30426B8083B8E
SHA1:	083449D0C619F9E22C87F12EFC276BDFF7D5566C
SHA-256:	7308972A4068637EF8AA827922C38FCBB41B71B31E7A1CAB71571F5BD1C0732E
SHA-512:	F4677E0AAF838613B94717EFDE2920209C9B1FBE9A45EE072F45E83A829F1270445324FDCBFA318612B600AD83D616D88C0F80DCA64E7077BDDFAC8B44161727
Malicious:	false
Preview:	Search for NSR..if( strcmp(#8, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#8, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#8, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#8, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-1VTOV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.905169351698
Encrypted:	false
SSDEEP:	6:TFCwxXlqFrV2g/IGjq0pxeZTHf5PYq4eqLR1MY+:TUwlk2ggGjVW/dYLZ+
MD5:	0B6EB7BF695BBD06EFF4874EEE463599
SHA1:	78847119463DFB851E9394F01437759FBF1E9B97
SHA-256:	BB923AB81B9A95FD216613DD31E15A6C897EB3B3FB0C7C4555610603EDCCD97A
SHA-512:	891FA578BC6851F2CFE81CE8F8DB7718D3336802ED91E8A088630CBDC0D928743B11165599C77B72EA4576119C8E509953251DB37D9D73F40F4642AA07F50BFD
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. print( "Data invalid");.. return;..}..print( fmt("%4.1f",double(#2))); ..print ("%");..trend(double( #2 ));..if (double(#2) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-2021S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.907508515861056
Encrypted:	false
SSDEEP:	6:TFCwxXls8mFErV2g/Ils2Gjq0px4BvyeCSPYd4qLR1MY+:TUwls8T2ggls2GjV0B650Yd4M+
MD5:	5AE61942177BC1E17E8CB148F706AB18
SHA1:	2B9B46E110EEFB0632B7D98871543008506A1036
SHA-256:	C3962CC40C125B15E64F6231A707319F9F898B60789FB86977C7A5E82C919C1E
SHA-512:	2581E512B6A680C106BBBE64FCB23902646467D0EDAD10D3BDA915CC83D473A7EBDD91432CA7D15C6423FF9D6B366BD1700C5EE04C58307914483B803F2B711D
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("RPM");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-2AD62.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.499597622210291
Encrypted:	false
SSDEEP:	3:5NFDkAL7BloFDy:TFQiPYW
MD5:	B3D38B9D6483A209DFEE908D7D21C6FD
SHA1:	9D48D47956B29C829D56A520CB4879F9C5168678
SHA-256:	90A07A943F0ACFBCA43BE1747C94C84F1A9E4479F4F397B013BBFEE11C2EF563
SHA-512:	8BE68DE74D1E0A170BFA96CD3F7C6D5F749C45D04BA46A6DC3B20A76C95632F1D8979638A09E74EE750229153FBAEFB48876F8031ADA73ECD4F5CF4714ECE71A
Malicious:	false
Preview:	Search for HRM..trend(double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-2DJDC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.691435688769648
Encrypted:	false
SSDEEP:	6:TFJPDGPnsFErvIlqPfk1AFErYhlqPHsi3FErpKyGBk/y:TPOIlJqlBiSKyGeq
MD5:	4E78BB7594763C54A3B66442930229A7
SHA1:	D06049A799E7117A8FFE20F4735E056208041AFF
SHA-256:	D71DC6C724AE232903F3ED16FF66007A8109F7C1CD23C4CE712997F3F1E132C1
SHA-512:	D766EC7A3BC645BF8EB616C15F3DEAD95574A82A2F664EDDD6A3A2918C1709DDC4ABED9D87EF0A9CFB3BFFB3C49571205759220BD1C8D926AFB8673016F224ED
Malicious:	false
Preview:	Search for NSR..if( strcmp(#3, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#3, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#3, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-2F2UN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.835071091497352
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/IlAFpGjq0pxMeTyeCSPYJIMgOFEruHhGu:TOT2gglAXGjVXu50YJIhqhGu
MD5:	67005C1C0178201B347CE2E5C7898FE1
SHA1:	CC2E151F13347C5B5DBDFC330CAC9125B149634A
SHA-256:	E7BAE12903468E1B1155B7A5C5B300261EAD1AC4ADC2B5C06451E41AE99784D8
SHA-512:	653695A8C3D08A34AE323D459103FB81FAEACD9817B11688E3F3AA39A6190A7A3C08F3E6B9A18670E43720A3AEF683557A938E14A6710DD992AE498318ED5568
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-2IKL9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.804764599629013
Encrypted:	false
SSDEEP:	6:TFUJXHEEClqJlsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TmkEClilsAPlsKeEUhlsj4K7qgE
MD5:	642F5F9D503FC5674D17A60D6C8F4F16
SHA1:	368EB9DCD9BAEE628A3378DF165D2240ACB98C06
SHA-256:	19CE82AB8217AA350FD6F0FF6E3898EBBB1CF1FFD5BAF3F1D04207C64CD5D5CF
SHA-512:	EA94407BF291FAD2201E97DB62595903CDA6E22075B47B8057D40E888C430D57A6A90F8A5319D7779EE9D838CB31175B36DDEE586B3BBE9EADBF571AD5802C2E
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-2MJQ5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	761
Entropy (8bit):	4.995326481306636
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloTUKpYrAeOUlolUKpYrAeOUGtqZUKpYrAe1jf8Bloololc6GZ:Z925tjyTUKUvbylUKUvbLUKUvF0Byoyk
MD5:	228C694325AB9DE579D0CDF03188493C
SHA1:	78BB3BFF585B4618441EC458E2F13A47FDCB537B
SHA-256:	931ABACD29450C3C7C82E57D3561CDD21F0F4762CC59D7E2216C52DBB307FC6B
SHA-512:	1D951B04137FBBF6BD6B98A0066D56FE6EF5DD23D667E69ED137429D8F321B917CE2F699DA95B86D07DC35BAE9F7CE3F1DE595DB44F54A8B870B2426F829B69F
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. print( #7," ",substr(#6,0,2),".",fmt("%5.3f",double(substr(#6,3,8))));...trend( double(#6) );.. return;..}..if (strcmp(#13,"D")==0){.. .print( #7," ",substr(#6,0,2),".",fmt("%5.3f",double(substr(#6,3,8))));...trend( double(#6) );.. return;..}..print( "!");..print( #7," ",substr(#6,0,2),".",fmt("%5.3f",double(substr(#6,3,8))));..trend( double(#6) );..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-2QP70.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.795187750352116
Encrypted:	false
SSDEEP:	6:TFysrJ9fJnzfIPz+WZIKrbW4I+W6IvIKrbW94DTc+XKrBWLy:TwsnfJrIPiWZIGW2W6GWG8zWLy
MD5:	A334DB2505872573F58D37594AFAEBDF
SHA1:	1C5BB66F46C72B0AEB16C4DB1ECB0176CDE6C4E6
SHA-256:	53FAA76C7D1F324F9E9FFC2E24A2948FE179C3F2537B639518D575B689A2A1D7
SHA-512:	90C4DAAD371F657399BC8207E6CC29EE45C6804BF8CF1118166BE0FE5C2D78F4E1925CB6BFFD143C55AC839AD4D65065A12C2235F638BE1A342E135FE53EDF58
Malicious:	false
Preview:	Search for ALC..print(#35, " ", #34, " ", #36, " ");..if (0 == strcmp(#5,"8"))..{.. if (0== strcmp(substr(#37,1,1),"")).. {.. print(substr(#37,0,0));.. }.. if (0== strcmp(substr(#37,2,2),"")).. {.. print(substr(#37,0,1));.. }..}..if (0 != strcmp(#5,"8"))..{.. print(#37);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-2RJ7N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.788075985119281
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJgeuo+UoU6X9PS+to+3AGXKc31+CQHFL:TFaoEFcrV2g/Itge9vfqjCGfkCSPmW
MD5:	ED512594A6B1D055E41D4CFAC5FA8CAF
SHA1:	F326D38EDA978FCED24FE6CBC86E06403D9163D0
SHA-256:	2F0F977108A9734B7CCBDAEDD65CC7B8FBE9048404C9E0542C1AA8B4065426C3
SHA-512:	CC9255CAB2AC7838084175B678A8C78BAB755FCE04EF5FE7E3526BA7AAF57255915E8020E4F3E05C5E76CACB37BD06D7A7933AD4B79BC97269F33A880ADB268A
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"E") != 0){ .. return; ..}..if (strcmp(#3,"2") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-31NFC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDi7FMLRKnfn:TFmVfn
MD5:	3B2BA0673BAB6674DE41AB3D2731903F
SHA1:	049A104E14502D3EAFC05224B7B535E0343890AB
SHA-256:	C23E826935E7ECB53AE95445F788305C50DE77C746D279A1C521D40759E85875
SHA-512:	EC89B57BF325726DF0C50307031B132D052BBD976B2DDF4132B1F638AD6AFEC056E441620D3C7A7CA71459665BA895015B62AF331E0EB594F98180E8117E152C
Malicious:	false
Preview:	Search for VLW..print(#6, "nm");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-37A92.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.773258119832358
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJ2euo+UoU6X9Peco+3AGXKc31+CQHFxx:TFaoEFcrV2g/It2e9vfqeXGfkCSPmW
MD5:	12427EC22AC35F74D8BAB06D46C3B4A5
SHA1:	69B92FBEDBEEF6CA2179BB8BDB85CC0A081877FB
SHA-256:	3809C1D2ACA043DD79413D1025000C917FF0E677D6CA7BF2DC59C929CE402330
SHA-512:	CE9D9126C4C1403338FFB442BF400ACECFF5BD5392C215BCB0A6E92AAF1460F5FF65D079B7488A364AA294B585023C8199BDC497916FFC8482FB46FEE9C84C74
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"S") != 0){ .. return; ..}..if (strcmp(#3,"0") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-39BAO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	4.846183953911797
Encrypted:	false
SSDEEP:	12:Tp392ggljjjlolUCjUCjUFlowUCjUCjUFGtqHUCjUCjU0f8Bloololc6GZ:Z925tjylUEUEUFywUEUEUFtUEUEU00B5
MD5:	367334065DF2A8F7557657163167B21D
SHA1:	4147CBF561874E173E39B2EF6C69EDFA2C7F3958
SHA-256:	81FB55F1857E7877CBDB722267D9DC4C995E5DE3730C71FD498634BB2E50BB92
SHA-512:	311F3991E319712C120E5F901DDF89DF9A4DBD514D6B2686CECC467B28D9715D4DA751DE54F8E6E90C2AC00BA5A6B4255A4E955879AB906D40313252826E2200
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..if (strcmp(#13,"D")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..print( "!");..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-39MV8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6JMey:TFSfy
MD5:	B038662C5BB55C5264D07363EA7D704F
SHA1:	09E82DEEAC2AB2BAE4B98716B8BDA5C307CF5A39
SHA-256:	1F87F61EE2A1613EFF7F9E69CA37847B8BBB882BEEC5F76FE076613E4D35BD07
SHA-512:	3CEAA2A39688FC0A74A053F992CFE50CAE645B86325F72BEE26C4F179DE2D930E64C7B97BEDE1AD97B686FF2BB600799A9F9C41840132E82E8D126360FAB9A53
Malicious:	false
Preview:	Search for ALA..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-39TPE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	447
Entropy (8bit):	4.766661871794292
Encrypted:	false
SSDEEP:	6:TFBHxHFErebAIlvNMF1FIFErcr+lv25FErohwlvmsiHFErqqq4lvg5FErHgqglvj:TXRcIlvNMFPsr+lvZlv8UllvgcglvoGB
MD5:	89E0A61E88C29B92F0081CC035FF9157
SHA1:	757D2BA2F277A2FF685039241E059F351AC90AA9
SHA-256:	668DFB154D41F522DC930E28AF69B0CF596E56A584430CB182B85681C0C898BE
SHA-512:	035C117598F0F97013708683E6C8ED5BFE711C8F21C1F62AAA95E6A38604FCC9E0896C9574F49F6D4914CA9E71281221A462909C917C0C46F58EC92B2E6A7567
Malicious:	false
Preview:	Search for TRC..if (strcmp(#8,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#8,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#8,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#8,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#8,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#8,"W") == 0){.. print( "WING");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-3BJV6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.499597622210291
Encrypted:	false
SSDEEP:	3:5NFDkAL7BloFsy:TFQiPYsy
MD5:	658DABF5C8BACCB231D0589555F60A4A
SHA1:	E29F03A77E73112C591E092EB6E2667470E5C07F
SHA-256:	1DF09B4831F0082B4956E4B23181C9329F326078AE891A0B3BAA2FD270762174
SHA-512:	D2F80DF5E24CE19C96B005E06B77658C2EF12EE754AE5F99295A220B45F9DA726B76D7623007580980AB16CE55C29185F5EE87BCB479E354A3CA43A0CF5BC0BB
Malicious:	false
Preview:	Search for HRM..trend(double( #5));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-3EA3O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.7158358044900055
Encrypted:	false
SSDEEP:	6:TFmtfIPQ+1JLIKrbqI+fvIKrbaA4DTcTXKrM:TY1IPrHIGA4Ga38t
MD5:	22F0741BD27F78D768ACF0B401ADCDE8
SHA1:	A9DD8844301C33B89F55DE89747F407B3976B5C7
SHA-256:	253D89D17D8B6803744FE6BD6CC72B1F49471803ADE2FACC7DE8D34440A074B8
SHA-512:	C607E07395D79F2B2B20762971FF99C77BE6660C06BAAB7E496F4FB3B0AD66DDC6A1A62ACCF43D818853B1A37903A24A17BD53C120AEFC7C08C1952BFA762D33
Malicious:	false
Preview:	Search for ALC..print(#23, " ", #22, " ", #24, " ");..if (0 == strcmp(#5,"5"))..{.. if (0== strcmp(substr(#25,1,1),"")).. {.. print(substr(#25,0,0));.. }.. if (0== strcmp(substr(#25,2,2),"")).. {.. print(substr(#25,0,1));.. }..}..if (0 != strcmp(#5,"5"))..{.. print(#25);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-3EG79.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	4.7880691031424485
Encrypted:	false
SSDEEP:	6:TFiQHMWFEr8JlgzNFErFceoIlgufOFErJlg7aFErDAIGBk/y:TMStlgz6JlguTlg7VAIGeq
MD5:	B708EA3E73CBF55FF166942B01052100
SHA1:	1DBE8982035D989E1E215D3E653CA84FE436C73B
SHA-256:	0714474B8A3A21A367D5E81AA714FE6C668DB8BF5883F29E3B8E077EFD7D4852
SHA-512:	E88567E971B1109BE1D7D1E589A8471FE43E2FBD73C18A02087CA7952A095E91AF815E2652AF51CFB9F290D8AD0658F1FE88BF4E0346F2A2FD072386C78739BD
Malicious:	false
Preview:	Search for DTM..if (strcmp(#9,"W84")==0){.. print( "WGS84");.. return;..}..if (strcmp(#9,"W72")==0){.. print( "WGS72");.. return;..}..if (strcmp(#9,"S85")==0){.. print( "SGS85");.. return;..}..if (strcmp(#9,"P90")==0){.. print( "PE90");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-3GVB7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.735821149647001
Encrypted:	false
SSDEEP:	6:TF2JF02fIPc+cUIKrbcbbpI+cZOIKrbcbg4DTc/XKrLW:T0JKOIPfbIGYRUGYX81
MD5:	DE149D0B789E7AA0DCAD82FEEB602683
SHA1:	78885B7A60F066101665BCCCE6473BF4A9BA7D48
SHA-256:	5282A47096F5EE76B05FFD54FA2E82307F4188E73A98B1EC828BEB1DC883FD41
SHA-512:	976B828952F84FCBB97B18B2B856D2492F933D5C2E9BC7364F10CECB7337C8DAEBF358DC7C8ECE892EF04A50A5D66582A10DC62FF353293AD56B55DAF2111AC6
Malicious:	false
Preview:	Search for ALC..print(#7, " ", #6, " ", #8, " ");..if (0 == strcmp(#5,"1"))..{.. if (0== strcmp(substr(#9,1,1),"")).. {.. print(substr(#9,0,0));.. }.. if (0== strcmp(substr(#9,2,2),"")).. {.. print(substr(#9,0,1));.. }..}..if (0 != strcmp(#5,"1"))..{.. print(#9);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-3K8S6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.7040511288482865
Encrypted:	false
SSDEEP:	3:5NFDpLYG3vRQHFxiFWv:TF+mJSPmo
MD5:	A88ADBA379C4C840CF16D7F88FEBF317
SHA1:	388496120BFF200E40A4D62613BDA72D583E8C94
SHA-256:	86E247ECB9D4469BF17208FD80647E0B5E7475D6833110458E17379A7C4ABC13
SHA-512:	E85E030A4E28F65CEF08F88AE524B697ABA657799C77C1FBC7144132674AACB4A4CAC222D8DE8E3561EDC6763A67E63A36F3E63CE60171E3C77BE7515C1BFF2F
Malicious:	false
Preview:	Search for DTM..print( #7," ",#6, "min");..trend( double( #6));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-3PGMG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDnLNVM3v:TF75VAv
MD5:	80E24D2721BD1B334C125C8EEC3B62C8
SHA1:	F80FD825BF69D54E4CB0E1773FE24D5B25B4EC34
SHA-256:	72F87A34011FD7D1F81B5F5B7DFCBBC4BAA8C00693DD7BF3E848EF7992985DA6
SHA-512:	264537B1A04B0AA67678275E8ED3C2C03A2718E7DFA0DC10AE39C50766174F26233FE31AE13A4E544299676CC53742A6E608B6180E79EC70E54BBCEFA9E4F7F5
Malicious:	false
Preview:	Search for ALF..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-3TG9P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.905169351698
Encrypted:	false
SSDEEP:	6:TFCjClqFrV2g/IGjq0pxeZTHf5PYq4eqLR1MY+:TUjClk2ggGjVW/dYLZ+
MD5:	A8E34DFBBCBC0348865279E4E1A659FC
SHA1:	9D01AA19F6D08540E6AA23D6010949604B9B58DF
SHA-256:	64C4D4C12800B710AD1AF52A215DD759A257490914E85284C8E2F6FC301CFF3A
SHA-512:	E85E1BAE64DD0F0902F32DCC21A93A6F8015FCC2F263A250BFA122F4EBCC242D684EEF67175464A3952022FC7B99CDE56F4A255B295EBCF83111F2A977966E6F
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. print( "Data invalid");.. return;..}..print( fmt("%4.1f",double(#2))); ..print ("%");..trend(double( #2 ));..if (double(#2) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-43D49.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	5.045714737535048
Encrypted:	false
SSDEEP:	3:5NFDjUZNWX9KdFyLR32g/pUAf6X9P5HM2+AGXKsfZHBloFifn:TFI4LR32g/p3q5HqlPYif
MD5:	AFF3559A01746013C2191B049B2366B8
SHA1:	488684B9A290DCEFADDF1F5E7B9A35E5B2AD4C2A
SHA-256:	A7DEA449A7F1831B57AFFCD868B042C77DF67CD980746ADFD9904EC595BED66C
SHA-512:	E5D6DAD586447EFBE7CEE7A9E6AF4C02DB46206A2A2D7A7BDC4EE0AFC3719AB7DC12B4722E0E6D4C2F926E04A1C47A465F602DF54C856E510F0D6B0E7AEF09CB
Malicious:	false
Preview:	Search for MWV..if (strcmp(#6,"A") !=0){...print( "Data invalid");...return;..}..if (strcmp(#3,"R") !=0){...return;..}..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-48KOT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFD3QMlNVM3v:TFLZTVAv
MD5:	852A3F8597B0F63B366EDAD6C1296769
SHA1:	E3F0BFF85CECD26D4A661DF26278B676E5065721
SHA-256:	D4627E9E620E008682365F9D797BE677C70B3588D28F30ADD2341657D96D68A3
SHA-512:	3C862EF24BD158B3478C38963D8297C0925C2006F47E76499B267E34BABB66BEAF470CC783358354C0F22ACE886AAEE13677D00F5C51B0B01FE83229A73E13F8
Malicious:	false
Preview:	Search for FIR..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-4BJ7K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.896989780134464
Encrypted:	false
SSDEEP:	6:TFCjCls8mFErV2g/Ils+XGjq0px4BvTHf5PYd4qLR1MY+:TUjCls8T2gglsQGjV0Bb/dYd4M+
MD5:	72C5D166C12972873F980F557419F829
SHA1:	E3FCA300B735B406F3DBEB351C18BE4B6BE21C74
SHA-256:	E2CE0F7F214E886C207887EC94B9B74DBDAB83E864834E345F675FB9375B3704
SHA-512:	B3317538495F838FD03E8A3D42B830D3B2265A73E99C298932E116F0F7A40EC369F0C086A054D30891182C1B3BA27919FA62DFE73B20DA81D11AC20DA18A973A
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("%");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-4C2OR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlEK:TFLZ/
MD5:	1C51C7119311D3425C80700CE1D18BDA
SHA1:	7072B0900A02819C38BA39E27F3923CAC63E58C2
SHA-256:	E8F5EA64CFC59E0B3143C5F3C4F514299BCE8163A540438F3624EA489AAFB8B4
SHA-512:	599FFCDBDB9B70352D34AAF2727DBA98C35D09102C5ED364DE03B8EFBD3E95EEF97589B5F11B9F6F1F3387F10F68EBDD1ADD4BD3375B9CE7E5F2B54955F8E7BC
Malicious:	false
Preview:	Search for FIR..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-4KNVI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.918895394329311
Encrypted:	false
SSDEEP:	6:TFCjCls8mFErV2g/Ils2Gjq0px4BvyeCSPYd4qLR1MY+:TUjCls8T2ggls2GjV0B650Yd4M+
MD5:	C158877E9F70A03033A28157E1BE60BB
SHA1:	4E259E51F4F5CBD9BAD10198CA724D53D3993FF6
SHA-256:	004EACDB36E02A78A6D51E673D151FB356FB8BF473F8BB447105CE07F661519F
SHA-512:	A4481DFFE421FBF812463F3C36C0FA7F21863E0B8330E1FF7C82D512A962CFB0C57CAEA4D75B780B67F6FF0E98909F0366F9E8BF3647D39F059720F6DF3B10B2
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("RPM");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-4OKC2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551767
Encrypted:	false
SSDEEP:	3:5NFDf2plEK:TFb8
MD5:	1F6CD70375F87FF3A350C92AE34D4FF0
SHA1:	43E2817BE54621E72E39252B8049741E290A9AC8
SHA-256:	D4817EFCF6988298DC58C4DBCA8E8649958412E71AEA2186F96C1D101BD9DD3C
SHA-512:	8B7ABAC7C2182415531F186EDC970A3752B8FEDB89E56E146702D8AC0AAECEE13EF9CA588E797FC1882DC3840A99900CF5C3F4E0D1D95672F6AE5B601AD7CF37
Malicious:	false
Preview:	Search for GNS..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-50K82.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLKfovn:TF7yyn
MD5:	F423C1F65DED70800300E8AFECF993F2
SHA1:	757337AF85BD8CAAA31FF00B730E589372BE552B
SHA-256:	53CF4F5308E94066E6EA0DBC0548013192B7BBE5B1735CD9F3BA6B8509A44365
SHA-512:	1110DA4E7FA1875C60A0D14B10A8C4DAEC68995605D3348C9D6AD4201B4897CEC25794DD8C316F4061FBE0871E0ACAD529A4168F83B92E0E3FD5D78FD7845E1C
Malicious:	false
Preview:	Search for ALF..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-53JVE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.8615919943530495
Encrypted:	false
SSDEEP:	3:5NFDPmX9IsYB3FFErVeym6X9IyYtFFEr+Ov/XKseZHBloFf:TF2WFEr8AWFEr+2BwPYf
MD5:	79A53710647B89D5B8174679E5E2679F
SHA1:	AC64024963491F4BD3B80FC060E9ADA5F468EC7D
SHA-256:	6E77AEFB77632577ED01AB7721B2BD8FB2587039A090D4D02BEFA739744DD7F4
SHA-512:	FAB41A23954DA08B436CF9EB83054E1D1D70E18A8F053EFBD9FB2E4D935B05CAC419F72CB8825302308A3870707A574AA62988C502054FB66FCAA3B5DB843A1F
Malicious:	false
Preview:	Search for HTC..if (strcmp(#4,"L")==0){.. print( "PS ");..}..if (strcmp(#4,"R")==0){.. print( "SB ");..}..print( #3,".");..trend(double( #3));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-54FK2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDWkov4NVJFogv:TFXogVJF/
MD5:	014CB208D01B175CFEB1A8DF1AF2A04D
SHA1:	073BEE6BFD1DA79B9034BC60E6E0FDD13F63170C
SHA-256:	B53330BEB6E18F1A652B357351BC4FADA1C0276B434BE2439A1950A4ED1FDAFB
SHA-512:	28F733486C476B8D1580FAFCDAA303C7E02E9F5DA355E026297FFC7C376B78F1F0FE06C38CB88F81F4FA980C009DDD4B53F142065D556D45F5EB054EB074B8A7
Malicious:	false
Preview:	Search for GGA..print(#10, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-576DK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.39212668463354
Encrypted:	false
SSDEEP:	3:5NFDcclGv:TFI1v
MD5:	B398422890D6B44DE6371998BB906B79
SHA1:	9EA80D69266E0918DBEE3A0941AB4E3E2D09D2BE
SHA-256:	93684712BC62045311266009F77EFCFB851AFF92FBFE7F735BA5127B67EC75A6
SHA-512:	1D80C144EDFAE2AC15DEB0A11F93BA9B2F32D1B06EE32E679A3D03D62D942B7E165D665A3DF661A70681DCEB5D9630F145FEA911141D48F775A48809A8EC74AF
Malicious:	false
Preview:	Search for TRC..print( #7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-57SL9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	436
Entropy (8bit):	4.773758506889757
Encrypted:	false
SSDEEP:	6:TF/VE1lFErV2g/Ilq/HzlFQGz5PYLs+FErh6lsQFErQlsHFErj6lsGFErvT6G7:T5Vv2gglaEGJYLsGlsolsLls9mG7
MD5:	4A500E7EAD5CC1B71D81F02771140D4E
SHA1:	A10DECD19848CA94FC2443AEC3FE23F1FB5FFE17
SHA-256:	A4538F68FF01A2689271F79C472CEDCB07B24F8B7BCD9F67C3744BF095891D54
SHA-512:	EF247AFEF9E6E5189F0C0E6F52CC7E36131397335FA27052D46E8A24BCF53DE023FA500B4855EF6F4300A13D4596A59FD3F3680657C49B9DE3CCAC381B2A8EC8
Malicious:	false
Preview:	Search for MWV....if (strcmp(#6,"A")!=0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"T")!=0){.. return;..}..print( #4);..trend(double( #4));..if (strcmp(#5,"K")==0){.. print( "Km/h");.. return;..}..if (strcmp(#5,"M")==0){.. print( "m/s");.. return;..}..if (strcmp(#5,"N")==0){.. print( "knt");.. return;..}..if (strcmp(#5,"S")==0){.. print("miles/h");.. return;..}..print( "Unknown unit");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-588LN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.5262170368431915
Encrypted:	false
SSDEEP:	3:5NFDFDGRzbWYY4FFErLM3o+3AfqRzKliaFFErLM3o+3AGXKgOLHfL:TF8FbWWFErLhlqFkFErLhGBk/L
MD5:	51ACECCC92F86A969A0D3176CC996C4F
SHA1:	564EE1D5D8F811321AAE70EE45F4B056D7F18142
SHA-256:	FCEC5EC3E0777F509D046E6D63990034F50B6CDCAFBD73CF7481114AAC6A512A
SHA-512:	A3EFC33ECAE71C983D0E607B61AD70E2FF7DD9D43B40520CB7564117C4AFB4F3FBBAC91556D8A3960A5EE45588432A04C873F67E485023FF5FB439350B896981
Malicious:	false
Preview:	Search for TRC..if( strcmp(#9, "R" )==0){.. print(#9);.. return;..}..if( strcmp(#9, "C" )==0){.. print(#9);.. return;..}..print("unknown");.. ..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-5B1SB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqcIK:TFf
MD5:	3F300171A267CC1409DC682342E080C9
SHA1:	5FB50EFF809496DA8E79183E7EF88D0F5A65D0A5
SHA-256:	9BAA017CD4543ECD5703D5897E949DD4E0F2BB6534A965A4D0D66F78A1002EC3
SHA-512:	8C9E69B069820D213EEFCDBC07388D39C07103BD38E89B5B5E914BB6B03D25A42282D5A701C7E0270AABCDA0ED47DD9B676251AB0525665696EEC9A40C27C394
Malicious:	false
Preview:	Search for VDO..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-5C8L7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.912586246064327
Encrypted:	false
SSDEEP:	6:TFC5ls8mFErV2g/Ils2Gjq0px4BvyeCSPYd4qLR1MY+:TU5ls8T2ggls2GjV0B650Yd4M+
MD5:	B8430B79CE251F89B1534B98418498BC
SHA1:	8A292670591AA78C62A87D51E6E41DD787B0A27E
SHA-256:	C3E96DD2524A7E5415D61980AC213DB59963313A11ABFE5A5B0442E3B32A3C25
SHA-512:	4D89BF1BB1295C527B78A5F3A6C6AE0A991C380FA91B5F2665445CE40163BB4D76C7D92A4D6C885BD8EDC8B6BE3AA6B2FE1C7AA4501006833A2045B829AA613E
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("RPM");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-5JPUQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDnLNXMf:TF75XK
MD5:	1BBED2288D8ED9454C91FEA05A927F74
SHA1:	2D0F5E8C5CDD77262EC1329704BE1A9C83CF6FC1
SHA-256:	00BEAAC24643F8833944FFE1834426C42C32D3AB8BF4C412A462953E90205E2C
SHA-512:	33411672F40DB0E629E5DCCCACA62BD052096F8CC5D0D13208CF0D6A50EB4CD5173606750B3CD47AB3C776FAF46696FCF1A9DEB5CB64D175788EB4D30EAE9E0B
Malicious:	false
Preview:	Search for ALF..print(#12);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-5KPHJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDzLIK:TFvR
MD5:	67E58223622F809A8496E44223914DC6
SHA1:	DA1B7F9F8B0178FAFBA241563BAE5E6A061482A4
SHA-256:	C853FDAF85B683ED37C3A60298C7C483356180D093E245B9D48452161F9E2618
SHA-512:	63AA886068C43C8BB2E4B844412A4E737BA615D98B36C758B4CC5C045446AA72DF5D900DB7F8B4712843AD0874A0A83702924E251A225C2ED741909E4CF7C5DC
Malicious:	false
Preview:	Search for ALR..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-5OVEH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDi7FMLRELr6Mfn:TFmHr6Mfn
MD5:	B3FD817269C8C96FA68A5701FE307F54
SHA1:	30BC7D02FBF9527CE0BE9E9D274EAFEBE04505EE
SHA-256:	D857547E1B9124579116F2422BF1FAA0D93F8B0BDA6A236FBC4D3547AE3CC9B5
SHA-512:	2B5FA78893ACC04BCB53447DAAAA0B823275E0C3B2F21BD7FBBA9345A36AA47791F21C0F483EC5FBCB0B879A2C2797E5458FEEADD8B95F212371CC399D69ECE3
Malicious:	false
Preview:	Search for VLW..print(#8, "nm");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-5Q6PM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6JMey:TFNWfy
MD5:	9E5ECD43941F88F92A142DB5628D84DE
SHA1:	19C65CC84050AC1A11C37C8DF1DDE5B86E9E747F
SHA-256:	7CCB217CD6CF840A4E3651CA14A6393C0719233E3A074933C307EEB2EDA3EEA0
SHA-512:	23BA3547A10AF3E51D841D923E52D6ABAFD4290B8CC0564ED95263142C0DEF9DB3A38223D43D4EEE3A42ED9CC7EC9EAA7F09C4E970CD267CBA6A44EC9C172F47
Malicious:	false
Preview:	Search for ACN..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-6111M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.773679354006836
Encrypted:	false
SSDEEP:	6:TFJPD2kcrV2g/I9eMFEr+1FeCFErNqwPmif:TXE2gg9P1F4jm0
MD5:	6131F5912D888B83F4BEC2E1D90AD5FE
SHA1:	ADD0060450D1B884DFDF48C8B54BA897F50E8BBA
SHA-256:	ED5E2131D942E1C14249A30192654AD6B48535CA7836C33B61ADCAF842CADFC1
SHA-512:	1408E8422FE1FB95A87BC33270AA7F513045229B35BBDB12E6DE8A9B200315CBB8A3007126A8ED41BB3BE5618F139B2FDA839D5A30118183F9E4BE19E008B65A
Malicious:	false
Preview:	Search for ROR..if (strcmp(#3,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#2) > 0){.. print( "SB ");..}..if (double(#2) < 0){.. print( "PS ");..}..print( #2 ,".");..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-649V0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD9XKRIK:TFZK
MD5:	CC69E07B345FEA80CF67553AD5E160C2
SHA1:	797039A1055B15A6E483EFC832D18974E2378869
SHA-256:	3EA60E7DD7F3EB02B465E20A045625C2A5758AD5714A833899E4F6CC9E05C188
SHA-512:	03E3113629C4D83A7BA3BA8C8A5D302A8594380466A80039ED1096B5C8EA5A254CBB9871F6F3D78ACBDB5DC403404A8D1B5D7FF08058C9D0D1CD842F3B6F1549
Malicious:	false
Preview:	Search for HBT..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-67L48.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.835071091497352
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/IlAFpGjq0pxMeTyeCSPYJIMgOFEruHhGu:TOT2gglAXGjVXu50YJIhqhGu
MD5:	67005C1C0178201B347CE2E5C7898FE1
SHA1:	CC2E151F13347C5B5DBDFC330CAC9125B149634A
SHA-256:	E7BAE12903468E1B1155B7A5C5B300261EAD1AC4ADC2B5C06451E41AE99784D8
SHA-512:	653695A8C3D08A34AE323D459103FB81FAEACD9817B11688E3F3AA39A6190A7A3C08F3E6B9A18670E43720A3AEF683557A938E14A6710DD992AE498318ED5568
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-684VJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulKfovn:TFoyn
MD5:	A9C7C1ABB3A328E9C2D0293F8CF82BF0
SHA1:	DD64CF4E8302626651D17758F0BF9C5AB00C71DF
SHA-256:	20BBE88D081ABDE5EEC5685ACD183AFC74A1DFF5BDE9108FCDC97ABC8406918D
SHA-512:	9217FF1FEBD9E87F2EC5BDF463C9AC84B35A7B9893880AB3414080A8382BFCEBF335018427B932D097BCDFE25D7C727551C44F4E9CEEBFACDC01792A4F5F81FC
Malicious:	false
Preview:	Search for ACM..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-6DA0N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFD6b4sfZHBloFifn:TFMnPYif
MD5:	E92F73416A8878299DA905044383B97A
SHA1:	2DAEBF505B3A6F38DB7C7896747D73509B3F2787
SHA-256:	948B6E0C700BC186B855ECDAB1D197F50E5583CF3024EDA8566E97BC4FF7CFE3
SHA-512:	0259D13D9E9C9BCBB19C579D42F7714F1E2C064F82B7993EEB457F1E577AACE68D44C83D5169E24CC63ABBA509776E05579EE9B0A873441DD574190DFACD4934
Malicious:	false
Preview:	Search for VTG..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-6JE69.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.770310755768087
Encrypted:	false
SSDEEP:	6:TFJPDGfF1FmFErUd6lqLmFEra6lqjF1FmFErzzIlqE3FErpKyGBk/y:TPyPuIlq3l6PZElpSKyGeq
MD5:	D45BF2B23FC219CFE1E53490B14C1B57
SHA1:	91D9CAED7E5A60870C2C82EDD7A7056C895A7D6A
SHA-256:	2EA166883665B1B41FA0473935DC5FFCD67A3D0AFD0F0A74B7CF389FFDB7FC06
SHA-512:	A63E95AD266321DF8CFF811F927B7BD55151085783D87ECF2C40483B30D54A4DF8A21A145EA9D5C06DAFDB3AFA1D8A71DB8DC63A9409EFFCB75E5A958872659C
Malicious:	false
Preview:	Search for NSR..if( strcmp(#6, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#6, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#6, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#6, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-6M42T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.638611091386151
Encrypted:	false
SSDEEP:	3:5NFD3QMlH2XUWbaIHwQwUWZhJHfHYQwUWfFHL4QwUWcpf:TFLZ+UWbpHwjUWZhJHfHYjUWfFHL4jUH
MD5:	A8B236A3AE8973CDB1B60B9A29BEDEB6
SHA1:	5F06F670B06F65319ABBE9C98C38A9F1F5E39D97
SHA-256:	418422B73F1BD8F15F84A53E142DE2EFAB09235453CFC486C34680FDA570904F
SHA-512:	C607EA0446D78764DA4665EB3BC71774CA3534BDEA03DFB13199BC3FF698A8FC28E1C4E2065E5286D6E8A2DCE14E475C4C1DA415889BA881B35216A8B177D373
Malicious:	false
Preview:	Search for FIR..print( substr(#3,0,1),":",substr(#3,2,3),":",substr(#3,4,5),".",substr(#3,7,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-6V545.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.922598366684069
Encrypted:	false
SSDEEP:	6:TFC5luJimFErV2g/IluJcXGjq0pxCBvuPYhtCFMLR1MY+:TU5lJT2gglrGjVeAYnF+
MD5:	48E045B698B3C5A89BD43B84A1796718
SHA1:	00AF88050006E6E8C660DA93782CF0D51F55F150
SHA-256:	BAA07B446084825D7BC18DD3FCB740D659C5AD818AE0C3615834CBCE5DDF87E7
SHA-512:	EF355A531DBD0C749A99DE0FC2C005EE279040665FB34AA6D38055FD5B8DBA65EDF20802DA3F4225E4227B68EE8FC586820252D8C7431747FD8373F5FD6C01E1
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print (".");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-701IC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.796709424428437
Encrypted:	false
SSDEEP:	6:TFUJVHqXlqJlsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TOElilsAPlsKeEUhlsj4K7qgE
MD5:	0B0334E19C27A5058CA4696C373603C5
SHA1:	E7B44214BE0A1C4433A9D50C98129FFAF45D1429
SHA-256:	A8BF5E7C2B9D9CB4330F8CFF3DA6DE3135A6E5417CCFDAE8CE9D9EFFB6588A37
SHA-512:	C39C7B055990B9167FE62CD862FBDBA447FF25B158D346CE043EF601D8426EA17F4651FC9F2A14676A6A7A7B7B31EF68332A0BE53C2390C08D26EEA126578398
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-71KFF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.780616778028722
Encrypted:	false
SSDEEP:	3:5NFD38WoOJgGm3FFErFM3vFv:TFL8ugtFErFAvV
MD5:	2FF37557A174A3041F504F9333E25F9D
SHA1:	06AD34B44D76A3E21A48ADE6497B2329E99F7980
SHA-256:	D5193FC489C2D135A42890575D4B801283D054CB12B89FD2723C879F3A855498
SHA-512:	AC1DF089468DC847A37046B9058BC255D5D4A17EEF150AA3B8E363CFEACC308E026DD0D38BC617657C0E0DA8D2644652FDB92EE781882CBBA2DC26C5D2C5BFAD
Malicious:	false
Preview:	Search for FIR..if(strcmp(#2,"E")==0){.. print(#7);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-73MS2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDnLNUAv:TF75J
MD5:	7E4879C3AA70E0D00C5047CA8BF34B8E
SHA1:	93F273EB08973D3853E33EECF1EACE58BF5B9728
SHA-256:	4DDD4CE4DF30E8435674B5133721BD641789A35FEE3724DC6B6DA2830581E945
SHA-512:	DFD7C80F71C6BDAEDBA8539AEBB8B5E74D566C0F44A7E27952C8030F26477EDEC4B5BD7577439C9ABE325B4249138475F95BBEEA0FCB71D785A8E90CB9A3DE2F
Malicious:	false
Preview:	Search for ALF..print(#11);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7A8FE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDUq6NVM3v:TFdSVAv
MD5:	429EF79A0415B51D154FD230503D0862
SHA1:	DA7CC58CB541C387756F12562DD467E4B11E376E
SHA-256:	564EABD16CDDCEB66094B1855A8BD290EAD32602B6D9E3831CBE86816EDBB533
SHA-512:	90A3ED08023B093502CF1D0845891D1885EF2DBD87A06B26475AAB4AEEF2FA5724496E505DFBE36A2A0DA9A8A7C8BA05FC4B770C2079406D0009EDA077C6F8BF
Malicious:	false
Preview:	Search for GEN..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7F0S5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLOK:TFT
MD5:	540D6DC826FB7E96A7FCF4DC424A4585
SHA1:	D65FD3E4773304CD60090FE505888DD7C9542025
SHA-256:	2822BA1F63E0BEF6423B212BCBB37A96AB9DC3ED930098F0B0BA47097F3F5CC5
SHA-512:	162D4EC7DB96501A1BD7B898BA588389F7F0A83A3563AB93F335719EC79823385A19BDB52AC20F34640E42E54413E57E3A31435FF548691D42AB7B1FF7CE1EF3
Malicious:	false
Preview:	Search for DOR..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7FMDJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.773679354006836
Encrypted:	false
SSDEEP:	6:TFJPD2kcrV2g/I9eMFEr+1FeCFErNqwPmif:TXE2gg9P1F4jm0
MD5:	6131F5912D888B83F4BEC2E1D90AD5FE
SHA1:	ADD0060450D1B884DFDF48C8B54BA897F50E8BBA
SHA-256:	ED5E2131D942E1C14249A30192654AD6B48535CA7836C33B61ADCAF842CADFC1
SHA-512:	1408E8422FE1FB95A87BC33270AA7F513045229B35BBDB12E6DE8A9B200315CBB8A3007126A8ED41BB3BE5618F139B2FDA839D5A30118183F9E4BE19E008B65A
Malicious:	false
Preview:	Search for ROR..if (strcmp(#3,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#2) > 0){.. print( "SB ");..}..if (double(#2) < 0){.. print( "PS ");..}..print( #2 ,".");..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7GVEU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.807888696044131
Encrypted:	false
SSDEEP:	3:5NFD3vMkWoI8FB3HFFErCEWEBI+3AGXKOK:TF7/1lFErCEWEBIGs
MD5:	21FD97C54ED97789301D038FDB6F4316
SHA1:	8CE9D0B80915F920407EE8B70288A472B8D058EF
SHA-256:	84FA9A77788254A6D3A827AD177BA2688A6CC76ED50349E116F96095ABDDCE28
SHA-512:	C2149F0B686E4A7D36A28902D9B559E19245E99645C5A306DD933F640892FBE5095EB030B4755497B595A4ABD6418918C5DFFFF8DDB0642036A54A7A2C1BFD6E
Malicious:	false
Preview:	Search for HSS..if(strcmp(#4,"A")!=0){.. print("Data Invalid");.. return;..}..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7K5DG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	4.833196467872089
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/IlAFpGjq0pxMeTyeCSPYJIMslFEraGDHK:TPT2gglAXGjVXu50YJI5/GbK
MD5:	DCBB8966C598445E9E7E9047EBA61301
SHA1:	24AD81B8350ACF000AB9298CF58585778638D8BA
SHA-256:	A269FA98F93ADB6E40020104D7CF45345ADF5347426EB7B5AE2BC7FB1716F009
SHA-512:	27BD8711D405B288FCC5A6E9BE6F4D38F4C49C49447B910D385A0E845DF36123E6C3AACD820913B6784F8862CEAED6C7EAD9EC7508559787B1FB07FA32201A9F
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7LS1S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6Kfovn:TFlyn
MD5:	7FC3ADEB90AED72F7542EB256D30ABFE
SHA1:	28042ECFB24E33B4D9CFF0496E4910A51E3D9BB1
SHA-256:	85E91F9AB82BCAE4A89CF9EFA4DBB459A38354FFA8AE0AF819A8ADDFBF302CE2
SHA-512:	33EA6AC1DE593588BD41E35D3A59CDEBCFD55DC5D6C751C3BC32B109896A82FD06C10F2492652C1E39AC063FBC03F9C88AD1265B329A846FC9233977E8E28136
Malicious:	false
Preview:	Search for ALA..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7OFTI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.75388313954079
Encrypted:	false
SSDEEP:	6:TFUJXHEEClqJl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9v:TmkEClilXcIlWsr+lPDlqUllbglWE
MD5:	167FF61C8E1B09020643C1BA7252168A
SHA1:	8E32854A92E08446A8AB56604ABD304A6010B8EA
SHA-256:	5E93F7C1BD6478AB869A90DCE8AC7AC7B2AC2A4088D0D0F3AD70C1CCB82681DA
SHA-512:	4F0B5CF116888D2D4DB6BF1CD17BA9C6109BDAED5076F4EF7596F38914AB656B298C008E6600CD55AA8AE2D045929263D9078967D81B4971EE44C995D77656F3
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7RNUB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.796850212260854
Encrypted:	false
SSDEEP:	12:TOElZClw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:aESbIEygGeygIVHiygBKeygaf3E
MD5:	F2C4E9188E8C7054089831C22544E4C4
SHA1:	3F1C10BBD5A2C825EFB6F51A49C5D53068173897
SHA-256:	4E045B08D95396D619BDAE4B10F2981BA51D6DF80F9281552A600688293BE24E
SHA-512:	FF89F042C8D3F3AE4F818E2EA8EEC7DDD2DAD1CDDB62B06829BCDEF2000502147F7645E59BAFEE48AE5A21DF17E7E756EF4417261F919E8D75065287DE3C005E
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7TFRS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.746310062783722
Encrypted:	false
SSDEEP:	6:TFUJXHEEClqaCl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqglZ:TmkEClZClXcIlWsr+lPDlqUllbglWE
MD5:	AAE538FBCE996A0EAB3A79DC1BF9FA36
SHA1:	9CD79678D18800E0DB990081CE3F3A3E4D930AAB
SHA-256:	8D4C90E3A13725FF246AA9270E4B720E5460A2A05634060FBB617F8B29622F05
SHA-512:	E938C379FDE374D85886981E7D9FECAB898022004DFD5A9B810982F2A4DF259F2F42A9CC07D832B00E16155D23AAF69028B15C0AAA836C8474C2AB6D3A734D2A
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-7U88P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	4.547247342260632
Encrypted:	false
SSDEEP:	3:5NFDMoN6RfvGHFxiGRMAv:TFwoIAP4K
MD5:	EFC4BA968837B93D46FCDB3080554045
SHA1:	F8917DAD98FE6F5CB65872C1FAAF8ADF688E4E7F
SHA-256:	8EFDC48C1B9FF679C502F03928EF01B0739128FDA0D4FB10F164E1F600F9F253
SHA-512:	B41BA7889F78655C0F7E8DBE3EE951283A838DD19971C80DF9B1B0D29EF4A2CDA6F2DD19291BDCC50141EE1CCDD10784187AB46E4C259D658B1A195625EF46F0
Malicious:	false
Preview:	Search for DPT..print( #4 );..trend( double(#4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-82KH8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.736801114695635
Encrypted:	false
SSDEEP:	3:5NFDMoN6RCRQHBloGXMfyn:TFwoxRSPgK
MD5:	CC45AB9654DA42B75AFD190F2F16E3CF
SHA1:	4C1BC4977EA2CABEBA5991FEA7164E4C3D1BECEE
SHA-256:	56CABE1B0F76EE5DE8465A0157EF927446D5A3D39C20BE824AD59040CF4C732C
SHA-512:	8A920FB65351D14BD1B3EC5AE27379BB97F04050354703368CD5546CD4876096A6C330F9C339B6FE05F2A7945316120EEC16B0029A7658E7AB857E3B72CC9491
Malicious:	false
Preview:	Search for DPT..print( #2,"M");..trend(double(#2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-8E152.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDnLNRMeyn:TF75Rfyn
MD5:	965237C363756B49BC20C985615F4425
SHA1:	35DA31333BF9F73F40892F97455E0FA334D03341
SHA-256:	E843FF7436F5F339928D0C2F1ACC667EEF8426A6A89AB9516BBB77098FAAA819
SHA-512:	48F00AD7615B940CDA2E82B42A1B16583129B4072A6F41FA721BF16160F4F1B07F16DAE1B4443BF4715F968C76E9C2FD344D81A68A6DE052C98EF166FFC9380A
Malicious:	false
Preview:	Search for ALF..print(#14);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-8IHV8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulJMey:TF7fy
MD5:	0E8FC319562A6CB26EFAD5578BFE306A
SHA1:	BBF84B058CD3492BE004758E8D6DE312666F6A05
SHA-256:	DFA855D64D2351148C39D661B0D3D039E9088E9B888A080DF616A5AA064D3FAA
SHA-512:	F16BC4699D80D44125545FBA4AEE10BA92A7568C7997C1D2003FE7E8D33F8FDBAA63693EA7142FB0EFD97E1E6ECD975D16DED8B416D40DC3836509276E408388
Malicious:	false
Preview:	Search for ACM..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-8P5PR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.949310848764217
Encrypted:	false
SSDEEP:	6:TFWJ0LR32g/p3FCF8mFErWq6CXMrSj2rFCFjOFErWq6CXMrSjviP8K:TJ2glFiUUFKEURER
MD5:	5A1D625F892928ECBD91AEA70C898980
SHA1:	F8740C0E494EC1DB4C7D3CA270CF5530CB3D86EA
SHA-256:	AAF34D34210DA91821AD182645B146C6209B88F5E4A056BAE3830A210D4F8EC4
SHA-512:	4A3048B94FE8D7E7592430B2256263509582EAD85DB3E0DD4522A929B2C3B3EC2160D43B47F796119EC890B1277164FA8EA0FC9AB80DA417BE7F6081B37D9904
Malicious:	false
Preview:	Search for VBW..if (strcmp(#7,"A") !=0){...print( "Data invalid");...return;..}..if (double(#6) >=0 ){.. print( fmt("%2.1f",double(#6))) ;.. print(" knt SB");..}..if (double(#6) < 0 ){.. print( fmt("%2.1f",double(#6))) ;.. print(" knt PS");..}..trend(double(#6));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-911OE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.667598710630501
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRH2XUWbaIHwQwUWZhJHfHYQwUWfAfov:TFfc+UWbpHwjUWZhJHfHYjUWfdv
MD5:	B31884CF90E9155D19E84B74595827C0
SHA1:	5ED62284A45E9D7242D369509CA25DC81018F29F
SHA-256:	0C58A0BB916EA381666F33839C4267EE8EC4B53FB3BCD8CB6497E44894F0204F
SHA-512:	49E90D1BB40D467F9923C27A19AC20D7FDEABF8C8957D11FBF03624F665073EFB0BF6E7F4DEAD5A6222D87697022D51A153CF4126CD2A31BD252D5B791720AAE
Malicious:	false
Preview:	Search for WAT..print( substr(#3,0,1),":",substr(#3,2,3),":",substr(#3,4,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-9BV0A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLROK:TFfcd
MD5:	48437D98D2234EC715C98AC7BCA13826
SHA1:	5AE24DF193D3A0F8B15F92079EE212C8FB26A7EF
SHA-256:	DF300D966C82F12090C9B269012860C1795E7BEEC728FD120C295ED77FFDE894
SHA-512:	2425455478A743E92842B2FBB0F9A7CD5AA70F2A463F3712CE77B90F549B136D6D6845BB6974BB1D017A7BB2E58730DCE91251DCC86412D0659291897BAE7A88
Malicious:	false
Preview:	Search for WAT..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-9GNFM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.798632387108336
Encrypted:	false
SSDEEP:	12:TmkEClilw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:qkEC4bIEygGeygIVHiygBKeygaf3E
MD5:	193BF8E52C81F948BF9F89DBBA4CA37F
SHA1:	658947FDB7A2891CB60CAEC90D5D0790F5C1AE91
SHA-256:	4BD6727ED15F15DF866863EB413E88F48B0049A7C36FC95262E039E5FCBB018A
SHA-512:	C7F658B812DCE99463809ACDA6E26AB0E7ACD8B9F05A408C57D84C7536A25863A5492303132F1063AC3B011D7C6899E62B44E847DA82F322721585BBA00DA1EE
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-9GV17.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.813534671515546
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlWXGjq0pxKGTHf5PYcKEZmFEruHhGu:TNT2ggl4GjVOQ/dYcKEUhGu
MD5:	F0A90FD1E7848040D7C63B7690AA4A24
SHA1:	12C11780B8A53CB619E039CD4ED64004A53621CF
SHA-256:	558B339F75292DCEED13BCFB78F110C61E29EFBF1F46C9D7445A8FD5FD85A307
SHA-512:	38987CFA0888F9968A40BA836D1420EB7F5168923BB9D37248C2547AB8E08FB63C40A06C229FCE735AA805B9FA9BF7A5415A929531E4CB2709ED57BDFCA6E360
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-9LQ20.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.59445640611102
Encrypted:	false
SSDEEP:	3:5NFDmkplSR3y:TFupy
MD5:	D658C8FB3A97174BB9C31122DCD8FCA7
SHA1:	090525535062538656775110C2DDACA2D03E0723
SHA-256:	7F3F1464B96675B1DB3EFACE0457462EA5E46C6501B6EC5DD7F5D9963992D3B3
SHA-512:	1F74CD3D3601D7846D8182F399C8926FBDBF174D103C05976887D39B0FD08CF4B1CD651404909B3AABF854EF5A2EB19501A6047C470813A235D1232344DE3A63
Malicious:	false
Preview:	Search for ZDA..print( #6,":",#7 );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-9N2U3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.77613097283397
Encrypted:	false
SSDEEP:	3:5NFD6b4v9HfZHFxiGdM5yn:TFMuf5PsIn
MD5:	F5068C709E83311C9DD93AAFF147BD09
SHA1:	37A17F759519906131602B0C72804BC66CA3F8F4
SHA-256:	57C71F0DD2C4CFF99FF66FDB578BE6E4FD1835647D7A453C29FE2E079E724AF3
SHA-512:	A12EC7243EF4E5BE9EA8819070ACC8AB46ABD57E9B3E3561A16F9D5E8CAC5EA6B3D4FF0C5756935C409FE553E995E7C41D32ADCADB19478762BACF047BA9060A
Malicious:	false
Preview:	Search for VTG..print( #8," km/h");..trend( double(#8) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-9NGDL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.75886148871991
Encrypted:	false
SSDEEP:	6:TFVTkcrV2g/I9eMFEr+1FeCFErNqwPmif:Tz2gg9P1F4jm0
MD5:	C26B9D0CE5EA6FCFC72F9C6A1C6CC555
SHA1:	E6CE74625BE91C88564BC46960F8D289AFF50DA1
SHA-256:	6BFBF38963369154353C9C11C6AADBE694D674B958B74E7A24D82D80AAD20DBD
SHA-512:	7A0FAC80933E672E99230CB87B042B489355B11CCDB5F85B286B1272599CBD1B4FA88C7C898F4CED562312812D04DA564D312FC9E1AD8E128C974FB3E14F58CD
Malicious:	false
Preview:	Search for RSA..if (strcmp(#3,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#2) > 0){.. print( "SB ");..}..if (double(#2) < 0){.. print( "PS ");..}..print( #2 ,".");..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-9OK28.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRIK:TFfcj
MD5:	153B2B9B02A864DD4D86C6B54E52F5B7
SHA1:	DF94C228F0FF99E05F005B1D24648E29A7B41BA2
SHA-256:	7E92C542E0DD6396EDDB300578F50B64387B03C79BC0AE0F164379D759610C0F
SHA-512:	E8BE14938F26FBA21F4B86E4F7F2ED9D0B01F57D6DECE5503DEE407123293B1C1DAAC1519507D815EA47D3751A970F49425837FBB7DE09950B203DEAC7850155
Malicious:	false
Preview:	Search for WAT..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-9SUNI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6FMf:TFdaK
MD5:	23D45B511DBC703285E353196E84E73A
SHA1:	1A84BE9B85848411AD5EED0E455700E5B92A3A55
SHA-256:	87E41B664AB8F30D34520258680FEB4303429A2319911C4563EC939F98DB3FD4
SHA-512:	921013BC766CDC890F924C33E20035ACC65EE628764C055BD780D4E1E6AF2F994C82E838FA1C53F641166767A0BB8E0FB3AF4B65E75265395E565B97DF4E710B
Malicious:	false
Preview:	Search for GEN..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-A187Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.122427451057994
Encrypted:	false
SSDEEP:	6:TFad5EIeLR32g/pMsbBzVFejq6KGTHf5PYedYsgKEZGLRcYe:TAzJy2gQjSQ/dYYYzKEae
MD5:	1732654AA51D4F339C214AE0DA902CB0
SHA1:	A33D9049BEE4F2246A33FA506973CB42A665C967
SHA-256:	6A66FA7528E1E5C0CE4889CDAE20808EA618596AD21C77D7A6C0BD40BEB4A96D
SHA-512:	8B70E26F95B467F3634EBA3E795AD1797507E7AFE3214445EE7A58C9EA74BA59EABF8F1703F2FAA4374EB172E8BC7822F6C81FB848D240D6C995A66B8E5E3073
Malicious:	false
Preview:	Search for RPM..//If #6 <> "A"..if (strcmp(#6,"A")!= 0){...print( "Data invalid");...return;..}..//If #3 <> "2"..if (strcmp(#3,"2")!=0){...return;..}..print( fmt("%2.1f",double(#5))); ..print ("%");..trend(double( #5 ));..//If #5 < 0..if (double(#5) < 0){...print("Ast");...return;..}..print("Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-A2RI3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.811134026380605
Encrypted:	false
SSDEEP:	6:TFUJLlqJlsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TKlilsAPlsKeEUhlsj4K7qgE
MD5:	E7781A5164D29E882DAF04DC07B819BF
SHA1:	3478FC4D51CC905411A0D8D4A4586012800A5277
SHA-256:	199BED5349856E4E8CFBA77D53C88B6BF37DEAF8610FAF5D606E99AC9BC03C94
SHA-512:	ABABA3C51B51E940CF01A04C33A39AC6F637856D5C06C7AB4BC75E8709DF37159FF2FD203743072B9B0A3334654F0546879C04CE1D663EB0DB3C172C84F80A4A
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-A4Q9S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDnLNWfy:TF75qy
MD5:	AA14D734B267DFE193844B7AFD6502F8
SHA1:	6A95B180393B0CD11FA8BE69E60072E8AD279530
SHA-256:	F32CD188D81F8ABF6335AE8B3F40D3C76B49E1CE2159DC0D4C08AAF1D8CC3AC3
SHA-512:	37D4684113A3F5367D1105C09AE497D6AD0F7D8373E56751CD19B6166FC2B2606F1FF6FFD2F4C7B625910D3F8760F45EC5158D3C771BFB670BD3B8F37232B877
Malicious:	false
Preview:	Search for ALF..print(#13);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-A8FUQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.806183542158471
Encrypted:	false
SSDEEP:	6:TFtMsQFErjjsGFEr53shFErhKms1FErpmsjFEr6BwHW:TT/svsSsimszi2
MD5:	2AB5032736D63DAB0B66B76D0A16E8CB
SHA1:	8CC8734D81A410A45B2980D5EDCBCE2A67C809B8
SHA-256:	EB57C7FCF5C6B65246203EEED07EFD504945D8E82A7755614943F283FA9C3896
SHA-512:	C60F5DCE92723A6BA593E3D62029740274404D4EEC695E3BC93F044E8423F6E4EE431578F455DDCE4952589488841ADAE37A95B27F2654869A06A1FE17CE4B8D
Malicious:	false
Preview:	Search for HTD..if (strcmp(#5,"M")==0){.. print( "Manual");..}..if (strcmp(#5,"S")==0){.. print( "Stand-Alone");..}..if (strcmp(#5,"H")==0){.. print( "Heading");..}..if (strcmp(#5,"T")==0){.. print( "Track");..}..if (strcmp(#5,"R")==0){.. print( "Rudder");..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-ADTA3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRFMf:TFfcbK
MD5:	B323567D9FB0EB882E600C52DFEC526A
SHA1:	C22161DB9AB0CEA0D4A2F82300338255A37EDEAD
SHA-256:	3B375F025B537C8D1CE821D877CD549C9F7C9B1EAB372A15E37A52899CCB4798
SHA-512:	4C867D6469551A7419CB42D5A4287B67E06DF6AEBFD41284BD4D20C6F4CA5B1043460911D59E362C3888EDB4648A8BA855A777437F104C599DF3EC9973DC9A65
Malicious:	false
Preview:	Search for WAT..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-AF426.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.811134026380605
Encrypted:	false
SSDEEP:	6:TFUJXHEEClqaClsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TmkEClZClsAPlsKeEUhlsj4K7qgE
MD5:	0C622F398B7FC462BC237C62E7A47E6D
SHA1:	998126C4F016459F3641852B5F37FDCCF647A8F2
SHA-256:	AFF6FA8ACB4E7815654ACB4031BEC577489691C4FE4C8CF46A1371E5EB6D3B29
SHA-512:	B7B1B57C6911631BD3D5E757B82D82ECC6518F7C25B718684826E108F7BA4080F4D72B2EA302564FB30C5CF661D1CE0EF3F4E87B86782680EBBFBD3F34AEB415
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-AG2FT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	82
Entropy (8bit):	4.650073120857778
Encrypted:	false
SSDEEP:	3:5NFDUq6oREWbaIF/HijUWZhJFHXjUWfAfov:TFd2WbpF/HijUWZhJFHXjUWfdv
MD5:	E1C8B31DC814B8417E03327B267B78AB
SHA1:	1729AC087E35A8AD1B9A36D3A1313CBF8D0B6160
SHA-256:	D38DCFDBABA423DEC7FB95E044D72379B2DAC1755CEFFF729D80BD37FE9985B1
SHA-512:	344F64E6695143268D216C8467DBB690D84D9614EAA59C49107F3A3DFA122E73240F8F65168C70394C4CDCADC8C02BA5442371C00B668B6141AE5E784F041A9F
Malicious:	false
Preview:	Search for GEN..print(substr(#3,0,1), ":", substr(#3,2,3), ";", substr(#3,4,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-AGEJO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.652894470837179
Encrypted:	false
SSDEEP:	3:5NFDmksclFL/lG49dG2LRH2XUXmMJwQwUXVfHYQwUXW:TFRFL/c4u2+UlwjUlfHYjUG
MD5:	2BCCACE120AD02E4628F72D6B54D3204
SHA1:	4D9DE5A38555F5A558799CBBDA0A0FF25D7A3A2A
SHA-256:	5F19B6A38311C0D1F3B21A3E2F83A3D859D5C14DB50068437BE43752EE3972FD
SHA-512:	E3D5C70C47E8C505954DFDD8C5CFD5B50157B2A44125E349A2FB0F061795A008E6C1862F09AC27AFE5789474ACC03F3A13CE4A54DF5F3BA08CD53427712A0AD0
Malicious:	false
Preview:	Search for ZDA..//print #2 1:2 ":" #2 3:2 ":" #2 5:2..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-AKVQ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.723438807834864
Encrypted:	false
SSDEEP:	6:TFy2PJnNJFOKfIP2+WtvIKrbWEI+WNIKrbW8A4DTchXKrBjV:TwaJFVIPFWtvIGWiWeGW838+jV
MD5:	79D536C07EB516D9870E03A42D5D9E09
SHA1:	F6F49B0EB2C9F505016D934A5213769A9D38EEFF
SHA-256:	ABF3147E1B9D0C60DD27A5E2990F78B249F6C2B6C94FD11C5F3A7E2DB84DDD72
SHA-512:	21CA30952163CCCA296E87D938A553769A1F04688DB332F2F8F14B13CED9540BA504F0E0394B5BAFC17FBD0EE6617EE01BBB8E5B005D4FB33163FAC7848E3D92
Malicious:	false
Preview:	Search for ALC..print(#31, " ", #30, " ", #32, " ");..if (0 == strcmp(#5,"7"))..{.. if (0== strcmp(substr(#33,1,1),"")).. {.. print(substr(#33,0,0));.. }.. if (0== strcmp(substr(#33,2,2),"")).. {.. print(substr(#33,0,1));.. }..}..if (0 != strcmp(#5,"7"))..{.. print(#33);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-AOL9U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqPXMlKfovn:TFeXZyn
MD5:	5C8DCD9179885FE6D742799CAFFA63F0
SHA1:	5BC1F7D2B8876BCCC21371DEEC4218A74590E6A6
SHA-256:	E6DED4BC055FDEB2B480E6CBDF8FED365B6797B5434BE6E5D2B37BCD036229F8
SHA-512:	1C9AB517A20526BCD34D53981A838F90E9401FB117FF9E52A767137BCE7D289CAFCC6D6F92B0B8D6ABC7DAC67A483D0EC410A88D3A7A6A45970038E150BC3E1B
Malicious:	false
Preview:	Search for VDM..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-AT6FE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDf2plNVJFogv:TFbYVJF/
MD5:	F29BA361323A5F7A9FF63E0133FE76ED
SHA1:	8A21A3E39DC3B083C7F39CE0A1D5B32AC159BB51
SHA-256:	8AF519F7602AF80D6E6029405B06980105D14CC2F3A420D7F370F4BFAD1A106E
SHA-512:	57DFE45BE5C667E76DB8F24E5B2EE8B2D6F66E5E3D9017CDF2D76BD2272B8795DF6AFAA789F2675BDE779AFC20E8E2267A0B3D7459B797DABEB30A283EF5FDC5
Malicious:	false
Preview:	Search for GNS..print(#10, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-AU0QM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.887438802525302
Encrypted:	false
SSDEEP:	3:5NFDBVXK3fYovRQHFxiGUm2eov:TFt9EfYoJSPOmI
MD5:	57131BE288E84CB6E85C9DCA8F6C8F6F
SHA1:	FF3F65AD631327FB8EC7A2D8A3CA175297CFDCEE
SHA-256:	808BE71E7ED8FD09AF579EEB6CC2DC673A2B45231D35A12D328A96EDE6AA2AD8
SHA-512:	7FC73495A68EFB145327CCE04011D0BFFB95D6E78D81EB32DEEE329F922FA9F7174A3955877F20E7AA2225F609F725A0C21873F89CE67F9D60F5858EFDBF9472
Malicious:	false
Preview:	Search for HTD..print( #10,"./min");..trend( double(#10) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-B9J8A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulIK:TFf
MD5:	ED9557BB7966F9C4CA1E0A1BB2F0A44F
SHA1:	01FDB7930D12E01EDAFBCFE3A3FDA2A5DC72EF2C
SHA-256:	BFCB8B66EC3CC42A684D2D19E343A8FFADE3BB76D4D409B1A4AC560EB9EFDE2B
SHA-512:	3CC9E376BFA328EB75369F30A157F49179EE82E06A0049E15EE40AF09EE5230DE732D8B549C2F685F1CFF4E8C0DB4C826C058EA5B1ACF907B1D49FC214BFB9A4
Malicious:	false
Preview:	Search for ACM..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-BH292.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.499597622210291
Encrypted:	false
SSDEEP:	3:5NFDkAL7BloFf:TFQiPYf
MD5:	DAB5ADEE0D5F624790F29D4A70E421B1
SHA1:	C6E5FF51255A8F40140E586049BB6E90C3E5C9F4
SHA-256:	F3486E5CC545C222D3C3ECC2D8A1C2B61F6EB9B7BAA7AFBD4976D8E381ABDFB6
SHA-512:	2B04D2D16459EE24382588440CBFCE07502D96D3724E40B89ABF6F0E3C20507F3413377501EDBD332BA9B86FF97B34E58D301CB4E2BC5CB811D3814CA8D8980C
Malicious:	false
Preview:	Search for HRM..trend(double( #3));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-BLMUV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.736443532438877
Encrypted:	false
SSDEEP:	6:TFwudzFxKfIPP+bvIKrb2I+jIKrblp4DTcqXKr4:ThdzFMIPGbvIGMsGM8C
MD5:	AA325D1D4B7F35121264E068DEB91197
SHA1:	82D7F05966FFEDB9C26C182A7864B68A81D17960
SHA-256:	F9E3639A513CD07F8E510E95BA3E12BC572899265944E621040D74492DF7312D
SHA-512:	662E48F2909CE956ACC15F25E199E9BEE8A74B8E8A4BF06098F9FFEAEA5E85DF58D70961F5B134CECBD76DB44F59120EAD6AAFBBCFB17A2DB23FDB7075639478
Malicious:	false
Preview:	Search for ALC..print(#19, " ", #18, " ", #20, " ");..if (0 == strcmp(#5,"4"))..{.. if (0== strcmp(substr(#21,1,1),"")).. {.. print(substr(#21,0,0));.. }.. if (0== strcmp(substr(#21,2,2),"")).. {.. print(substr(#21,0,1));.. }..}..if (0 != strcmp(#5,"4"))..{.. print(#21);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-BN0U8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.888405210518773
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/Il0XGjq0pxMeTTHf5PYJIMgeLREH0Yu:TPT2gglmGjVXv/dYJIhdNu
MD5:	2B6A2E4669C06EC60E2DFA766585A701
SHA1:	14960057EB91A9DC6093BB1A8CA47D320230BD15
SHA-256:	F95961BBBEB9530FC34B559885AA08770986014D1D17292B9F4D9B2EB324F441
SHA-512:	139A2B6CECEE0DE8859F85867E4AB8FD962CF82C6C0B0D9DF0D1C50A6B72A3B435480454B49D0D854F9F8FC28AC372C5346EF13DC98A75113A35637B52BD5554
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) < 0){...print(" PS");...return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-BNA00.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.813534671515546
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlWXGjq0pxKGTHf5PYcKEZmFEruHhGu:TNT2ggl4GjVOQ/dYcKEUhGu
MD5:	F0A90FD1E7848040D7C63B7690AA4A24
SHA1:	12C11780B8A53CB619E039CD4ED64004A53621CF
SHA-256:	558B339F75292DCEED13BCFB78F110C61E29EFBF1F46C9D7445A8FD5FD85A307
SHA-512:	38987CFA0888F9968A40BA836D1420EB7F5168923BB9D37248C2547AB8E08FB63C40A06C229FCE735AA805B9FA9BF7A5415A929531E4CB2709ED57BDFCA6E360
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-BOR0V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFDVNXK0/ZHBloFDy:TFbNRPYW
MD5:	93EB038726D9AC6C83B85412B6256DEB
SHA1:	D51BED1D681BF12BB1F6C99FB3C101EB963A00A8
SHA-256:	630DB7A0D42E4223DF7ED891B830766E93EFCEDFCCE61363A64E9949D5B056C1
SHA-512:	E86FDB8C52B34E876BF13F9D4C2A95D7B05C98BB16CFC06BAA7501990D4196CD28FADD8126657A2DCE2FEDA7474CA6F7C8B89593E71513095A63686C145A0904
Malicious:	false
Preview:	Search for MWD..print( #4,".");..trend(double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-BP384.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.730915395146161
Encrypted:	false
SSDEEP:	3:5NFDHFMl0/ZHBloFDy:TFnRPYW
MD5:	9BBAA32C70B631D6F2EC1123BC3F7CB8
SHA1:	8DF235621EE5FF025E48593FFFF6DAF3CCA8C880
SHA-256:	BD46A9E33A2246BB335A8AA04B252193E14625026AFF2C5043D66670D0673962
SHA-512:	443F6D4AAB01814070E618E0368330A5F2172FCD64A8060D0214CD766CE4DF2DA47C318DDDEE3E1DFC542905C43916B352515551ACC352ABCD5481E0C95A0FB9
Malicious:	false
Preview:	Search for HSC..print( #4,".");..trend(double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-BRJP7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	491
Entropy (8bit):	4.771286256793215
Encrypted:	false
SSDEEP:	12:TUwlvRcIlvNMFPsr+lvZlv8UllvgcglvoGB:IwVnVeF3VZV8cVg3VoE
MD5:	47A9F6A5D1F674228D239B0269DE4A1D
SHA1:	BFE2C3133336AA2FF10F11320A488EA9C638B131
SHA-256:	DB1932632DD0A3B4E95780E3F6DB263B06E7A3822B6CDE3302B9301DD1C5461A
SHA-512:	0F748002A5E1ED299F0A44CDB24B23D7BE23C8C84A67D0546D4911A599B9E05573E52F0C0A6CFDF6F2CEA8B1BEBF1474D8D0A9AA07EF9762DEA329FF7D0D54D0
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#8,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#8,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#8,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#8,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#8,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#8,"W") == 0){.. print( "WING");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-BT2JP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqPXMlLM3vn:TFeXkAvn
MD5:	A05893BC7E9C7797C023A0C2EDE88576
SHA1:	551D3191056A71674089D35DB0244B6274AB26D6
SHA-256:	5584C4245BAEF23A62EB9D04B179E7A13A1F5F7581437ABF694028111CBF2669
SHA-512:	222F10223B13A80B621580FA5B321304B7580035A4A71148DF9BE59CAECC0F8A406C856F079839EA9DD2CC606DE3D3A03DAD972893D7020DEFAFDA8779F625D9
Malicious:	false
Preview:	Search for VDM..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-C9GEV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqPXMlJMey:TFeXmfy
MD5:	145995A39403247C48A1294BBD3F24B7
SHA1:	FDE206B8842D5D6DC2C55419FA9132D29BCCDDA9
SHA-256:	8E1E1809D5A615B804ADE5C19320254123200A6A519E2A8EEF7B0195FDFDAD13
SHA-512:	9EA1428CD5C2DC6194578A7FA6C7C7FB8365CC903254B0CD19FCC5DF85191BD9DBF289458BF68A104003F7E504DD69DBF80918595BBCFBEB272CAA9554C1285B
Malicious:	false
Preview:	Search for VDM..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-CAPI5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlIK:TFLZj
MD5:	4FA0E6DBD6C83092E9E357AA1655AC38
SHA1:	AC4E86F67BB423A486ED92DEBDA1C427F9585AA9
SHA-256:	09C86C919F4F2218117710D555280EB0B4E920581F57A3A6273E3D069764A70E
SHA-512:	8FE18F3FC4135E494162D3EEB8840C6981709067A14E9AAE3B23AEB7E51E5B7BCA34DC3312C7CB2AB216EBF519CF42A43977E5DADEF7B2361E97AEFBA30F2C6F
Malicious:	false
Preview:	Search for FIR..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-CEL4D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.705744211903336
Encrypted:	false
SSDEEP:	3:5NFDFDmX9OJea4FFErQJF6+3Af6X9OJ0YdFFEro4HM3vg+3AGXKd9fy:TFrtIFErQJF6lF0YHFEroXYGMy
MD5:	592C445498BE858292019E01B1EFEEB5
SHA1:	026393944C0C5698E62C2B454D7DDFF778DB5DE5
SHA-256:	CFA5E8FDFC58649D89E252ABDABE22404F86D5B5C05C01B1B9070F12B3A94F11
SHA-512:	7BEB281F511CF59539B0B856FA56D628068A83E6774C69076240EEA3CE837215B24181F152BFF87E131D9E00C823FD238AC1751AF96F2403070363DAA48070C2
Malicious:	false
Preview:	Search for TRC..if (strcmp(#2,"1") == 0){.. print( "BOW");.. return;..}..if (strcmp(#2,"2") == 0){.. print( "STERN");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-CFN7A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.8615919943530495
Encrypted:	false
SSDEEP:	3:5NFDBM6X9IsYB3FFErVeym6X9IyYtFFEr+Ov/XKseZHBloFf:TFtMeWFEr8AWFEr+2BwPYf
MD5:	A6A4CB991493ED15D48C9CE6A0F10B67
SHA1:	7F8D950726530F907FFE81E01AB9C60FE574F774
SHA-256:	CF7FA1AC306199ECB6C1DE642FBAEAD1CC3ED258B7CAC5722D4D7EAB6B53B2D4
SHA-512:	2B5381FCDCF6539661972EDF0339523F1212AE6B93DB563B739E54272C6356E189F652FCBEE1EDDBB30451F4727C23D2D2366C3A96BDF28D671131BFF7B369D9
Malicious:	false
Preview:	Search for HTD..if (strcmp(#4,"L")==0){.. print( "PS ");..}..if (strcmp(#4,"R")==0){.. print( "SB ");..}..print( #3,".");..trend(double( #3));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-CG225.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.7491279525714525
Encrypted:	false
SSDEEP:	3:5NFDBVXKiseZHBloFxK:TFt9tswPYxK
MD5:	1A3ED18F18EFD04ACD6FD6D30A1E24A0
SHA1:	088B37B55332BE23DBAA3104C8692472B703F5AA
SHA-256:	6A7A801CB285781DF7B9EA9CDAADC6E994BE64A007F3F5BEAE70C5630244C9B3
SHA-512:	6797F32255C682D70DD73A0895272A536FDCB1CB2ED3CA228D98764CB740938BF10DD5A1F77F7383B17BF157E8276BEAEE18B3857EEE6AC0E9A4DD8C07315C3A
Malicious:	false
Preview:	Search for HTD..print( #11,".");..trend(double( #11));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-CG9V7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.105414684205305
Encrypted:	false
SSDEEP:	6:TFapx4LR32g/pMsbB7Hejq6KVBe5P02KEZGLRTMYJDfy:TAbA2ggjSVBed02KESFNK
MD5:	778381A083D5887876AB1D9889236DF5
SHA1:	4A27E00C833CEAFF8711DDFB730FC83996B75BED
SHA-256:	CC69BF3894102B7AADCB29897165B1135E36100C1912862157D4C84573AD89EE
SHA-512:	5507557CC05F1695D7F386CEAB734556C0DEE3EA830FC5926F06989F2ED5D6AC1BE973CFACBF9C2FD8CCE96989E558C7CAAFFB1FB66FBC18A4E9F02F2618E519
Malicious:	false
Preview:	Search for RPM..//If (#6 <> "A") {..if (strcmp(#6,"A") !=0){...print( "Data invalid");...return;..}..//If #3 <> "0"..if (strcmp(#3,"0")!=0){...return;..}..print( fmt("%2.1f",double(#5))) ;..print("%");..trend(double(#5));..if( double(#5) < 0){...print( "Ast" );...return;..}..print( "Fwd" );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-CH8GF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551767
Encrypted:	false
SSDEEP:	3:5NFDf2plLM3vn:TFbeAvn
MD5:	AD6EE5DA600F068849CCCD330D139F09
SHA1:	8734A25F0A4686F7216D2F4C9075F7E9E0E517DE
SHA-256:	B567B833B6B6297869DC5AEB40DFAF66CA22A722D7E5A6FA19CA0A01D2F1CD5C
SHA-512:	A1BF4E60741E5E3D4272FAC42DDDEE16A265662CE87CD4FB4F98FBC0A173A06976936120F30B9AC34A7647826847B49A8C49A722C3D5F91FB49FC4B95DF47638
Malicious:	false
Preview:	Search for GNS..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-COI6R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6IK:TFO
MD5:	9982D3476BA740B1E79F71D354F83DFE
SHA1:	BF7D761844B4847B22B2ADCADC5A20C4FB5A1A9B
SHA-256:	68DDA0C77DB9134AAA8FA8BCDB40EA52A755E422A272AAFE39970A037BA81899
SHA-512:	A50896B7AAAD236198639C0E39DF3D3C18BD93C9D09E4F56B254471375EDDCE14050472CBB5B6768643E30AD068CDAD5B05B380EB0C93E9C3444E988760CD122
Malicious:	false
Preview:	Search for ALA..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-COINV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDdGvVXKEK:TFZ4VXG
MD5:	185AB46A21A31E480DDB265B6C0E7A5F
SHA1:	8B2CF04C397FFFC3A3CF63993E0A2AF2C36E446E
SHA-256:	E22354C80C82AC56D8BE37711FAE0E46970DAC1800F802337ACEA655F483A121
SHA-512:	E4320F30CD428CE08FE22655F67D157AC13B69F739262BD3C5C713F9B2A9323C04E592532247ED2D9BD47EE9B1798E15EC151827EB1A0878858206EDA08F53C6
Malicious:	false
Preview:	Search for GLL..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-CR7KT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.958034016114698
Encrypted:	false
SSDEEP:	6:TFWJ0LR32g/p3FKEbIOFErWq6KVFrSj4FKEZAFErWq6KVFrSjkWV4iP0B:TJ2glFKEbLSVLFKEwSVlW2E0B
MD5:	46A9AE915CD2B1027977A2F11036B524
SHA1:	D4199CF94EC0CC502A99DFBCC3BBD0A0DA4CD65D
SHA-256:	00DC2C6834C7DE23CD0FAB276748A2F3903C961BD4E8FDC293BB995B8F0E26E8
SHA-512:	49167AFFE268C59D4C4D0A2AD54B2F48B227606CFACA15D62331ACA5D31C0CA54C6ABF7B35D91BB1723EF47AA54D0E0FF0B9D4F6D840689BEBD99375D4F3A412
Malicious:	false
Preview:	Search for VBW..if (strcmp(#7,"A") !=0){...print( "Data invalid");...return;..}..if (double(#5) >=0 ){.. print( fmt("%2.1f",double(#5))) ;.. print(" knt Fwd");..}..if (double(#5) < 0 ){.. print( fmt("%2.1f",double(#5))) ;.. print(" knt Ast");..}..trend(double(#5));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-CSOJP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLFMf:TFtK
MD5:	062FEB1C571A7332BC08415042F275FB
SHA1:	AF8AD4EAD43F3205E04D47823821DED5DC29990E
SHA-256:	83204B37378371B4D8633E1CECB21C4BD73C435650D98BA76FF3B962D041B01C
SHA-512:	CAACB1B55E1DB8C8A250BF8C8613B3C31A46B3F68E7E59AF17B772EEC54019149BF8B7B0B2E04B1CC9714291C4DE1A381CAE31FBB7497F626A26823380413B9F
Malicious:	false
Preview:	Search for DOR..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-CUCOP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLEK:TF79
MD5:	9976EE3E20704DD69F942997FE05C470
SHA1:	723E846ADADA1CC7B0D24FE96CE970ABAB562D34
SHA-256:	8F1335A61072B2C426A4990EE39B1AFDCD56875D980A1270ADC898BC84260301
SHA-512:	7EFE1E24ADF7BDE14068E56731F9097F2D82620BCCD54DACB5728D4E808126DAC2CD1F9200BE11C59B36748DD7473740D2A2E95657E363A26EF12A2EE1E0691E
Malicious:	false
Preview:	Search for ALF..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-D0DC1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	491
Entropy (8bit):	4.780142703932923
Encrypted:	false
SSDEEP:	12:TU5lvRcIlvNMFPsr+lvZlv8UllvgcglvoGB:I5VnVeF3VZV8cVg3VoE
MD5:	8280077248499F0E05406BAA44C5CD0F
SHA1:	914095E136CED4EC1C91C3AF5F007B838FA85E38
SHA-256:	82564D9EA5527D00E6750C65587B97C05EC72029A43C5299A3A7E60A10BB778A
SHA-512:	38C5001F6DDC75F63B848CF7A085AD6C4BF4B68CFCE21681E87E43DFA702782B8629C2685274F4D44081F971BA39B145685240328C431B62C38BDB143C3F06C7
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#8,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#8,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#8,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#8,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#8,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#8,"W") == 0){.. print( "WING");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-D1TCQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1252
Entropy (8bit):	4.842878802818841
Encrypted:	false
SSDEEP:	24:Zu2suUEUEUFSUEUEUFqUEUEUF6UEUEUFyUEUEUFQ+UEUEUcHhaw6Z:JiEUEUF5EUEUFhEUEUFxEUEUFZEUEUFc
MD5:	BFEADA53FE747FCADD84927E46E9E775
SHA1:	964F8E04A96EBB4C9FDFEA5E6A94482EFC552408
SHA-256:	7136AA01BB2349F5289836E792741789AE71BAD599DDE9F3971AB49A79B0C7A4
SHA-512:	86610580D35636DF840A2976B10355707B540BBE89727AE468125B66AB4EDBABC7147746B821E0414FA62964ADE12F989617A7C3E199C312F9BE456C3CF544EB
Malicious:	false
Preview:	Search for GNS..if (strcmp(#7,"N")==0){.. print( "Data invalid");...return;..}..//if #7 = "A" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"A")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "D" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"D")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "P" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"P")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "R" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"R")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "F" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"F")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..print( "!" );..//print #2 1:2 ":" #2 3:2 ":" #2 5:2..print( substr(#2,0,

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-D25BN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.820807398788273
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlWXGjq0pxKGTHf5PYcKEZmFEruHhGu:TsT2ggl4GjVOQ/dYcKEUhGu
MD5:	6BE808A74CE47B0528B9CBCC39C3ED7A
SHA1:	ACD322442B017D1964C418A0AEAC83F78860541B
SHA-256:	8D578061B5B6849E2512A11121806370C8204C5731FD85998D5281644FAFB2C5
SHA-512:	B05C0979DBCD9D312BCB61D745CDAE1B2ACCA20F852994737F05375E7B81C3913F898C1E83D66E6B635B3246BD0275286F08F3E6170666CBA6CEDC6AC6C6D7A9
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-D4FT8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.124816335558512
Encrypted:	false
SSDEEP:	6:TFad5EIeLR32g/pMsbBzV9Aejq6KGTHf5PYedYsgKEZGLRcYe:TAzJy2gPjSQ/dYYYzKEae
MD5:	9EBB4B5C98D682A6FF7CB88C82737EA8
SHA1:	311D639BAF7FD13ADCE90359F4C227C65FFE58D5
SHA-256:	DE2E0B0A72C77E11AA89F9F015DE9F855457DDFD55FEAEB6450A80F8BD2A4172
SHA-512:	A818B70734C1C4A1E38D30D5DE8AD2566EE8ADC42B5F3BE442FE2AFC117A8E92C0EFA920AAE89E5D25F8A5DED0EE6B0540F935C21BAF8FB314CDEF49DADF6F5E
Malicious:	false
Preview:	Search for RPM..//If #6 <> "A"..if (strcmp(#6,"A")!= 0){...print( "Data invalid");...return;..}..//If #3 <> "2"..if (strcmp(#3,"1")!=0){...return;..}..print( fmt("%2.1f",double(#5))); ..print ("%");..trend(double( #5 ));..//If #5 < 0..if (double(#5) < 0){...print("Ast");...return;..}..print("Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-DAQAC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.746310062783722
Encrypted:	false
SSDEEP:	6:TFUJLlqaCl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9IFED:TKlZClXcIlWsr+lPDlqUllbglWE
MD5:	4FFECE5AE2BAD9ADD442C1F4232F1C36
SHA1:	3E59F3BC38034C8B056F5361902CA1C0A0929589
SHA-256:	D84C627CA0F5AA8DBE39BEF5A94AC0C8D26DDF41D0ABBFCCBF6F40B3C9234872
SHA-512:	7F9D547D5CDDD889F4D2F8B1D4CA02F74A02A992786D0BB3870AE9AB47BA76889615F94D5946F9A956CDBA9034AE33C2CC25348CE26992F88ECFD1C7FFA4F492
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-DH1P7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.465311532225101
Encrypted:	false
SSDEEP:	3:5NFDnLPJK2fyn:TF77Jxfyn
MD5:	8E1B99A19EFCD62F7EB311B674E77503
SHA1:	EF31D30BB09E3D5C59655FD12C8BA30B57E7C16F
SHA-256:	8C275429A39FA842B1011EF688D1A9CF64D1B176B57A5BD2F30273E3C2AC1780
SHA-512:	4236CDAA60778D18B833774A0E56F3C9880A3C0D6BD32B502F9CBDF587CF0117C6DAD12B990025E629A560FE0F7118F4C0FFDBBAC111FAD00494B40E02D4FDB5
Malicious:	false
Preview:	Search for ALF..print(#3, " of ", #2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-DIQ84.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.949310848764217
Encrypted:	false
SSDEEP:	6:TFYSLR32g/p3Fs64FErWq6s8rSj2rFsUFErWq6s8rSjviPSK:Tuu2glFsVkEFsCkBESK
MD5:	5A81B150E09A0F9F93F3A4DEB6DB92BD
SHA1:	175364DA54063685E292EDC910723E41649C1835
SHA-256:	5EF8606077590791B4FCDDC4A302D8D9810B9BD23DED5EACA67A8A8F733DD19B
SHA-512:	1C06CCD27BF59FC69E19535F01EFC78B4C53DC54121389CC481AA033E275AB8AEC36AB367699BD08CDAF991DABCCC7E00D195D34FD1AE6A774C858ADAF6D9CCE
Malicious:	false
Preview:	Search for VBW..if (strcmp(#9,"A") !=0){...print( "Data invalid");...return;..}..if (double(#8) >=0 ){.. print( fmt("%2.1f",double(#8))) ;.. print(" knt SB");..}..if (double(#8) < 0 ){.. print( fmt("%2.1f",double(#8))) ;.. print(" knt PS");..}..trend(double(#8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-DJ27F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.761977534984806
Encrypted:	false
SSDEEP:	6:TFw0dxLVJfIP8yU+UZIKrbU+bpI+U8avIKrbU+g4DTc8ynXKrDoy:TvdxrIPZQIG3RxG3X8Ty
MD5:	ACF74046391BAA4E7390974E507C5101
SHA1:	8DD10E331F58B2BF9774AEE6F383BBE10B3EF85F
SHA-256:	1D02561491D2A5545551EF971CAB3E4B8D26714E3F903CF7D46D802F046EB73F
SHA-512:	7A020E1ACEAE43049B15C88B4C003E262449496F9926DF8674C866CFFA28B57EF059D373CC683FDB655984DC4DEFE6C2BE0CCBE2BE829D4CCCFA78F839A86000
Malicious:	false
Preview:	Search for ALC..print(#15, " ", #14, " ", #16, " ");..if (0 == strcmp(#5,"3"))..{.. if (0== strcmp(substr(#17,1,1),"")).. {.. print(substr(#17,0,0));.. }.. if (0== strcmp(substr(#17,2,2),"")).. {.. print(substr(#17,0,1));.. }..}..if (0 != strcmp(#5,"3"))..{.. print(#17);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-DQRGB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLLM3vn:TF7/Avn
MD5:	1C2E063C6BCD44C523D9E78D999C3756
SHA1:	B5AC52FF3473F990224327CC5658120EC28103DC
SHA-256:	A46DE7EB623F4C9474D017EA92207FAC23FDF70F96BAE6E51F1B03082D96953C
SHA-512:	1793118BBF4146B72223239F190940C9B2EC2D4A59476013CD6C93E54221EA827F7CEBD143F64B82B33ADAAA3F73DC58F6FCCF5CD360D6E49A023A48DE2E7C2D
Malicious:	false
Preview:	Search for ALF..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-DTN96.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.671877762033242
Encrypted:	false
SSDEEP:	3:5NFD6b4Sl3vGHFxiGTMFK:TFMBlwPCFK
MD5:	BEA259EDFC463A9EC43FBDC4E207ED2E
SHA1:	C1601AC8E182A9D4551F27B8BCE4CB0F63976837
SHA-256:	91532963896577B118F6F6BC8B1F0C7219F0339FB79D0B6E06017C63480F7F76
SHA-512:	ADBB482FA9220796C8EF06E364B6C101D664D9299412C22C670F4D28EDECD4FFB6D61AEE1FEDFB79B2418173CC5337920672D8B229B3A23B39004A72B8D1A0C7
Malicious:	false
Preview:	Search for VTG..print( #6," knt");..trend( double(#6) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-DV2LG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.663562559067146
Encrypted:	false
SSDEEP:	3:5NFDLoREWbaIHwQwUWZhJHfHYQwUWfAfov:TFFWbpHwjUWZhJHfHYjUWfdv
MD5:	FB346936BED36B64AC998EF2A53CD3D2
SHA1:	F2AFBA975680B5AA92B14FCA63E921A9123A49EA
SHA-256:	46F582A8DA456A2B6DE6361541224B71B30C686513B85B9CBF735B0F1AC457BE
SHA-512:	83B8A3381784D3D8C834AC1B773A4D85979C0C4CF771CF958D0D7C00FEE43A62E7F307DEA074FA4036C139445EB6F5715377B2FDE2D5EE4F6A6D3D8F71EDFCAA
Malicious:	false
Preview:	Search for DOR..print(substr(#3,0,1),":",substr(#3,2,3),":",substr(#3,4,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-E0ML2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.465311532225101
Encrypted:	false
SSDEEP:	3:5NFDqPXMlPJK2fyn:TFeXgJxfyn
MD5:	311CF8DF24955815B91CD1393F535F79
SHA1:	931F4E48C02352D819E96762301180AEA5DEABCE
SHA-256:	6FC07E0BCE5A643DE730468BBEE08A4786D4AA4FFCEE8AF6BEFF553A878FE03D
SHA-512:	BCAD90CE973F2D4C2D22A82B01CC8120D1F28113E696796512411D09613211A2443B2634DFADA668E07538F32E3594965FFD06653DF42CDEEE4DCD50C1AF0A48
Malicious:	false
Preview:	Search for VDM..print(#3, " of ", #2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-E0RI4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6Kfovn:TFNpyn
MD5:	37D082C0B9E46111035436D10E4D26F2
SHA1:	F211D8942FB301E2492639A806301CAD2DAEAEE2
SHA-256:	F68F3F3B26B3AC3D66D09CE95449CCE47C2A4C40E5DA8FFAC6757600B171C9ED
SHA-512:	8C6F9905C7CA82674E0528C239CCD3E8F3FDD6C998E4D663A3DDC73D2BF6A62042C335242C62E5B9467937EC8C01F75418708830BF88820ECDF05906838C7F89
Malicious:	false
Preview:	Search for ACN..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-E5TK1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.75388313954079
Encrypted:	false
SSDEEP:	6:TFUJLlqJl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9IFErf:TKlilXcIlWsr+lPDlqUllbglWE
MD5:	E9877D384E5C1168A88FCFADB74A8A18
SHA1:	61C138793961D8934DEB325A3CCF99D1A6F1D1F4
SHA-256:	F1CBB3C4FD45F8A19957164589DAF91F9F0FCD2C27648AA627D8083AD6A1E46B
SHA-512:	7B95E8BBF20E6CB8FA32243900A6AA3311AF7EE2847E6D1C209DAA71CD07F129892F31E017C41E4D6FE9DD4F5488DCF29AB4D201F7C5A9F61CE357DAB1CAB420
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-EBPQN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.745088333690341
Encrypted:	false
SSDEEP:	6:TFUJVHqXlqJl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9II:TOElilXcIlWsr+lPDlqUllbglWE
MD5:	9693D534176220960AB34C9E62A6941F
SHA1:	6272D757BBFA0675CCAAD2BF5BC16D537FEF55BA
SHA-256:	3AABB0D684B14D6D68260BE831A8DD9F85E37E778FCA6FBF4861CE6E2DC3B539
SHA-512:	87F86D14C1BF4F492FADFC9F59A1858AF5080EBAC5799AFD9D666C3C5397BD40C116B09E0E30478B244670099A85126B8826AE19A2D79C3A0E515120C79F3023
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-ECL2N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.820807398788273
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlWXGjq0pxKGTHf5PYcKEZmFEruHhGu:TsT2ggl4GjVOQ/dYcKEUhGu
MD5:	6BE808A74CE47B0528B9CBCC39C3ED7A
SHA1:	ACD322442B017D1964C418A0AEAC83F78860541B
SHA-256:	8D578061B5B6849E2512A11121806370C8204C5731FD85998D5281644FAFB2C5
SHA-512:	B05C0979DBCD9D312BCB61D745CDAE1B2ACCA20F852994737F05375E7B81C3913F898C1E83D66E6B635B3246BD0275286F08F3E6170666CBA6CEDC6AC6C6D7A9
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-ELUQ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	272
Entropy (8bit):	4.90974697117534
Encrypted:	false
SSDEEP:	6:TFC5lqFrV2g/IGjq0pxeZTHf5PYq4eqLR1MY+:TU5lk2ggGjVW/dYLZ+
MD5:	507B4F77086B1C66594A122C2FA9A615
SHA1:	A02B83F06CB01673A464482FA59B8DD7FEDD18AE
SHA-256:	B413A64A383DF97962916B8D87CA28F6830BD9F029BB9DA6802CE6D709B00A0B
SHA-512:	D85E57E73F730579C9493F5A6FD9ED0C371918A2C0D419783288EA49BB31EDD359ECEE806316BDFC650037F3DEB2D958EB72EFC43966613C0548CFDE72F98200
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. print( "Data invalid");.. return;..}..print( fmt("%4.1f",double(#2))); ..print ("%");..trend(double( #2 ));..if (double(#2) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-EMSM7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLIK:TFN
MD5:	373EE063D70945C4FCBFDD3D0B0D6D99
SHA1:	5E865BB2D4BD1C9A3141FA74D92BA9B4EE52C299
SHA-256:	41DADCB9E2AA3C563100FBC18AF7AB43DC45E22403FAD0D438E5EB4C4CC3462C
SHA-512:	F369D374F2C73AEB6BC4B7795EC9234D761A63D664B89FCA9C3237A0B5BD53CCD2C4E4649B25A8C14786DB4507F6415E31521803564C678BFC1BDBA618EE3174
Malicious:	false
Preview:	Search for DOR..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-EN0SM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1408
Entropy (8bit):	5.038433372570456
Encrypted:	false
SSDEEP:	24:cS2RXjUWN+WVhNh2jUWN+WVhERjUWN+WVh++2jUWN+WVhpmLjUWN+WVhaC0mjUWv:crdjU5oL2jU5oUjU5o6jU5ocjU5oaC0O
MD5:	F0C6309B8F09C6AABC18A3C35C04A3B0
SHA1:	49ADB95902B14885E3C9E2415433BCA330D6A73B
SHA-256:	760715AAF73C02921CCF96EED146FAB312A0CB724B75D875B7F5172AA34CEEB1
SHA-512:	DC80D06AE980D9B5A498A95CEA8EEA9AF8717EB34A6754DD46E4294DC281975CB4BAD845A3D075CEDE437EC3FFCE47D7A307AE96457BEF40E76B0F15CB817476
Malicious:	false
Preview:	Search for GGA..if (strcmp(#7,"0")==0){.. print( "Data invalid");...return;..}..//if #7 = "1" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"1")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "2" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"2")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "3" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"3")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "4" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"4")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..} ..//if #7 = "5" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"5")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-EPAFQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.513794876803092
Encrypted:	false
SSDEEP:	3:5NFDWkov4FJqs3v:TFXooJdf
MD5:	455D0135D897C5650D699A71E6878DC9
SHA1:	E1EC5F4FE50F050733AE47E07E6E351359757229
SHA-256:	38FFAFD8AC7D4AC6F64060BFBA8B73EFC1A0CCDDA41B0E844A85F9870D144EF6
SHA-512:	F416C8573112A36278BDE6BC9F958E84F624D8FB65FAF084C5FFB7DD3A30207AB0065DC97184A09963F23CED50B08C0DF3579881E6C4D0D74B2DC3451617B2FF
Malicious:	false
Preview:	Search for GGA..print(#9, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-ER7RV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.85046698502259
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlaXGjq0pxKGuPYcKEbIAlFEraGDHK:TsT2ggl0GjVONYcKEbF/GbK
MD5:	A10463C3C0842E133ABC4347213F87A6
SHA1:	7D9D2E6058BC7F7BFAC4DB03DE62C170F88FF9D0
SHA-256:	07C6EC49AA759925B2D88816388E14B323CCD1DEA2A7388961FDCCB96C40F9E5
SHA-512:	8485FA3F62F26BCACA2C8B6FEA63E517B2E8D7B5A49B0FBD1E8CA6F716FC253FA3D4F9A2793983BAAC88A015EFF7A4391FAE49B6109267DA157AFAD64398BC3A
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-EV72D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.7951281103782515
Encrypted:	false
SSDEEP:	12:TOElilw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:aE4bIEygGeygIVHiygBKeygaf3E
MD5:	527D676855A12CC6E7EE5714D3F74B87
SHA1:	BC04027E3272ADF8480B3EEFC8213C6EC0295362
SHA-256:	F0269D190C07B2F57FCFF71B661994B4BA27FBC2C6B1F1549F0D00CD7481731F
SHA-512:	3218FB546D52760C229465386F1C1A8F4F133211F47A7641C0851F026A12D8487A07CAE24EFA4B0266ECAEC37B4D9B90A161E6852A7B5735B8882D89027D9448
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-EVMTP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLIK:TF7R
MD5:	EB99A7F3B37578E7415C92E9BD17EBDA
SHA1:	8E3FCD81FAE1A843490899E10FA2D5B046FD22EA
SHA-256:	F08D607372A08BACE7F7F8109F50E2DE63C57642120249DD10554F9841CB453A
SHA-512:	7EB56E2F8CCF7D5BFFE779AD0C7B9F3C81C37F4CC40BA4FEFD736AE54298F334CB69305F790ADF70C233B9D62A0026279B89B4BE1D87C0D3F856E173C4E42E6D
Malicious:	false
Preview:	Search for ALF..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-F816H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.638611091386151
Encrypted:	false
SSDEEP:	3:5NFDzLH2XUXmMJwQwUXVfHYQwUX1L4QwUXE:TFvUUlwjUlfHYjUFL4jU0
MD5:	5C0B309F240036081410AA92DF7076D7
SHA1:	20095BDEC142AF5DCE3B762A0739A5A63E851B59
SHA-256:	DF3B267C5D0F2C982061A4AB0F159025AE938E1B98C2B3ACB96CA622722A8262
SHA-512:	284B55055D3565121D7A96584940A91F02ED04214092F1B5DC8590ADFCD2F7D1D3AC80062D94613401586D3EC4515210557293B879E9E899F639BF2483830FB5
Malicious:	false
Preview:	Search for ALR..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5),".",substr(#2,7,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-FJQ4H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.465311532225101
Encrypted:	false
SSDEEP:	3:5NFDqcPJK2fyn:TF9Jxfyn
MD5:	3DA47AE3CC1B63DBB0E5F9350F8784BF
SHA1:	76416146643BB0CF86AEFC8B16E2B4E54587DBCB
SHA-256:	6DC4CF4218FB43B8AB9A84D0B76AAA04BB46B5F543269D4E82FDC9DCF70DC935
SHA-512:	7B3C2AEFFC0E1565C0B2AE29CA376A87A59A907065F14B9BA7A8F5722D00459A4FA99277BE4F063D0F2500732745EBA849A13D3F1220980E4E0C00E5144DFAD3
Malicious:	false
Preview:	Search for VDO..print(#3, " of ", #2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-FKLAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLJMey:TFhfy
MD5:	2D20F88549C5829DEDE2C95CEB94A4BE
SHA1:	FA8D11388086B160207445CF25EBAD46F4147130
SHA-256:	5F9A8DCB5EEBD14C48114274DEEAC9B104562C834DF91F43D63DCB09F0C8DAC8
SHA-512:	97C36A220C29FAD2737D77539715EBD31719B6005814C1690C2C0C7D83BE7C703EEFFF823A354769F5171F68900DD82B7B35493F1E36579BF8C63325456436DB
Malicious:	false
Preview:	Search for DOR..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-FMB7J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD9XKRPMf:TFZgK
MD5:	E95C5993F098E886BD6C41E43A693F2A
SHA1:	4AA814B4535550101591080384619CBF80B00B8B
SHA-256:	ED1FAD38356DC3708A188DD03BE161B4137A59F92ABBEDEC40BE8E9B6E1E6F1F
SHA-512:	9E45CF10AC8DFE603BDD90DDA30F41C935EF1F24CCA5A70B81EC37BEEB07471BF7CF01AA9FA581666546DC0070C17852181D915BDA868914F93BB9CD7EA0805A
Malicious:	false
Preview:	Search for HBT..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-FO6OK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.840521542776512
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlaXGjq0pxKGuPYcKEbIAlFEraGDHK:TNT2ggl0GjVONYcKEbF/GbK
MD5:	CA7B69D1559F2609B53E860BF0B0A292
SHA1:	EB13B6343D3D30301D081F99FD28C088109E2B91
SHA-256:	44BF74E05DCD9029CB2181C60D415EA1904E8955A72E529264712617A63272F1
SHA-512:	CE508FF3793457F32C9D1BFB0E93C2797A33F9A5DDBCADAA11136588537920BD97C7833EBD518861FC5BD1E0937258862D93279079DAFA95EBA6A6AEB173032B
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-FPB7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.769404604106139
Encrypted:	false
SSDEEP:	6:TFGVfIPN+UkIKrbeI+7IKrbb4DTcAXKrRy:TgNIPIUkIGUEGE8Jy
MD5:	438383B219045F831E489048B29EB845
SHA1:	A78C6EA8D2CADD8AFB660734E0A1F5C761EA1804
SHA-256:	338E94B600375A70754D6FAE00A3F9A0F2CD3BEFCE863801E1070B05C7351344
SHA-512:	EDC21AE7EBB638B60B4A76DBC40F2FF30306BF5DBD0198D049CC56976A42E7BD7CDD76F0C28B8C1992717011FED8EE71976A7BBAC87886A36118315CBEC9F046
Malicious:	false
Preview:	Search for ALC..print(#27, " ", #26, " ", #28, " ");..if (0 == strcmp(#5,"6"))..{.. if (0== strcmp(substr(#29,1,1),"")).. {.. print(substr(#29,0,0));.. }.. if (0== strcmp(substr(#29,2,2),"")).. {.. print(substr(#29,0,1));.. }..}..if (0 != strcmp(#5,"6"))..{.. print(#29);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-FRP96.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.926593677728287
Encrypted:	false
SSDEEP:	6:TFQSkXLR32g/p3FOmhIOFErWq6Om8rSj2rFOmjAFErWq6Om8rSjviPwmK:Tml2glFO9EW/FOKuWcEwT
MD5:	85BC2149799AFA3B2385521B3552C44D
SHA1:	DBB19E140D682C1614EF65B220D1A6327DD538FB
SHA-256:	5C66CC331BE38A2C573AF61BA0F5CF87EC8270385B2E315A3191AE2218608B68
SHA-512:	56773DF5B4E4DE02F0E3A34C7A06AE26550D76F8A99EFC31376057ECB1636394783D1718AA1C8B146B721BFE9F8E0CF64EE8C0C1AF1BFBF1FE08FB2519A75BD5
Malicious:	false
Preview:	Search for VBW..if (strcmp(#11,"A") !=0){...print( "Data invalid");...return;..}..if (double(#10) >=0 ){.. print( fmt("%2.1f",double(#10))) ;.. print(" knt SB");..}..if (double(#10) < 0 ){.. print( fmt("%2.1f",double(#10))) ;.. print(" knt PS");..}..trend(double(#10));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-FUK66.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.949310848764217
Encrypted:	false
SSDEEP:	6:TFQLR32g/p3FM6FErWq6MeOrSj2rFMg4FErWq6MeOrSjviPyMy:Ty2glF/7WFh27fEi
MD5:	43D922357AA1E841BAFFE7EAC7C3B85B
SHA1:	3492AF3DB18683C09F0593DC55B5173478E5511F
SHA-256:	2706E6405583564C001DE50314807E030FE92F9397661CA24A1273F826096913
SHA-512:	D486102B6F4C56D298DF511344968AC44512DF7C33B53F20D354F7C71FC23AEE75A72F9032D30C4686D5356FABDC842594458493029227F532E3A97AC7321A59
Malicious:	false
Preview:	Search for VBW..if (strcmp(#4,"A") !=0){...print( "Data invalid");...return;..}..if (double(#3) >=0 ){.. print( fmt("%2.1f",double(#3))) ;.. print(" knt SB");..}..if (double(#3) < 0 ){.. print( fmt("%2.1f",double(#3))) ;.. print(" knt PS");..}..trend(double(#3));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-G06EU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	335
Entropy (8bit):	4.848546118228948
Encrypted:	false
SSDEEP:	6:TFJPDGNZF1BmFErQBeyglqNZFvsFErvyglqNZFsFEr1JlqE3FErpKyGBk/y:TPUxIeJlYLTJlYHlpSKyGeq
MD5:	F0082F8B93998C20DFAE09D908FEEACC
SHA1:	4D667ED0366AC156C853852CAD0E8CFD8E8A56C8
SHA-256:	E065EEB1841342576E9310B55E6748A4DEE302BCEBB4EB12D7D7F43A5E843D8A
SHA-512:	E097BE83C46A5525941A9DF3206F1112FEA6F0CCD63D7E8DC3CFDB5CAAD8A4BAAC1017002E54A4BD2992ECA93701F153A9C4A8DAC7C43A91D948E865444B7B1D
Malicious:	false
Preview:	Search for NSR..if( strcmp(#12, "W") == 0 ){.. print("WATER REFERENCE");.. return;..}..if( strcmp(#12, "E") == 0 ){.. print("NON WATER REFECENCE");.. return;..}..if( strcmp(#12, "M") == 0 ){.. print("MANUAL");.. return;..}..if( strcmp(#6, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-G4IQG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.705744211903336
Encrypted:	false
SSDEEP:	3:5NFDvX9OJea4FFErQJF6+3Af6X9OJ0YdFFEro4HM3vg+3AGXKd9fy:TFqtIFErQJF6lF0YHFEroXYGMy
MD5:	2715FF2911BA3A29D21249D405C0E5DB
SHA1:	590F19DA5DBBB40241C612206FB99702C7E1939B
SHA-256:	BBF9BA7EEB2C08053285249143E42358FD08B009EE95B808ECA6D05DAAE356D6
SHA-512:	8F874F1C34286A399C11E9707591AE9A8C2254FDBB731E25320BE07365A99EABFE7A4ACF8DFB478E5FB94FBB6C09E47E60883B3851E35A57B2106F1FEB8F41B3
Malicious:	false
Preview:	Search for TRD..if (strcmp(#2,"1") == 0){.. print( "BOW");.. return;..}..if (strcmp(#2,"2") == 0){.. print( "STERN");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-G701Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDz4PMf:TFHqK
MD5:	D0E0AD37929DCCB878628533F0B3B540
SHA1:	C43241D4ABD8DF413F30B7773452557C9E5F6192
SHA-256:	CF2E6F978624642C121F5F95B5A2E180C0E3A06B74D9010316A9817B3C76CCCC
SHA-512:	5605176FA7EF9B939444C1629E9DED71AF3471DD959415A681D6F8F6FCCD0B0631E9356738DC7CED3A12E20C5784AD94CFB313E47F61849D8DDCEA57B7A29C5E
Malicious:	false
Preview:	Search for XDR..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-GCML7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.895832548462717
Encrypted:	false
SSDEEP:	6:TFCwxXluJimFErV2g/IluJgXGjq0pxCBvTHf5PYhtCFMLR1MY+:TUwlJT2gglvGjVeb/dYnF+
MD5:	637A504659642736DE8C2AAF3D7FB765
SHA1:	014495C70DE3217CD793DFE9EE4794845D8DA50F
SHA-256:	D2A06CA634D6F7C2FF0C68B32F4A114E433143047DF6ADA772864F52454DB311
SHA-512:	B0E921AEAF57CC65D0DBA82579907EC59C8C06873F5934216C7A887634E33572590E6590932ED88FE9734AF9CD35B97FEF0B894033A43912925DCE29370A764D
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print ("%");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-GLN3L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.8451834689284174
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlaXGjq0pxKGuPYcKEZmFEruHhGu:TsT2ggl0GjVONYcKEUhGu
MD5:	35685D095FBCAB305FA3A0352AD5589E
SHA1:	E0EEC1D76748418FE494CA4DF75D3F423D0EFAC6
SHA-256:	34D05B420C46C068E72B145157E3FE6D43EAFAF9AAB868B0052DBEAC5A5EC3E0
SHA-512:	722727ED9C54B664C41097F37AFE491D7869613D63D165D2AE21B3B23C5BAE5059AD204145CA6CE2F15FA8814C8BA8351AEE5BE1E3BFB24E3BADC84A9F8A0D96
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-GOOUV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.826179438139153
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlWXGjq0pxKGTHf5PYcKEbIAlFEraGDHK:TsT2ggl4GjVOQ/dYcKEbF/GbK
MD5:	E721D25F232CE982F09B71FD82E96FDC
SHA1:	3676273D51B69E515D066A5ECA7ED76069E0B8E8
SHA-256:	DD318DAC5932ED2B1F72E67A59872DEB46EFB353FB8C3D05541AAE08623D69D0
SHA-512:	B6B0704F3772C48D823AC94AA7D5744A432F82270C6CB83316689FB046134F4CAE684FC31FAFBC65C9A24690F007CF46C706364BEF5402D05249E0B43B61FB16
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-GPEBA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.701649204701856
Encrypted:	false
SSDEEP:	3:5NFDMoN6RnRQHFxiGWEovn:TFwoURSPMBvn
MD5:	14A2BD450B44058474EBA3793E1BB278
SHA1:	10F5A2945BFB2E69C3E389FE09622C37CC3C24DD
SHA-256:	3F90F83BDEF9817589E1384E5BE0ACC1F0A57EA6223C6F520DAC186646DDA174
SHA-512:	160ECCCE42C8B4D6B2F9B58D52472F5C1E5BAA4A2DABE6DB1FCF3E1EC05ED862BB2A8DA18AA50667813F02E158A9233A63B24A53C28FC944FF831DB0213973AF
Malicious:	false
Preview:	Search for DPT..print( #3,"M");..trend( double(#3) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-GQB8S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqcKfovn:TFoyn
MD5:	05BB90FA5D5E4616B9D935D418A08574
SHA1:	1E08D8209AC1C44A92B6550FF7B5FB941D6CCC7D
SHA-256:	62AD1D580F42EB1890EF1CD15F2DA204472613B1C6F274EC6D1249E89762F2DB
SHA-512:	C1D7224EA9277C26E4E0F20D3626812013871D1D6E5C747D2868007B216DEF14E4642EE577A4DF2EFF3B4B9131773746CFF27C961E8B0B0C502C8E41C378ADB7
Malicious:	false
Preview:	Search for VDO..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-GSU5L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.780616778028722
Encrypted:	false
SSDEEP:	3:5NFDAxfwRWoOJgGm3FFErFM3vFv:TFPRugtFErFAvV
MD5:	B8AEEDC64E02ABC88806B8C721D5100E
SHA1:	6C77EE37C03CE41E0F48542ADEC9C8F9A9348B6A
SHA-256:	C6EA968D3E40BF8880A990FF84285214155E5815D8A3D950912D16C9518D98B7
SHA-512:	C3ACC29CF676F4D4196E09102ABF181B131D55E369DDF6BCA507F66C0063D6B3FBF676F7E2F48DFD6BDBF536B379B684B59C6B97423DC9477E23E2CF87578233
Malicious:	false
Preview:	Search for WAT..if(strcmp(#2,"E")==0){.. print(#7);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-HLRUU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.712993984287172
Encrypted:	false
SSDEEP:	3:5NFDVNXKSOlgvGHBloFWv:TFbXOfPYo
MD5:	8A2C9B039CDBFFE8AD9AB28EA521E3EC
SHA1:	F26BB27B63231742AD316AD9E7C3C98438FF2288
SHA-256:	AC61D0772173E6853DEE105BA02B6B42C91EB5A9A7A3BCC99A677F71ADB7C9FD
SHA-512:	5DB3CC9604B9586F81081A56C803EA4F10E211D6A1D33888BEABAEC438D4BD43A012E6B72796D579BE48079C63C21B92B9D8F7F7137136A94E358922A5EEFE1F
Malicious:	false
Preview:	Search for MWD..print( #6,"knt");..trend(double( #6));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-I5I4L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.8451834689284174
Encrypted:	false
SSDEEP:	6:TF6mFErV2g/IlaXGjq0pxKGuPYcKEZmFEruHhGu:TsT2ggl0GjVONYcKEUhGu
MD5:	35685D095FBCAB305FA3A0352AD5589E
SHA1:	E0EEC1D76748418FE494CA4DF75D3F423D0EFAC6
SHA-256:	34D05B420C46C068E72B145157E3FE6D43EAFAF9AAB868B0052DBEAC5A5EC3E0
SHA-512:	722727ED9C54B664C41097F37AFE491D7869613D63D165D2AE21B3B23C5BAE5059AD204145CA6CE2F15FA8814C8BA8351AEE5BE1E3BFB24E3BADC84A9F8A0D96
Malicious:	false
Preview:	Search for TRC..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-I6QU0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLJMey:TF79fy
MD5:	F8E47A12FDAFD813A4C474559DEFB2BB
SHA1:	9EEAF0625C7CECC62672D016C68591416B57949D
SHA-256:	D90C6DAE455B2A8EDE5F43328086EC99C823FE19FFCF7924AA7FEBCF7FC1EE16
SHA-512:	1732881E68E7B76A15B479CDF8AD46271C93F19D2ABF90DF41256A7B2A28F8FCC2711134BCF6F1B6133AFE2398ED0D1D7CCAE3627768C2131E98CD47760FF72D
Malicious:	false
Preview:	Search for ALF..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-I6VLH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDzLKfovn:TFvyyn
MD5:	A6D29947E6D1CCD1A80D7B498DEC57BD
SHA1:	6A4732289382E2D3ECCC008C9143382DE9DA07B0
SHA-256:	EB697D5E0B8899152BFB76B218ED20B7CE82E2FC4B3B726568FA1CB12B57522A
SHA-512:	73B7131ACC17CDE1413F4F31DC501BA03A38F0BA7574976FE67F4559FDE6BB1783D468E29769E9A8BCA8460F48DFFF0D6F3CEE877B3A518A2B1D4A670E3BAFB6
Malicious:	false
Preview:	Search for ALR..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-IALN7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6EK:TFdW
MD5:	61A2C7A8666697FEEC54D6314A6CB83B
SHA1:	A343380DB8444F715880340AA541644B989F30DB
SHA-256:	A809C0BB40081049726DD6D08CDB591F933A35CA3195B64C0584B65D188F5299
SHA-512:	9C81E2FFE5A2627D0E7141A55927DB50F1819E2A644F8EFAF3566C2D67CE1CB0240096B24F91A29C42272AB329F4B37957B2BE21927533C23725A212549447C9
Malicious:	false
Preview:	Search for GEN..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-IG21F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.446439344671014
Encrypted:	false
SSDEEP:	3:5NFD3fN63FpuMey:TFL12FVey
MD5:	2BB372B7E8492E7FEAAC268ADA2AD868
SHA1:	69FC162A1056F8DB0AFE36B0C180121928D4D3E7
SHA-256:	A98D3BD218DAC4F7CA1513AF80DA5ADFD3DAA0C63154F7A2043F4B089B87EDF8
SHA-512:	E489CC09534F55B16F151B697CC90C1CEFDC37ED96FCEB7DF46AC1D6B8B8F8ABCDBB0795DB2AB92C4A1B8A9487150BBE7A768BEE60B711DABF306FBA3E451038
Malicious:	false
Preview:	Search for RMC..print( #12, " ", #11);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-IRFAR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDzLJMey:TFv9fy
MD5:	88C9E487636A2C623D9B5F05E9FB49FB
SHA1:	192165866308DBDBDD9BB99D02C34879F89D722B
SHA-256:	0E404DE519C37D71714E450710D8ECA3DCE6AF154BEB7925DA9946D542B436A8
SHA-512:	9DCDB5BF2606C6AC3F439D9BD8DF263420CD02F57A510992443FFDCC442ACBFA711AD48EB077662F7ABAD1B553AECA36AC8ECC4E6CE263285C901FB06597E410
Malicious:	false
Preview:	Search for ALR..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-IUIEQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.39212668463354
Encrypted:	false
SSDEEP:	3:5NFD5KGv:TF1lv
MD5:	B050E06A5A0AFCE12467C1D9CFB087D3
SHA1:	F677E352C8AA84801D4D1A8BC5B8EB555C49E74D
SHA-256:	052EEA304152D8F7809D1D3AE836E70F8C429A564428838E8D2ACBEBCE82E304
SHA-512:	EB54DDC4C862753A15C0B504FB4B3A3BF1736517A0ECA6B97D21B66F50A6F033A1F4C1E664B025EB128E762B21ED3447D794AE9EC9D97E7EA453F7A19AB82A23
Malicious:	false
Preview:	Search for TRD..print( #7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-JI19B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.780616778028722
Encrypted:	false
SSDEEP:	3:5NFDAxfwRWoOJgGm3FFErKW:TFPRugtFErd
MD5:	E0C43B0FA18D0BC53317216BC60D927C
SHA1:	2287EBC17021547317C4BC5AB4F573F32E57BD40
SHA-256:	F1C82A11640ED06A5FFDE403C274130AA9E079729BDCAB2694BDF39D4285EAC2
SHA-512:	09D1FCC202F9FF3A8012C7A3F3880BA981E986AAA694D4959AE7D19C4AA85D0ED9905AB67557A50D2D69949F718DE793C87ECC779C23D851DAE989C610B6DC07
Malicious:	false
Preview:	Search for WAT..if(strcmp(#2,"E")==0){.. print(#8);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-JRP2R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqPXMlIK:TFeXK
MD5:	106F6AF804F815B13FC1EDDCC7105C18
SHA1:	5BB342EBD10D48BECCECFAE3E9C784F73E930DA6
SHA-256:	9BFEC9C5321E993AA678460F6C390A2C327A76251DB924A62F91D2DD41407D51
SHA-512:	4083EF6198B813D263E6CDE4D9B0198FF595AEDCCAA5449B745EC4DAEBAFA78F3A49903C435D313CC1C878A7F498CC807A2BD1FEF0F731E1001F28EC58B84663
Malicious:	false
Preview:	Search for VDM..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-K0VIE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.691435688769648
Encrypted:	false
SSDEEP:	6:TFJPDGJsFErvIlqJvE1AFErYhlqJnx3FErpKyGBk/y:TPQrIlc2qlcxSKyGeq
MD5:	3D4CBE7AEDD94C56EF4379BB8D6850AD
SHA1:	45F1268A0D729945AC52A781E12404686A3680AF
SHA-256:	7E21EC51BFF36A23212FBEAED9A4674A1E06EF9F38B8F62B8175849BFD8216AA
SHA-512:	2B53AD41FEB1E9CB40B65C02E75E7A5766BB45F0DD60D55612A567177FB90B0914EADAC89AAEFF85FE512E57179A1577FC482F5C1A55B90D2AEF5035D2208883
Malicious:	false
Preview:	Search for NSR..if( strcmp(#5, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#5, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#5, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-KDFNE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.51364592935837
Encrypted:	false
SSDEEP:	3:5NFDf2plNUkgv:TFbYe
MD5:	41AC3657E10721B2C08C463DE2B9FAC1
SHA1:	9C140F8D2119D55E52E7F34D7930476992C38146
SHA-256:	C35B2FA855C59579C853C589BCAB8EADADA0F3A3CB55262ADBA75D835638AC80
SHA-512:	EF8F1C4844ACCFB9D2D93C2329BA6924809CC819FEB9AF3FA521DAD080DE3648FD39ADA90389041B481D60823B03338D8BDA84507E4C60C3B2F7EC58491D8289
Malicious:	false
Preview:	Search for GNS..print(#11, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-KIVRO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.835201992471304
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlaXGjq0pxKGuPYcKEZmFEruHhGu:TNT2ggl0GjVONYcKEUhGu
MD5:	E9CE55A0DADA85DB6F8198B58489880B
SHA1:	0E52C0EE4D784BBF5A6CE9181F3D7066EB0CBABE
SHA-256:	BA4C9E117A396B445DB20E82EC4AAD5A70BBD5EC203E29693EC11966B6AD7C7A
SHA-512:	465C6725B6D30537E31B30E09FE45DD8451841F669420FC7D499722D18DC9380A9BCEC25D4D0937FEE3F4413141D6B9B5D9F9E5CB9170AA116F94D7514044B08
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-KLEC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.800354488990939
Encrypted:	false
SSDEEP:	12:TmkEClZClw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:qkECSbIEygGeygIVHiygBKeygaf3E
MD5:	F8FBC44969B2C7264E441F87F082A313
SHA1:	A75D8C644BA47D8DAFF3259F116C0C77ADB0F01F
SHA-256:	BD107D1C802600B57695A41732034B5EE49FA9A0FDC52C2F8523E4E2C8DDBE34
SHA-512:	D7AC08E24CB04C4E79370FD9F386AD7290FE0D76FA196481F71C117AE6669D5416E1CE23E6036BC55E31F00624DAA63EBD30CCFDEB2638ABC7F6D8080965961C
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"2") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-KQ6M2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.45148902643068
Encrypted:	false
SSDEEP:	3:5NFDBlQlw3v:TFgl8v
MD5:	045D7D9A42FD731DBBCD9B80D243597C
SHA1:	CD8F08F8AEB6895990F8F215802598A18B843AC5
SHA-256:	ABED1A53898E81035E095B31F7B219CAE2C396DAF3426A68F46EFCCD78EDEE26
SHA-512:	0D0348129259272924785D3BA72D19F6CF07DE3C4A3FAF5C7EAB81649F1E16E44D8C9D054A4582274690246C6231985DF8B949E121659077C037761DFD2CC49C
Malicious:	false
Preview:	Search for HDG..print( #6, " ", #5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-KQ9NL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.729821516759323
Encrypted:	false
SSDEEP:	6:TFJPDGNv9OVFErvIlqNv9YF1AFErYhlqNv9d3FErpKyGBk/y:TPUv9OEIlYv9iqlYv9dSKyGeq
MD5:	280B6AF1185F7B8B63C0ECE4DC27DCC5
SHA1:	F751FCDFB4D18B805590A04C4CD895F40C0A6D14
SHA-256:	F5FB506983D2B5E2E429812CF07ACB541C0D106548AFE19DED29E907869D48C1
SHA-512:	8DDE452FE3E6F32F0077477B6556F4D2CE80E9612718A137764F0941EFA1F3F9A04A679038545E6C35E0B8B6ECDF37338310A3EA8CF53AD57E523B6944C19426
Malicious:	false
Preview:	Search for NSR..if( strcmp(#14, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#14, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#14, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-KRIRG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.465311532225101
Encrypted:	false
SSDEEP:	3:5NFDiLPJK2fyn:TFyJxfyn
MD5:	BEEC164D879B76B8CEF36CF65E5BD193
SHA1:	31147658B8AABF30E8116B4A75D88C4135E1A733
SHA-256:	89A2A2D05574C50E23C202297EF8F324C67CE3D797E1A85DEA66FAA1BF0BA16C
SHA-512:	1452122D38BB9D21A696D513CE1D01125DFB31A1B96098C0C84C89F68F74AA74A3E65D7813172F9C60EBB08922FC86E9B70D6C090A0AA461FEF4D5F74B9BB851
Malicious:	false
Preview:	Search for ALC..print(#3, " of ", #2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-KSV9V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlFMf:TFLZbK
MD5:	9001A172EA40F02820340531E7188A41
SHA1:	DAA459BCE4ED5638C033AA78879CB220C470A64B
SHA-256:	7CCBCE4B9B81D7584360BB0D4F4D8ABA0DC223789F771B8E9B6F294CE563F85A
SHA-512:	3E090E98D581D96E3C366B6B718CC37213ECB2B7277B3523DF84D686B14E833848DDF32883AB83BA2A656937D9B9F416C9503BE8BBEFD8F90947A6FB2B7F3093
Malicious:	false
Preview:	Search for FIR..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-LAA8P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.890640573785258
Encrypted:	false
SSDEEP:	6:TFC5ls8mFErV2g/Ils+XGjq0px4BvTHf5PYd4qLR1MY+:TU5ls8T2gglsQGjV0Bb/dYd4M+
MD5:	CC0DCCF7D856C09226307E643DE76305
SHA1:	7DBC9846AB12E144424603FC38B5A4393EFA85DE
SHA-256:	3FF791F5DF797F7D2840960CC389C543E9A1E7F2B96343A5D146FB8B99CCEFB5
SHA-512:	22CD718C9CC08F3EA4C33A675262F2969839AA72503FD7842BD1FDF198FAA70B2EA9CB5AB737F8571768CD1C1B836F49B3070EA1EABD703A8FEB1F338B04CEED
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("%");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-LF5UU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDWkov4EK:TFXo0
MD5:	9144A00B8E011154BABD1F2F5F3E2CC7
SHA1:	BB00596141A253C22DAC710FE386FF7F64592BAB
SHA-256:	2F2E531D5B52600A1233F75B00671479F7E60D98D9D578D253FF07C71541F47F
SHA-512:	95A37F16933EE6C8B911453DE5573E22AFB3D549645CC45B0705458648539605F3A89C67F97B11F78F8F156F3F89C8426B45B4E8CF020C1EBCFB0D4B77D1CDF9
Malicious:	false
Preview:	Search for GGA..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-LH1VO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRJMey:TFfcXfy
MD5:	E5104FE97581BEF75F2F57EF92B45E72
SHA1:	0614F5E5E1ED319462782F2C22833028F12777AC
SHA-256:	1CAD7906E681EA601DE2D981B44B094B478389624CFFBF052FCC4051CCF430FE
SHA-512:	ECF89F84DA248D9B4D5F01028CBEF82E3303FDF16519CD284ABC47EF5EE4CC8CA96EA4CE9809C5633E87DB138FB36A41786B58B3C2CC642517C79E9C0D9C7CF8
Malicious:	false
Preview:	Search for WAT..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-LH5CL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.916832398504472
Encrypted:	false
SSDEEP:	3:5NFDiX9KdY7vFuLrVJJSiYgaQ9KwVKXMLrVWEBiYg3sLrX9fLy:TFpYryrVqi3oKrVWEBi33qrBe
MD5:	9383C4474395637C879AC50FDFB42160
SHA1:	D184B1A8926F6764190D97D01644998907ABB5ED
SHA-256:	2470E62B8A609575A955AC7D404C265AAC73830A2BA469CB611DC4D280790683
SHA-512:	1DA884932ED46FB6E25A7F597F1BA00547CDC8FD388962809ABEC991407C43B3001B9812CB827F3B9723B461D15560B099D75D3BAD7AE73690CE5AE50E8D6DD6
Malicious:	false
Preview:	Search for HRM..if (strcmp(#6,"A")==0) {.. print( "Data Valid");..}..else if (strcmp(#6,"V")==0){.. print( "Data Invalid");..}..else {.. print( "Unknown");..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-LJ84V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.746718472943976
Encrypted:	false
SSDEEP:	3:5NFDAxfwRWoOJ2P3FFErFM3vFv:TFPRu2tFErFAvV
MD5:	6453618412AFEC72B6140D2FF66768D7
SHA1:	45FD618BB7826C8DC893ADA2910F0FFD987A358B
SHA-256:	B8EA611B2225D0D136364BFB52177136BC9C940E8CF0E5BBCB6ADE7418B22C18
SHA-512:	29A858050779F081EA75E855C172C08521336F480997B0E16154374060E2357FF6070E08062F17CBBA5B7650E2FDC38A5DFE377DD93A9E7B956151FF5D6F36E6
Malicious:	false
Preview:	Search for WAT..if(strcmp(#2,"S")==0){.. print(#7);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-LK88S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.97019263177749
Encrypted:	false
SSDEEP:	3:5NFDdGvM6X9LJE3HFFErQireJ+3A01XK8afX9lGYfPGef4vuLRoRETt7wQwUT3lo:TFZ4RJYlFErQWY2Y8UX9cy+AiurRwjU2
MD5:	0EFE37AC4B0C82A7546AE47F8AB7AEEB
SHA1:	931F675C695AE4F4B0605CFDA09166D2A2F652AB
SHA-256:	B4E864C01FC97691D3265B620016CE8F7496FB8192915FDA5143D95360F07E5D
SHA-512:	B2859CD939F1BF3ABCC85D1840993FC0845D2E311E315ADE5C546F41DACAD1BB6E770650C6238EED3EEC058576144CD738577DF21ED4599EC60CD01EA1900AF6
Malicious:	false
Preview:	Search for GLL..if (strcmp(#7,"A")!=0){.. print( "GPS failed");.. return;..}..//Print #6 1:2 ":" #6 3:2 ":" #6 5:2..print(substr(#6,0,1),":",substr(#6,2,3),":",substr(#6,4,5));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-LKAV8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDi7FMLROLrnfn:TFmtrnfn
MD5:	C1C3E489BDFCB595936BEE9F23E07AB9
SHA1:	4943D56DFF09417E7556F046B21D0DE5502C4233
SHA-256:	AD6AAE11EDDF445AF7D2BC6374D739BC5201920F22DBE7605E2A90CED19CF27F
SHA-512:	DDA5098873EB253144154B00F6BE89AA634174EF4186480C2E7427A082B729328ACFA11F5FCAE81988E1683A14436272B430C946864AECC740CBDD69A776250B
Malicious:	false
Preview:	Search for VLW..print(#2, "nm");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-M1GUG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	5.044294068122479
Encrypted:	false
SSDEEP:	24:cS24X8UsihUXm2UsihxX2Usih+TX/UsihfXAUsihfXsGUsiZxe3TBsoRc6i:cr4X8UsihUXm2UsihxX2UsihSX/UsihQ
MD5:	57E9FA9E28F39969316E1EC751353C10
SHA1:	A5967B1F2660309061C61231C6BE5548755B6C89
SHA-256:	835706390F3CB5465C2037FBE276A3587B11D9F852118A32925BBE1D2E6D0D92
SHA-512:	9E859AF9F4F9E43DB66DC10C9EC3594E47C2538D411AC07BDF8FEAAA51B36D749E9690D21E1EC79EAED5E5C7BD9271057AD2C6C15911DDE4BC683BF59412E3AD
Malicious:	false
Preview:	Search for GGA..if (strcmp(#7,"0")==0){.. print( "Data invalid");...return;..}..//if #7 = "1" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"1")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "2" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"2")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "3" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"3")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "4" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"4")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "5" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"5")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. retu

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-M4RJ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.782551202337296
Encrypted:	false
SSDEEP:	6:TFJPDGNjXk1FmFErUd6lqNjBsBmFEra6lqNjDk1FmFErzzIlqNjJR3FErpKyGBkq:TPUjXkPuIlYjI3lYjDkPZElYjPSKyGeq
MD5:	8049B7C7FFC37DFCC65B25CF167A1283
SHA1:	41F07E754FA606761E5BCD49C7BDA9A60939C359
SHA-256:	E80F009AC8F3B85A93549E0E065BDC44C12F611C397D030F260A8FE6C6451111
SHA-512:	C77B800C8F453E73E4A5B92D72279B993CF5B01E62EDDEB89BBDE1B75E01EBEC43A474B642A35766EA5012A2036F2E03B4C7436501DA93CC315EBDCDFECC1FF7
Malicious:	false
Preview:	Search for NSR..if( strcmp(#10, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#10, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#10, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#10, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-M7QK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.7261033495736084
Encrypted:	false
SSDEEP:	3:5NFDmB6RK6O3vGHBloGTMMf:TFoZwP8K
MD5:	73F8A302CC3C78B4261A50EEF951C167
SHA1:	FD6EEAC1F239C10B59DE6DED07CE080C43EB0DE9
SHA-256:	2688E08E0294A745DA91E029C564D67DC4CD21776CA4834EF3C637C2764CBEDE
SHA-512:	094459E956BC92567F100902FCD687AFB233530B4C97C09DD873AD9F7002E4AD8F8306C58510BA669707A7B87EDAA4620BBAE9EF7F758035422799E849B3FFE3
Malicious:	false
Preview:	Search for VHW..print(#6," knt");..trend(double(#6));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-MBMPE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.704716914248863
Encrypted:	false
SSDEEP:	6:TFJPDGNQDsFErvIlqNQTHE1AFErYhlqNQLHMi3FErpKyGBk/y:TPUQ/IlYQCqlYQgiSKyGeq
MD5:	B430A4A044F8E604F3D41A9752DD6F56
SHA1:	221A0036621A739D9636C831ED7561A6E8DBDDE7
SHA-256:	412090C03A7D4C60AF70264F11DC5DBD9A6ACBCD66B3DE81F79FEDA526F95A12
SHA-512:	FA82AD5023848037A127577BD5F999736307A82CEC5830BA53C117A4A9E70C39E29C5B846A37D6B5F46C4AB35B15949CEE6E079F47AB698B6906947B951149A7
Malicious:	false
Preview:	Search for NSR..if( strcmp(#11, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#11, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#11, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-MFAUP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.788075985119281
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJ2euo+UoU6X9PMMco+3AGXKc31+CQHFL:TFaoEFcrV2g/It2e9vfq5GfkCSPmW
MD5:	1F0EACFA3C4DECA6E43B4D7E8985292C
SHA1:	42309AD550D90C8146B4E8C05702D969A61367D3
SHA-256:	7ECA65CF1D25A6477A8BEA0171B2833A1CCC1F5974AFF8E1AD86CEE0D4126E59
SHA-512:	325274795B4F84694D1B262FAC2F5CB4544EA952A1C0E2891DF2A1DD6BA9490C18283AEDEBBBFF0E6CC8961E33DAF5D8A6A670A133ED3EE1CD0B76FE53923C94
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"S") != 0){ .. return; ..}..if (strcmp(#3,"1") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-MK9H3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6EK:TFi
MD5:	DF1728A7643081E7A94D07541090BF14
SHA1:	645A91B67B8339EDC946057D0DAB3A97F34922D2
SHA-256:	835E85143CE6D5CB78435763641ABC89D81BEED4C010A7A314F3E27FB8C98EA3
SHA-512:	E31DAF5F1D0C872FEF48A7A146924D10289C84BC5EC388CE3D928885EF61D358625DEAC572B15BB429BDAF5F700C914EB7F9A9FE0413A38BD1FEC84AA752698C
Malicious:	false
Preview:	Search for ALA..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-MMOJM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.895840154756691
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/Il0XGjq0pxMeTTHf5PYJIMgeLREH0Yu:TOT2gglmGjVXv/dYJIhdNu
MD5:	CF43C3C7BD49EAAB06248A5406A9DE63
SHA1:	CB83A5508051208D73DA310D9D53093584760459
SHA-256:	ABA5CB312F72847FE14F09D8CD4956B31A672311DDAC002B53773BDC81B255D0
SHA-512:	94CF6D3ED4685A31C7A36E9DC416AC02954CE97D1169358DBEECC99E09B07D1C7A7F5FD9F6D060F1C7FFCEEAAB12B4F4B9B4AA4874094038FE923DDE07AF1C1E
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) < 0){...print(" PS");...return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-MNHNR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFDB9KRsfZHBloFifn:TFN9lPYif
MD5:	3EFFBACDD60F7332FEB020A732349A0B
SHA1:	83D8E79196137D49BF2CAC30EF6946879EF293FA
SHA-256:	3E46C33790B6702B23DFA43946A7A571D30DB08C559F4C879750BB085E6FE3EE
SHA-512:	D9BE39A0CC32BF77158462C40888F1B557E793B465F2BEF4C172FD56B156B17F665BC48529D7726BCB4BF13D330A6E806DD2409B8EBBB72CFDCDA7E492442848
Malicious:	false
Preview:	Search for HDT..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-MNR71.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDiLIK:TFY
MD5:	9CB7C3DF11E3C07CE792D7CD9698DB1B
SHA1:	AF6267D61A07420348B8EAA6F6485A6F83FA7B43
SHA-256:	8470802DD4CC21ABA24100A2EBF6BB7C5E5EF1F3A86AA29E5FD440B7DFD52D60
SHA-512:	49E9E762B70CDC137DA4BA16E28CBF2459A55C3DA5AC8CA50C1F3891D5193B99028F620477EF1CC3BFF3780ED54666DCE7FCB86E11CC8BC1A5183B632EA23AFD
Malicious:	false
Preview:	Search for ALC..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-MNTN5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.75886148871991
Encrypted:	false
SSDEEP:	6:TFVTkcrV2g/I9eMFEr+1FeCFErNqwPmif:Tz2gg9P1F4jm0
MD5:	C26B9D0CE5EA6FCFC72F9C6A1C6CC555
SHA1:	E6CE74625BE91C88564BC46960F8D289AFF50DA1
SHA-256:	6BFBF38963369154353C9C11C6AADBE694D674B958B74E7A24D82D80AAD20DBD
SHA-512:	7A0FAC80933E672E99230CB87B042B489355B11CCDB5F85B286B1272599CBD1B4FA88C7C898F4CED562312812D04DA564D312FC9E1AD8E128C974FB3E14F58CD
Malicious:	false
Preview:	Search for RSA..if (strcmp(#3,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#2) > 0){.. print( "SB ");..}..if (double(#2) < 0){.. print( "PS ");..}..print( #2 ,".");..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-MT376.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	62
Entropy (8bit):	4.887438802525302
Encrypted:	false
SSDEEP:	3:5NFDNl3fYovRQHFxiGUm2eov:TF7fYoJSPOmI
MD5:	6E0A62FADCDE084C5C231B29BB9148B0
SHA1:	410BBF6819B1EB36CED8E54E2835CF7407359E93
SHA-256:	EFA8E459F1AABE9F00550585A26248270BB02D441E71954F12700982932CCE4E
SHA-512:	371E8B470118593387DFD729AA957F9CC19C6653E2FC6DF1FF3558040A2B3EE872904AD7C664D020229E5C419726FBA2A8E83C840FE912B3B4DD75C2BC02F908
Malicious:	false
Preview:	Search for HTC..print( #10,"./min");..trend( double(#10) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-N33KB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.730915395146161
Encrypted:	false
SSDEEP:	3:5NFDHFMlsfZHBloFifn:TF7PYif
MD5:	04E5693FF20BBBE70605F7D5ECA497CE
SHA1:	0B8F4304DDB780C96825F536E847260C67849E27
SHA-256:	34CC3E64901E67735E101766350084174FCAEAE693C445F5B4CBA04AC48CA9D2
SHA-512:	32C024BBD8D56ED6AA8ED005C15F6814D4E149BF11DAEA045EAB4B6FC49104FEA986F256A782D4D2E8816C2E0AE9264EA57DB16D4CF6D1B96A09C35FF83E3F34
Malicious:	false
Preview:	Search for HSC..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-N4GM3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDUq6NUAv:TFdSJ
MD5:	617749B1BD5871A5B249FF70A9058361
SHA1:	2DEDAB8DE8F802F1A71612953DEE579B5DE07DE1
SHA-256:	87FB54199E318D10EF1D5A292632982C73A8AACA64E19463A366875760662CA3
SHA-512:	552FFB707ABDE69159DFEDD65D7F435433D954DB140A07D721D685CABAB6B4A65C67D287A1D1A6C8B16640CC675B45436680BF4C667E7A583163765F24E11506
Malicious:	false
Preview:	Search for GEN..print(#11);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-N74PV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.742918596477533
Encrypted:	false
SSDEEP:	6:TFIQazfIPQ+lIKrbkI+FvIKrbXp4DTcTXKrjy:TOhrIPrlIGC+GXK8ey
MD5:	CE59AA836341199C42FC336B910A2F28
SHA1:	A5532D58B2F6D7D850BCCD1CA688B99BF6773B7E
SHA-256:	45ACB69A6C0E0A76C30A7E7716A731EB131697BED19CDD8BD6EA549704AE5268
SHA-512:	38AC244F621720D9F97E3AF2918224CCC6728CDCB2229AE78D161CAE2D5CDA33FFFC2507175C69A3C76A47D756305F00C996345872B69607C93435B1A83744AC
Malicious:	false
Preview:	Search for ALC..print(#43, " ", #42, " ", #44, " ");..if (0 == strcmp(#5,"10"))..{.. if (0== strcmp(substr(#45,1,1),"")).. {.. print(substr(#45,0,0));.. }.. if (0== strcmp(substr(#45,2,2),"")).. {.. print(substr(#45,0,1));.. }..}..if (0 != strcmp(#5,"10"))..{.. print(#45);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-NHJ81.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	692
Entropy (8bit):	4.958200302568717
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloIFiU3YrPDhloZFiU3YrPDhGtq6FiU3YrPD4f8Bloololc6GZ:Z925tjyxUu7hy+Uu7hpUu740Byoylc6i
MD5:	C74E39B4F2A8EC56E195BC72444C3905
SHA1:	BDE6FCB3B9A5B93C36F0CBD036A92623AE955E81
SHA-256:	93D36316EC95210B2DC1F942CA9CBDF77BC6B283B51ECF7C9835A835050E8FF2
SHA-512:	93CB4BE9396A8524AACC192BCA45E615E08303DC7BBD350611D051A583DFA5C97B07E7C4FD17AD94794062C72EB6E1C4287E8E0A12C719E870BE29EDF825D607
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. print( #5," ",substr(#4,0,1),".",fmt("%5.3f",double(substr(#4,2,7))));.. return;..}..if (strcmp(#13,"D")==0){.. print( #5," ",substr(#4,0,1),".",fmt("%5.3f",double(substr(#4,2,7))));.. return;..}..print( "!");..print( #5," ",substr(#4,0,1),".",fmt("%5.3f",double(substr(#4,2,7))));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-NNE3G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD9XKROK:TFZs
MD5:	C03D8C934E2F06F3BFB88E7C5F69644C
SHA1:	295C8595C19DDA731186D8C25F4524793EB930F5
SHA-256:	29CFA759D3BB168B4C159465C380D5345EABBAC22ABD93CF56A424F477E931EC
SHA-512:	970371F9FD66CDADF79771A92F10DA5C3E1ABA904DE82B1115B951E8B36B1DF159EDDC4CD54D0C532460F71D08B918AD6FDB156873EC4A3CFB8EC825B4D281FC
Malicious:	false
Preview:	Search for HBT..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-NQ8NG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLKfovn:TFGyn
MD5:	DCD024731D315ACF2429111647974FD3
SHA1:	EDB4FAE8971B8305B21B3F6C52FC009E2E40CE8E
SHA-256:	6930C0F5CEDF590B8B11A78DDD1F13BA5F73907F674C19302A3C92428CB36F4E
SHA-512:	205E4C1AE87AEE661E35FA0C83DA8DF864C5B81B0A35AAE5EE7D463D14FA44DC0E4ECF1E081D4ED1245C77F7B1F035580FC808DA8B97877429B650C5AEB77776
Malicious:	false
Preview:	Search for DOR..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-NRG4I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDzLPMf:TFv7K
MD5:	E12A2F5C0E84A3C995FAEAE318CA5462
SHA1:	EB1A76F1519E803BFF8552AE0A43F0154EBF9FF1
SHA-256:	F0F1B7D2132B715C5725F4DC21CB986CD769B8FC2325FFE67059F8EA1F71D169
SHA-512:	6E25ED61F33D9845D119F78AD4FC62F4DBE56B09AF57863DA5823B792A6639ED2F0D638314A2BCBA8FD011A60D6AD6E9D129A72A785720F615FB824C1545C142
Malicious:	false
Preview:	Search for ALR..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-NSARV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.499227541723358
Encrypted:	false
SSDEEP:	3:5NFDmkplPJLCGZ3v:TFTJLFtv
MD5:	30169015BD79435EFB5472B352C1A643
SHA1:	AD5961DEE451BDE3711DE8EECC2F5D5B4BEC4018
SHA-256:	8697BEA61BDB37FB7187D2F630A84B7015028D652F01AA4AC4E628EACE730DF8
SHA-512:	E3D117FE0E106A7126C73F7FE5833FC3E2FDAE5066682B9C614C0D4B95C95D354C651A976428A2D99638B8A1C8703709A1FC587521846D90D9A9D8DD7FAFF914
Malicious:	false
Preview:	Search for ZDA..print(#3," ",#4," ",#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-O0820.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1347
Entropy (8bit):	5.029132232087029
Encrypted:	false
SSDEEP:	24:Zu2s5XyUsihiXVUsihuXrUsih0XXUsihYXBUsihfXsGUsiMBCPc6n:JoXyUsihiXVUsihuXrUsih0XXUsihYXf
MD5:	A9172424F6D4242F2E4642E0E11CEDF7
SHA1:	7EF2C9558E42B620B641AF6FE4C11A377820FBBA
SHA-256:	6C8C79B2F3D96DCBF1BF3DA1FA60F8DA8069B6FF7978D1885679A3BE6AB560EA
SHA-512:	0AF1CE0F2BEAE090E38C0D87D3281EE2C1AE30E8768CEFB61AE0BC3AFADD5AFC04AD324CA81FC300F1A43343AD82431AF4AD6CE447B4C9D77C025E0B832B3B5B
Malicious:	false
Preview:	Search for GNS..if (strcmp(#7,"N")==0){.. print( "Data invalid");...return;..}..//if #7 = "A" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif..if (strcmp(#7,"A")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "D" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif..if (strcmp(#7,"D")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "P" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"P")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "R" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif..if (strcmp(#7,"R")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;..}..//if #7 = "F" print #6 " " #5 1:3 "." #5 4:6 F00.000 Stop Endif ..if (strcmp(#7,"F")==0){.. print( #6," ",substr(#5,0,2),".",fmt("%5.3f",double(substr(#5,3,8))));.. return;

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-O569Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.7040511288482865
Encrypted:	false
SSDEEP:	3:5NFDpL5FT93vRQHFxiFDy:TFLFFJSPmW
MD5:	F66A022F2F14FF2894733169A4D04BF2
SHA1:	91DDAED0BAA309CB78DE3F541A5E2D950B8B4A08
SHA-256:	0E67203156C7BB28BC4E13003CACC6DD336B942AB20F3D013C8106C158EC820D
SHA-512:	91896D5324DF2412BA6931341EFC612E97F39CBEA2A5FF78372BBD09EE88F64DB1D053C8C0627E5F2A7B1757B899DA5BD5C04FB3C270BDE5AE67B4163225F66A
Malicious:	false
Preview:	Search for DTM..print( #5," ",#4, "min");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-O6EDU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLLM3vn:TFjAvn
MD5:	ADD54C2AD039D3819F17D4A255771A77
SHA1:	DF832CA778BB31BF8735BB1469BA4A8B6EC57790
SHA-256:	26430E301504D413136CF3CC53FA4212B4DDC7089FC034F4FA869D6B8A48840C
SHA-512:	1DD6E60A96AC5E358607E42A238426CECA264D1AD2DC798411BD7A4980DA54CB3ADAFE15D9E819B2B93011E849ECDE1C271E8A99F1804E5ADE49EAC2B87079EB
Malicious:	false
Preview:	Search for DOR..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-O705B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqcLM3vn:TF5Avn
MD5:	7CD218B684DB45B17EE11A6E0598DD7F
SHA1:	AF0396EA51591E53AAE819C879C047805F54D47F
SHA-256:	050AF8A13B3605276415B043AC80790A6663DF6C463D5FCAE073BEE3D579D117
SHA-512:	D25BA1095C4BD33B15641245272E89E41D298D437D4EEEED88B9BFCF4B2D86F75A8A70F4FED793484456573225620D25143327BBBA98F980006BA709F1C27723
Malicious:	false
Preview:	Search for VDO..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-ODRCQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.572469458770135
Encrypted:	false
SSDEEP:	3:5NFDWkov4NRJ96M3v:TFXogRJ96Mf
MD5:	045EE688293BF6CB3FE0556BA5771A06
SHA1:	38F7FDC92569B1374CED20ED30928B6873FCB0F3
SHA-256:	BC0A163B033E4F1671950E83960D4DA95D266E4272FF365A7F0E67E2E80C5050
SHA-512:	0159AEDDD9F6DF75B6CF5724FAE20B970772537064BF8CEB4420A72E17E2A7D2C17A6F77B6C948B62A184DF86CF058DED30FC9A915316D00C88367B0BC15E2BC
Malicious:	false
Preview:	Search for GGA..print(#14, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-OG557.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.099125025909878
Encrypted:	false
SSDEEP:	6:TFZ4RJYlFErQWY2Y8S6AKFUFiUNaVVbMWymwK4Pms:TvsS61FUFiU8Yrd1ms
MD5:	EBD87D58F7D0A0DFE57DEEA4C8202964
SHA1:	8A9A2835CD9F828BBDB9EED2A3F0C5A7697E8981
SHA-256:	16E9BAB5D0137FABEDD3992A69EF48103D9CE6264478D058031CB227A17DD1B8
SHA-512:	7B576629A126E635E4A916B7D25BB451761C0138A51A83ECB8689005865B50CD3514B40838D119422CF1A41880AADFFA0C281D99520AA4863C2EE89C69DE9D77
Malicious:	false
Preview:	Search for GLL..if (strcmp(#7,"A")!=0){.. print( "GPS failed");.. return;..}..//Print #5 " " #4 1:3 "." #4 4:6 F00.000 ..print( #5," ",substr(#4,0,2),".",fmt("%5.3f",double(substr(#4,3,8))));..trend( double( #4) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-OH1HB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	4.840390712476405
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/IlAFpGjq0pxMeTyeCSPYJIMslFEraGDHK:TOT2gglAXGjVXu50YJI5/GbK
MD5:	4B6A35EDACC70CCE8BB95F9FC555F63B
SHA1:	5CD5507C2ED6C0BA9BF51D4E0217671FFBD3F8F5
SHA-256:	9DC5727C88CD850AFEDF98CC7E9D1B1AED6CE8CF84233A1F1E940D4F89E125C7
SHA-512:	16956530D29DED12CBDB10BE879241F39AABB2C0C8B1E1511F261DF7F5E0A573762B31C605455D367E45A09752D5A8D1080C5260C75AB1404DDB96E9992C16F7
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-OIUE4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.806183542158471
Encrypted:	false
SSDEEP:	6:TFkQFErjjsGFEr53shFErhKms1FErpmsjFEr6BwHW:T6/svsSsimszi2
MD5:	32A1DC8B3652E59ADD74501D5A8B64A5
SHA1:	91A0DE499177B94B410B3EECF47B05FE9274F2A0
SHA-256:	05F653DBCF9ED799116AED812386656207D7941AD30FB453248A27CC7DF30FEA
SHA-512:	961CA9FFB5DBA87661BBE6B94CD5BD0EB77A3C39015D025AD93D6E9CDADC3C23905BAAA70C0CE021ED15D055ED7640477F093D77FA0AE716ED9BE8BA233B1A1B
Malicious:	false
Preview:	Search for HTC..if (strcmp(#5,"M")==0){.. print( "Manual");..}..if (strcmp(#5,"S")==0){.. print( "Stand-Alone");..}..if (strcmp(#5,"H")==0){.. print( "Heading");..}..if (strcmp(#5,"T")==0){.. print( "Track");..}..if (strcmp(#5,"R")==0){.. print( "Rudder");..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-ON43J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.778943565027957
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJ2euo+UoU6X9PS+to+3AGXKc31+CQHFL:TFaoEFcrV2g/It2e9vfqjCGfkCSPmW
MD5:	88E1B4B292F87F83F482E5C26F9BEABC
SHA1:	5F59935A09B59E777292C46EBD0E1F7B1C1F3FED
SHA-256:	1E9374F7D33BC20C485DAA4929CA60945691E9051E37F78228F7D8CBCA2838BA
SHA-512:	34802ABA470D375E6D657DF8386FFEBF773D43A28826D040943B737A1DB4BCD83F151BAB22CD143D0749285B5A20E18DE58D3813DBE7F1603140F3658329F3ED
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"S") != 0){ .. return; ..}..if (strcmp(#3,"2") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-ON8QD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.827863787639069
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/Il0XGjq0pxMeTTHf5PYJIMslFEraSHK:TOT2gglmGjVXv/dYJI5/0K
MD5:	E93CB4326D3E1EC3542BCB01B275BE60
SHA1:	181F2387F4F545CF15102745F49D287AFF42EDEE
SHA-256:	58B77674FA851A3F1EB11D9AD3AA92CBF256FE2CBC0FE5CB75A01F7B44C6A865
SHA-512:	455A5783EC046A34CAD1C7832BFEFC70842B4B70F52678ACDE717B9E7EB6AD101601706CE87A1284F66251D6073846EB223CC2B5086B0E3FCD7231F2A74E3BF6
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) >= 0){.. print(" SB");.. return;..}.....print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-OURT0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.513794876803092
Encrypted:	false
SSDEEP:	3:5NFDf2plFJqs3v:TFbQJdf
MD5:	4D0EF61907E761F6F31306E0D4F1869C
SHA1:	4E30EF303B5FE6DD1E1DEEA64F0984CA60036FD2
SHA-256:	0721DDB5FB79CDEE797F937623AB2CC5244443394EEBD6313D98F4A75302EB6F
SHA-512:	ADA0859F196FF6761A09DD618FF7524DD5047760ED6B79C1C00F1401349C74BED8C2B658A1A5A6760E4CE618E3D341187798DAE94AAD53ED32A7752A76F24F1D
Malicious:	false
Preview:	Search for GNS..print(#9, "m");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-OUTKK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.4968985554505645
Encrypted:	false
SSDEEP:	3:5NFDBl89Yeyn:TFgyn
MD5:	F602950FE072F1CBF8A5AE02B3DB0A2E
SHA1:	5A062BE2DAD4AFC2B40F5CC3DDA58AC24E707529
SHA-256:	BF4EB8D280C7BA0359E177D842CC0A7F60E5C72C183C4A50BAE078AFDE6988F5
SHA-512:	AE8822F491AD5530F32D08D56E55E78E2BDD4B31227B80399D0855B9C50B81313406C35ED504211105D6A555C7BD8FFCEFDF3CFD87A18883823B90414AB1C0E7
Malicious:	false
Preview:	Search for HDG..print( #4, " ",#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-P3LNU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlKfovn:TFLZ0yn
MD5:	153BE4B716EF953E78A1A2FB9E68A2BF
SHA1:	444815C287BA6A4CBA6A4051100720AB3A511742
SHA-256:	ECDBE6942C3D434A9FC62DCA2E2EDBF39367C9E4FAEBBF5540C615BC131E15E8
SHA-512:	7D999C101700C0E518A2BBADFC5AF004B8AEEFC76F7EEE4BA4D41A6CB7AA953A31A9F4CCB0251A8F63AF29DF5C88C709FFED7EE9830403CE9316ECFBB170C303
Malicious:	false
Preview:	Search for FIR..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PBBIO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.823382565856403
Encrypted:	false
SSDEEP:	24:cS2hUEUEUFy3UEUEUFYUEUEUF+pUEUEUFsUEUEUFQ+UEUEU/HhIoS6F:criEUEUFykEUEUFDEUEUF5EUEUFnEUEL
MD5:	1E2B0B5C9B045D48E0157B70A99520CE
SHA1:	A56B170163D810456FE82F8AEC6E058130136F30
SHA-256:	3C724229D3EA1AC5E5368BF402C793C216A87B3C1B5729E7DA4A285BB0EE99EF
SHA-512:	BAAAD857AE11B3C598F4548E034770995662DF78AD1938502F875B4406DFCA071D1A8CB4F2AF6F3254B8B9C5C24EDC5409C5B2F19C0682358AC590A545C2E7B8
Malicious:	false
Preview:	Search for GGA..if (strcmp(#7,"0")==0){.. print( "Data invalid");...return;..}..//if #7 = "1" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"1")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "2" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"2")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "3" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"3")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "4" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"4")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..//if #7 = "5" print #2 1:2 ":" #2 3:2 ":" #2 5:2 Stop Endif..if (strcmp(#7,"5")==0){.. print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5));.. return;..}..print( "!" );..//print #2 1:2 ":" #2 3:2 ":" #2 5:2..print( substr(#2,0,

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PC265.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6PMf:TFNQK
MD5:	B41312F75583AE3C1D61A1914291ED7C
SHA1:	D03125FB6E4E773C9162EEEA363EB39A014C8E48
SHA-256:	040334504D902D0C7A850439D158FCF8975387DFA4C202B73B1B76CC4363ACC6
SHA-512:	E6BB3118B65359E953ABC4F41FC1990E51B68B379896255AE02AC9EA55189C0C85EFD10BEEBE8EB37B3FCAF028B5664382F2130C0BE24FE087D86784CA7D8E26
Malicious:	false
Preview:	Search for ACN..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PCPFQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	4.621895151006009
Encrypted:	false
SSDEEP:	24:3sYdYe20p8zBAtNnZNGYT4X6Hvny+QWrnflnquBcC1lBV:35i1MznBd/BV
MD5:	7CB9E0DEC493FB5079E3FB46E808434E
SHA1:	5DAB211100CA075D364DC8C2583374AD1C8EADDE
SHA-256:	DF5EEE715527B64D28220AECE5B8466EE06CD2079681E0F7C5890F19D5A7C626
SHA-512:	1AD27AD80ECE736D2856A45268366146A52507CE2D75260DE68280C40A06DD6313B5EDE8E0287716D5038986DEBC11575B3E9435EA2F547869E264F0EAC12610
Malicious:	false
Preview:	Search for XDR..if( strcmp(#2,"C")==0){.. if( strcmp(#4,"C")==0){...print(#3,".C");.. return;.. }..}..if( strcmp(#2,"A")==0){.. if( strcmp(#4,"D")==0){...print(#3,".");.. return;.. }..}..if( strcmp(#2,"B")==0){.. if( strcmp(#4,"K")==0){...print(#3,"kg/m3");.. return;.. }..}..if( strcmp(#2,"D")==0){.. if( strcmp(#4,"M")==0){...print(#3,"m");.. return;.. }..}..if( strcmp(#2,"F")==0){.. if( strcmp(#4,"H")==0){...print(#3,"Hz");.. return;.. }..}..if( strcmp(#2,"L")==0){.. if( strcmp(#4,"S")==0){...print(#3,"ppt");.. return;.. }..}..if( strcmp(#2,"N")==0){.. if( strcmp(#4,"N")==0){...print(#3,"N");.. return;.. }..}..if( strcmp(#2,"P")==0){.. if( strcmp(#4,"P")==0){...print(#3,"Pa");.. return;.. }..}..if( strcmp(#2,"R")==0){.. if( strcmp(#4,"I")==0){...print(#3,"l/s");.. return;.. }..}..if( strcmp(#2,"T")==0){.. if( strcmp(#4,"H")==0){...print(#3,"rpm");.. return;.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PIMJG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	592
Entropy (8bit):	4.860033044912777
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloAYClopYCGtquYdf8Bloololc6GZ:Z925tjyVCyGCtd0Byoylc6i
MD5:	0872984EBBE74761131D858F84A5CEF0
SHA1:	029A8193AE37EC088252EB50D1A0903AA90F37BD
SHA-256:	3575E154F98A0ADDBB3DEF59EA5826E7C09075751B9ED796DC439DDD3DD35D4A
SHA-512:	BB1E2C4F85D25EB38CBE3B2AAB807C207FABB5928BE7EA3D763FF1699C20FC5E31EC8C5647EDA83EE928B0377D7597800EFB7071C29BAFE50A7155A48F88DE0C
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. .print( #9,".");...trend(double( #9));.. return;..}..if (strcmp(#13,"D")==0){...print( #9,".");...trend(double( #9));.. return;..}..print( "!");...print( #9,".");...trend(double( #9));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PMHG1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	683
Entropy (8bit):	4.806107560072881
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloCpU4HOUMlo9pU4HOUMGtqUpU4HOUrf8Bloololc6GZ:Z925tjyCpU4HOUMy9pU4HOUMKpU4HOUk
MD5:	C6C3B1CD0CE352EA5AAFAFDCADB0C974
SHA1:	D9B2A07D1EAC50010702A2D51E54C7CFF7A85FEE
SHA-256:	12E2AEE43FAEC05966E6D05E70D468D87D2D8A2F9A1BDCBAFB5435C91F5535BF
SHA-512:	4240C4DEBEE30168454B685842FA208BE27D018B2AD603300B8FF2BEBAD8B8166124C949A28C92D73E447FD9D63541479970CC1312AA8B98E2C7715C7166C43B
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){.. print(substr(#10,0,1)," ",substr(#10,2,3)," ","20",substr(#10,4,5));.. return;..}..if (strcmp(#13,"D")==0){.. print(substr(#10,0,1)," ",substr(#10,2,3)," ","20",substr(#10,4,5));.. return;..}..print( "!");..print(substr(#10,0,1)," ",substr(#10,2,3)," ","20",substr(#10,4,5));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PMQCB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	159
Entropy (8bit):	5.045714737535048
Encrypted:	false
SSDEEP:	3:5NFDjUZNWX9KdFyLR32g/pUAf6X9P/Ht1+AGXKsfZHBloFifn:TFI4LR32g/p3q/HtclPYif
MD5:	ED7D3B7DA5B88EDF32992DAD50BBFFFB
SHA1:	2D7D393E234CBE13725BF681D28EB4879AEC1CE9
SHA-256:	A8DC01D6D35DEE41723DD228174A899CCE6DDFEF466BA80999A9D957DF7E59FC
SHA-512:	2F09B997EB5B5E5E42C80AFED8641F77335019B40AFCA7CD268C37F246AD72C1FF5351D1886C498AD7BBC9E07828B2CF395FF50223DB3B5F6E806A2085F0EEE7
Malicious:	false
Preview:	Search for MWV..if (strcmp(#6,"A") !=0){...print( "Data invalid");...return;..}..if (strcmp(#3,"T") !=0){...return;..}..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PNCUR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.75886148871991
Encrypted:	false
SSDEEP:	6:TFVVkcrV2g/I94MFEr+1F4CFErNPUwPmW:TFX2gg9461F47VmW
MD5:	54111E4B678A5D098A495B48673B9FDD
SHA1:	E92BE2EB743137A11DAA5DA02D11533478A95E77
SHA-256:	FA7342FA849DBF3491DE8B6718348940902E89D72A36F337D769B1CC477BBB35
SHA-512:	42D61B2185E834A8B8A2CD674037F61EA184FB590B964ABA86BD083714E788B9366E9486C43E2141E64411FA565A987D1369B2D6A55E988F7134340F400EDC74
Malicious:	false
Preview:	Search for RSA..if (strcmp(#5,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (double(#4) > 0){.. print( "SB ");..}..if (double(#4) < 0){.. print( "PS ");..}..print( #4 ,".");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PQ3PB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.087745028346076
Encrypted:	false
SSDEEP:	6:TFZ4RJYlFErQWY2Y8sHFLesQvWJAUln9VbMWylK4Pmif:TvsmFLes6WJAUdYrl1m0
MD5:	546A3559488C8BD7648DEFC94F917932
SHA1:	CDEEA1642425F1989406D24F953DE723F03D774D
SHA-256:	B478FA523D717F723BD4570E296457AC89AB536D01354E36A51FAF0730DFBACE
SHA-512:	A39F2EC78942CAF6C45A7006A17C63A855E0D44E60829C8E68C33C51F79BD0699513C56C5A9866F994EC88F0B74EC595729C9EF76E0800D5E125B2B0C055282A
Malicious:	false
Preview:	Search for GLL..if (strcmp(#7,"A")!=0){.. print( "GPS failed");.. return;..}..//Print #3 " " #2 1:2 "." #2 3:6 F00.000..print( #3," ",substr(#2,0,1),".",fmt("%5.3f",double(substr(#2,2,7))));..trend( double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PSUQG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.917504567714332
Encrypted:	false
SSDEEP:	6:TFCwxXluJimFErV2g/IluJcXGjq0pxCBvuPYhtCFMLR1MY+:TUwlJT2gglrGjVeAYnF+
MD5:	2855C5098977A178F249B784541FCE6F
SHA1:	F1964F1C477F94FB0C04A82F0CA4DE650F34E0E1
SHA-256:	8B5C7D6F416880206E131D510F57602FECAD20D1294FB40B23A9B314D6957F6E
SHA-512:	3CEA1DCB690DCFDDE109B686C100E4DC5B2388003E5221FA1E71CA2EB7DA8F16E206C4E53B8EF9D06BBB1215D4D4FCE37A537306194D1466BC487E786F925A68
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print (".");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-PU0HM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6IK:TFda
MD5:	B5FD55809DCB2ACE715944A1B05D8268
SHA1:	1B6EAD168F7EDD133644522A77681A8A953E2B09
SHA-256:	8AB84776194EDDDE62E064C0BA994EA06C9B5700EB80D24FEB254170209CAE2E
SHA-512:	44BD4F6D8C67817F5A7BA5AF96CBC9EB9FF42E0EC3AD4937C5CD3C754AD841B7E34DC3E00BD985274985DAECE2D9D636AFA6BE1AADCE190C4D493342D6BE11A2
Malicious:	false
Preview:	Search for GEN..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-Q0O5F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	594
Entropy (8bit):	4.8312639140233395
Encrypted:	false
SSDEEP:	12:Tp392ggljjjloAYRlo5YRGtqmYIf8Bloololc6GZ:Z925tjyVRy2RNI0Byoylc6i
MD5:	FA41B00F6D1F8D9286BC72DEF5F2F28B
SHA1:	AA8C347E287153E8C1D8EE47766B1FA01EBE2A88
SHA-256:	84EE43A66BC7208FB0A06C535407CC492E141E57B325C869F899F5089FE152B7
SHA-512:	1DC69BD27BD88C023A197320B4243A5D1E4EE6EB590D5A92AA740E55D31C8060CFA7B50A05ECC35A669A583EFB8003BFDE36C78BAE944D2F4AA25040A95546D9
Malicious:	false
Preview:	Search for RMC..if (strcmp(#13,"N")==0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"A")!=0){.. print( "GNSS Warning");.. return;..}..if (strcmp(#13,"A")==0){...print( #8," knt");...trend(double( #8));.. return;..}..if (strcmp(#13,"D")==0){...print( #8," knt");...trend(double( #8));.. return;..}..print( "!");...print( #8," knt");...trend(double( #8));..if (strcmp(#13,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#13,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#13,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-Q2SDQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6LM3vn:TFdUAvn
MD5:	733E6AC73E44C6ED593098929168C4F5
SHA1:	DFE7D28DEC8DC26F3D041A7626FE2D868F361308
SHA-256:	4239163C34F8072F7E5BC83A33EAA0C6CC69F61F7BA5E85997263D9D041669ED
SHA-512:	F62F15C0EC237307D09D0DB08BFE635EEBBBA03D7D4184959F33A1DBA987C40C33186D9CDF9330A6AF31F1E79C54F9B848B356615B741046503BD0AAF8000721
Malicious:	false
Preview:	Search for GEN..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-Q6U03.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAulPMf:TF9K
MD5:	FF321DFAE0D8A5030FC249A7F6C5F678
SHA1:	8F628AC1117DF22EF1AE6B0FCFB08D4886941466
SHA-256:	A75484C2BC6FE73D3E73E5F1ECA827B7D537872FB97DE44252E8FEFB0F0173C2
SHA-512:	89281FD3273D0AD877F927FE3623704697B1295925DF33277223EF634E5BF3F8677DF30F6D4A3EA2B370C807D898195A8E3A3DA9F7A508319951A1D0F81F8ACE
Malicious:	false
Preview:	Search for ACM..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-Q7A8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDf2plNWfy:TFbYqy
MD5:	8C1A5A9E9F42D951B259BE2A08DC8A74
SHA1:	CDF3E78ACFA578CA6FB5DC61818B70B3B18DC992
SHA-256:	ED5D5931D4509F2FFD5497FE5EF5FB560C9D6B4F12F863F22AE2DA4BCD263D0B
SHA-512:	9C4EA0C975179D17A3D8293678C996E92FF46ECBD28B07DEFD124DE6FB99FEFCD73A89B493769F2121FD95BD30BAB0E76278B6904100EDE80E1659FB20FC4BB1
Malicious:	false
Preview:	Search for GNS..print(#13);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-Q9UN4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	491
Entropy (8bit):	4.780142703932923
Encrypted:	false
SSDEEP:	12:TUjClvRcIlvNMFPsr+lvZlv8UllvgcglvoGB:IjCVnVeF3VZV8cVg3VoE
MD5:	CCA80CBECF84E2C8448F5D368867801F
SHA1:	9751F21CE89CB35F2A58D12DF807415D7682F18C
SHA-256:	8EEF0B37F6C51D9A42C4B7F4AEF01C30D0E4B47EDE8851B19784BCFA8D38F479
SHA-512:	78A36DA62613DAC9E1222FC8EB648F6F8F38917B62EC17780084AB38A8EDB0892A80030DF82CEB51B837F45D123176B3F15128FFDE5C8D33DC0A60A7DEEB4CF6
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#8,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#8,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#8,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#8,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#8,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#8,"W") == 0){.. print( "WING");.. return;..}..print( "Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-QDUJL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	277
Entropy (8bit):	4.8278508748908555
Encrypted:	false
SSDEEP:	6:TFFmFErV2g/IlAFpGjq0pxMeTyeCSPYJIMgOFEruHhGu:TPT2gglAXGjVXu50YJIhqhGu
MD5:	995E52AB6AD1D2A7C3793A3E6F513BFA
SHA1:	8B962E4C6F76E2D164299FD30A6E5B7F6042CD8A
SHA-256:	4959AE465C17A30F1A8DF980DDD64690DF07BF83BE96B4E59B464E5CA48986A8
SHA-512:	7C999E6C6A271C55229F7042AC9A6E88F014759EA465F5D24ADA9E33877395B9E0132A766E6A94916F5545BC1C3EAC6F345D33D1616C5C8A42E8ED1C21A48698
Malicious:	false
Preview:	Search for TRD..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"R") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("RPM");..trend(double( #3 ));..if (double(#3) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-QI9JE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6FMf:TFeK
MD5:	DAF2BEB67F4121F51E890D9979FA2179
SHA1:	CD4BBA849DE3ECD537D3DF560F422BCEF08F3329
SHA-256:	55F389FD218D71EFF9BAAF45EB771411C55424E4E9322E8B5F783BE5763C9992
SHA-512:	A410D094141B292822955C6B4E4190778726EC9CC540F17808F2FB3F4038E2FBB85F1C359A438771FB4184F7DC9AAFB57DCB8498D7BE360D672CC64B82A89974
Malicious:	false
Preview:	Search for ALA..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-QVEFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.885530604025141
Encrypted:	false
SSDEEP:	6:TFCwxXls8mFErV2g/Ils+XGjq0px4BvTHf5PYd4qLR1MY+:TUwls8T2gglsQGjV0Bb/dYd4M+
MD5:	79036DDB917F184548AE33BBDDC030BF
SHA1:	FB173A6E057A9582BF153F60E35FDE29C5DEF4AA
SHA-256:	C23FD1A6F7BAEB32883E5FD740953A62616AFFE5FEDBA580199ED6D19DFC1DEF
SHA-512:	8056EE7F4D727E6C4EA92BCBB179398D850EE633A1A153D6DE9EE20F1DBDB04500B4AD5BDBE2E7B984B18C1CA4526950D354423379B13F0A1574318D4A5B904D
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"0") != 0){ .. return;..}..if (strcmp(#5,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#5,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#4))); ..print ("%");..trend(double( #4 ));..if (double(#4) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-R14K0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.7113737109794
Encrypted:	false
SSDEEP:	6:TFwUtzFsKfIPZ+UNjvIKrbUEI+U+kIKrbU8A4DTcMXKrDqe:TPDrIPc6jvIGtPdGD38x
MD5:	F0CEBD8E4DEF2216E6E4AEB384956DC5
SHA1:	4D37F04EA535839E472052091E02772104CB5CEC
SHA-256:	3A066E28039FDC5734B0EB056F6FC1095BC64EFB83666060432E00308CD70938
SHA-512:	F20A662662B36E83006EA174F39DBE0304026117E92597F9D8C3510BB0A7DE5C4BAEFE329102B1453CB99B97616810CADBA1F34CC1D5C81F199B5FE33AAFCA58
Malicious:	false
Preview:	Search for ALC..print(#11, " ", #10, " ", #12, " ");..if (0 == strcmp(#5,"2"))..{.. if (0== strcmp(substr(#13,1,1),"")).. {.. print(substr(#13,0,0));.. }.. if (0== strcmp(substr(#13,2,2),"")).. {.. print(substr(#13,0,1));.. }..}..if (0 != strcmp(#5,"2"))..{.. print(#13);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-R8A6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	359
Entropy (8bit):	4.761036585101526
Encrypted:	false
SSDEEP:	6:TFHy4WFEr8JlFyaFErFceoIlF21fOFErJlFkFErDAIlFtZVOFEr0GK3IGs:TpyhlFy3JlF21TlF3AIlF13KYGs
MD5:	11608BE88EBA262C9FEC529AA4B7955E
SHA1:	62BCFD7745351E75A2C49F51E1067EC6E3787926
SHA-256:	696D64267C5495F9ED1139A918922CF9F1E5B269FA7A638B5C3E38610DE0E734
SHA-512:	9D5ABC81D299A3C2F6AC3AC47E7B6AB6E80EA12BE47D8007F0146F3754178B756304113C294CFF76D69A135F26D44DBD553B40746C9391CC157828B327DB64C6
Malicious:	false
Preview:	Search for DTM..if (strcmp(#2,"W84")==0){.. print( "WGS84");.. return;..}..if (strcmp(#2,"W72")==0){.. print( "WGS72");.. return;..}..if (strcmp(#2,"S85")==0){.. print( "SGS85");.. return;..}..if (strcmp(#2,"P90")==0){.. print( "PE90");.. return;..}..if (strcmp(#2,"999")==0){.. print( "User defined");.. return;..}..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-RIIHE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlOK:TFLZd
MD5:	C8D5CBF313458D5E441B99E3EA43F20C
SHA1:	564029CD28EFCE342BDD017F6FE6D6F96306837A
SHA-256:	FE60C981B5080B7B1A711F8192CC74361364D3FEFA224FDF7F398741D112BCC0
SHA-512:	214EE131AC19AFA257D040150C6C6BBB2CFBF452F6373C8F07DC0434BCD32A6732978658A0037F5A2B312B5FA81D7EC051E079208FD37F1B6C9FC2D0156D66E1
Malicious:	false
Preview:	Search for FIR..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-RJ4B4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFDBlsfZHBloFifn:TFiPYif
MD5:	1CD30B0EA309136ED8775947F136352A
SHA1:	1080CF9335DBC22409406EAC6DB1CCCFEB63DEDB
SHA-256:	1867198A606B9FF3081E6BD98E60023F878157E220119092E529DD9134C3B831
SHA-512:	695CC1513A982DC44D3ABAB76175D6435487886B1DBD482650D9F9747364366ABB3E5DA2C15374F9336A90723386317500D310912118D8E6628761F0149A5CC4
Malicious:	false
Preview:	Search for HDG..print( #2,".");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-RLUA7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDh6IK:TFNa
MD5:	7C8BB037A13C27C2676A8B98A43C5992
SHA1:	2BA118514051A83ED81A155E4308F147737832DB
SHA-256:	488C7638851251026522A1178C9E6449B243AEF5FD00A710031CA80154F65587
SHA-512:	0F99A4FDAF50B755FBE73C22CE991CF0EA00B512747F970A96FCEF8A7FAF44CBB395C2FC6546BC815DEE95E3754731C38FC5A1C8D3C83212756025ABAC2A3879
Malicious:	false
Preview:	Search for ACN..print(#4);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-RMQQG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDflPMf:TF7RK
MD5:	9EBBA5E4945E2912F4BA1156579DAEBA
SHA1:	F22DF7A4FA1D9B58485F7D0AED3C84C3648D7D63
SHA-256:	C283203C6E4CFAC37C905597E7DDADB9EE21C6FFD1AC58C7887C611AFC3B2681
SHA-512:	B3CF03DEE954AD9D6E482DEAA18260D969E63DEA3FC58121AE5A3E306AAD7D031351CD648FA0E9E3CF9F7099C5C62F94F0D75138FDCC8D17AD371636E2C965EE
Malicious:	false
Preview:	Search for ETL..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-RTSN4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDpLPMf:TFVK
MD5:	27A2908F51F89EA953C5B849632A95EF
SHA1:	58768D2F54E9F4ACF5BF6BBE57181806FC503824
SHA-256:	1516B976409E722E0FADB46DC88EAEBC27ADCC99D3909F8E25B67D2B84AFA96C
SHA-512:	F17D8E5C0AB122C975644DFE4A0BCBAA379C03A3B1E6036E6B2023A8D7268F356943C1A4FAA684BCED8AF5379A123CA8CA197C50D128DFC09A47F48403568BED
Malicious:	false
Preview:	Search for DTM..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-S07G0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.767279031509798
Encrypted:	false
SSDEEP:	3:5NFD6b40/ZHBloFDy:TFM7RPYW
MD5:	4B9A028A5729946076CA012760D3D110
SHA1:	625119C8024B69A8EE743480EE7AA09F7BA88F53
SHA-256:	7AB1C77E93C64BFD59027FDC0EE3CB084C34A92C37AA425B63D66C19E2DB63B0
SHA-512:	08B34C801029C3BC4528F52C1F8D8D4A26617E958470E4B4AEFB9D2FC10AD6A922300515D91091109CB215A95735A168B7C6FDCB71232C19B3276FACFC98B37C
Malicious:	false
Preview:	Search for VTG..print( #4,".");..trend(double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-S0TGU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.807888696044131
Encrypted:	false
SSDEEP:	3:5NFD3vMkWoI8FB3HFFErCEWEBI+3AGXKPMf:TF7/1lFErCEWEBIGgK
MD5:	95B2A60CBA859364E20C9BD9E1CC6914
SHA1:	BA6467C3EBCC82D6EE702B05C490F37504679319
SHA-256:	76AACBA2B593DA1AC10A10D1326E8FDD074515027617BE3CB0527012562545E8
SHA-512:	51FDB70D5253CB037B48AA0F58B2433BBF0C90BEB9482E78BB243BEFB48BEE6EF07ECC0EA238A92A49713027D0D0DC83D4440A400B0549047C483C9190EBFBC2
Malicious:	false
Preview:	Search for HSS..if(strcmp(#4,"A")!=0){.. print("Data Invalid");.. return;..}..print(#3);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-S4MKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.90729172457204
Encrypted:	false
SSDEEP:	6:TFCjCluJimFErV2g/IluJgXGjq0pxCBvTHf5PYhtCFMLR1MY+:TUjClJT2gglvGjVeb/dYnF+
MD5:	5560BB9958F5EDE8F5FC8273B94FB46F
SHA1:	9F4524DE875719188222D92EB890C9FB8B29E214
SHA-256:	50D8F09435C7BA95DE260872C5DDE6AE67610A51FE74BDC060BDE394E2A9938E
SHA-512:	186C129D6ACF0A09216D5074EE6C787C480F3993577F8A1A27B94F5551973EEBAF39F2C9CB2716B767C41F2A4E1BC5A1BBB92934C9E622C9EA8B346725FF82B8
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print ("%");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-S9G96.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.811382823650154
Encrypted:	false
SSDEEP:	3:5NFDVNXKnseCQHBloFcfn:TFb1SPYcf
MD5:	54D1E096C3D62A6CA3A191BCD140B7B8
SHA1:	158AA8B50D5EA7339890FB39DA6D31B11A573195
SHA-256:	48CD274A46DAA8EDE920889CD4FD04BE1789855BA1534DE433958A908D329211
SHA-512:	698D1D11801C825ECED2899E9E8F86595BE0ED3C08AD380642F8BBC253009054F65E2C39A7E4F55A831776D6F50A00EAA61C7EA661D248178F15E0C55751E841
Malicious:	false
Preview:	Search for MWD..print( #8,"m/s");..trend(double( #8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-S9UA6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.835201992471304
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlaXGjq0pxKGuPYcKEZmFEruHhGu:TNT2ggl0GjVONYcKEUhGu
MD5:	E9CE55A0DADA85DB6F8198B58489880B
SHA1:	0E52C0EE4D784BBF5A6CE9181F3D7066EB0CBABE
SHA-256:	BA4C9E117A396B445DB20E82EC4AAD5A70BBD5EC203E29693EC11966B6AD7C7A
SHA-512:	465C6725B6D30537E31B30E09FE45DD8451841F669420FC7D499722D18DC9380A9BCEC25D4D0937FEE3F4413141D6B9B5D9F9E5CB9170AA116F94D7514044B08
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print (".");..trend(double( #5 ));..if (double(#5) < 0){.. print(" PS");.. return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SB8OI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.722027548259446
Encrypted:	false
SSDEEP:	3:5NFDB9KR4HBloFifn:TFN9DPYif
MD5:	5CE563CCF3AF24FEA99561755B50B3FC
SHA1:	08AD7E2680295ED57F63986C5E81156EB16DADB4
SHA-256:	86B2D4720434C65F59D4B92CB8C33769CFF920FBAC91F90ED37BC13C247963C6
SHA-512:	BAE1818CCAF0774FA7C4E52D9A93FFA5FDC764DD86BCE80892E7DCCF932DBFB99EE1E9CDEE811F91F7C17EF9A3098AEE92D073E72EA8C9D3DC75F034FD88C3D1
Malicious:	false
Preview:	Search for HDT..print( #2,"@");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SEBT7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.671877762033242
Encrypted:	false
SSDEEP:	3:5NFD6b4Sl3vGHFxiGTMFK:TFMBlwPCFK
MD5:	BEA259EDFC463A9EC43FBDC4E207ED2E
SHA1:	C1601AC8E182A9D4551F27B8BCE4CB0F63976837
SHA-256:	91532963896577B118F6F6BC8B1F0C7219F0339FB79D0B6E06017C63480F7F76
SHA-512:	ADBB482FA9220796C8EF06E364B6C101D664D9299412C22C670F4D28EDECD4FFB6D61AEE1FEDFB79B2418173CC5337920672D8B229B3A23B39004A72B8D1A0C7
Malicious:	false
Preview:	Search for VTG..print( #6," knt");..trend( double(#6) );..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SFF8J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.7491279525714525
Encrypted:	false
SSDEEP:	3:5NFDNliseZHBloFxK:TFGswPYxK
MD5:	616D26A8F1C816E8FFE130104D6237EE
SHA1:	A49CAD6B0CF3DF3466E0F101AD13CEE692778939
SHA-256:	212A268679FECE731A57E7D5C849BA6D7D1C7774F2E5F7B63D58292BBDD03E0B
SHA-512:	3E7B9A99E5FC5D6871B6ACA0D53A997A643A0435609481F68672BAB29EAB52A3892D6A5437EC7F6EE10DD8F06AB17D0FCC2880E9821187742860C4194FA61626
Malicious:	false
Preview:	Search for HTC..print( #11,".");..trend(double( #11));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SFJOT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.060161669319466
Encrypted:	false
SSDEEP:	24:Zu2ssnjUWN+WVh7OjUWN+WVh3KjUWN+WVhtMjUWN+WVhxwjUWN+WVhaC0mjUWN+X:JdjU5oqjU5o6jU5oejU5o2jU5oaC0mj2
MD5:	CAE67BACB192EA2B30B99817F27C6CD3
SHA1:	7E2CEBC95F5C4C97B9771C59984B89C614E5452C
SHA-256:	DB9ED45668236293B7158AA0FA701240A083789C38F2DC4D1DE4346E82221882
SHA-512:	9BB1B520E1437A59FE1FDBFFB1EA717BC604E9CB633883436067180BF1A50F0CF1D8A27EB179A50BC087BE6F9B31BF5F3EEA6B1C3027D97D4A8D13942F9B9C44
Malicious:	false
Preview:	Search for GNS..if (strcmp(#7,"N")==0){.. print( "Data invalid");...return;..}..//if #7 = "A" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif..if (strcmp(#7,"A")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "D" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"D")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "P" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"P")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "R" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"R")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. return;..}..//if #7 = "F" print #4 " " #3 1:2 "." #3 3:6 F00.000 Stop Endif ..if (strcmp(#7,"F")==0){.. print( #4," ",substr(#3,0,1),".",fmt("%5.3f",double(substr(#3,2,7))));.. retur

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SFPI7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDLEK:TFh
MD5:	7AEE1F49FF9CD9CFC3813827D5686343
SHA1:	75330E372345037B5B280E029775D0B8E333C0D9
SHA-256:	F9E3D63084FFDF00A2B73944D3F3169FBD050E344E5258E7E0A8DC9C2F510F20
SHA-512:	5947F7325551EC499BF4524F7697AE9AC348005B80EC013DC30899D4B77F3277A9FD20EAF2F194ADBB58972A3C4557E15CD336DEBF79E1843761F6EE97994FBB
Malicious:	false
Preview:	Search for DOR..print(#8);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SH2NM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.770310755768087
Encrypted:	false
SSDEEP:	6:TFJPDGVF1FmFErUd6lq9mFEra6lq5F1FmFErzzIlqu3FErpKyGBk/y:TPsPuIl83l0PZEl7SKyGeq
MD5:	00EEB44C24F8B3A601DA1427DA198314
SHA1:	1960DC100D3F1CB40AEEAE99ED99483FF91DEC7E
SHA-256:	FD74DFC0A5156280D67064FC17769ACE390A29681C278279ED6967864D2DB92D
SHA-512:	1D975BA149325FBB00C07F37518EA8CD50A0E7662FBE8A6DBB20771D1A5E2831876C268EDB26C3A48497D0AEA57BAB241A92BAD3F3539E0740ACCC42A1AE683A
Malicious:	false
Preview:	Search for NSR..if( strcmp(#4, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#4, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#4, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#4, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SK85T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.900942518222834
Encrypted:	false
SSDEEP:	6:TFC5luJimFErV2g/IluJgXGjq0pxCBvTHf5PYhtCFMLR1MY+:TU5lJT2gglvGjVeb/dYnF+
MD5:	018DFA70A2067AFCB8E5A459962633B8
SHA1:	B6642CC950572DC86C42D3823BBCC26471166D5F
SHA-256:	52A397989997B5553BB128CCF388DFF44E9DB60128B3054842CA37B84C44ED3A
SHA-512:	ED007CF4489DCCA94CA07892DB05AB6AF811E0AC443A575FF2EA7936977FE2AA77CDC9295266D645FA567537D95EB5FD3ACF073609916835257848BD56A9DA2D
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"1") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print ("%");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SPAL6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.638611091386151
Encrypted:	false
SSDEEP:	3:5NFDflH2XUXmMJwQwUXVfHYQwUX1L4QwUXE:TF7+UlwjUlfHYjUFL4jU0
MD5:	8B7FD1FC25DBC3B036B77ACF57B96AF6
SHA1:	018FDED4B112FFBFCF080D70242FCFF65F3E2B47
SHA-256:	98D7D8A197B486CAFB3920BF99C3EAE618086D00316603B67D6737C57CDD7BCA
SHA-512:	D557DB5F3015CF74079BDCFB7BC6C6DB7C9741C2C73100C5E734B4B0F3C98222248A6BA8D4465DD95C53A3FC2132054C1B3713F56FCA073D5B8B65B8A16D1DA9
Malicious:	false
Preview:	Search for ETL..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,5),".",substr(#2,7,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SQRUL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	436
Entropy (8bit):	4.773758506889757
Encrypted:	false
SSDEEP:	6:TF/VE1lFErV2g/Ilq5HzlFQGz5PYLs+FErh6lsQFErQlsHFErj6lsGFErvT6G7:T5Vv2gglukGJYLsGlsolsLls9mG7
MD5:	9F2F2434AAD7E8DF20D6B23A6486C01F
SHA1:	ADDD6F5DA83DA0021DCB93FA96E1EE5227301F64
SHA-256:	3874E202B057A89954250C4F8A29B48A6C83E2A2D200758162D09899E8DD7FB0
SHA-512:	5709B0B0C6B63DF25D67A0B63A6005237892AF569F0ECE3689A113D1593550D0FCB4B315AEDFF5DC465CDF0EA4F2A31F08125E6B43FCC70E7794FE57C51673A8
Malicious:	false
Preview:	Search for MWV....if (strcmp(#6,"A")!=0){.. print( "Data invalid");.. return;..}..if (strcmp(#3,"R")!=0){.. return;..}..print( #4);..trend(double( #4));..if (strcmp(#5,"K")==0){.. print( "Km/h");.. return;..}..if (strcmp(#5,"M")==0){.. print( "m/s");.. return;..}..if (strcmp(#5,"N")==0){.. print( "knt");.. return;..}..if (strcmp(#5,"S")==0){.. print("miles/h");.. return;..}..print( "Unknown unit");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-SULSO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.499597622210291
Encrypted:	false
SSDEEP:	3:5NFDkAL7BloFifn:TFQiPYif
MD5:	9A3F4FC9DA8BAAD941D91AA61CD4F056
SHA1:	A643AC5548ED9EC5EC4454298D6FEE5E3FBD3926
SHA-256:	E257BDE9DE1F6BCBBB09BFEDCB1FE7B7F90E3F8AA9D215337A2153097FEF480C
SHA-512:	C3EEDEB418398A20B370DAC32F0E058C30C1370BD9B504935945BA675432B3BDA017E276EBD3706ADDF89101289251EC05663149B33C083A087F1FC49D12B0FC
Malicious:	false
Preview:	Search for HRM..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-T2N0U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDz4JMey:TFHsfy
MD5:	BC9416D7232024B3BD181FA9850DE070
SHA1:	C4480DF352811AD113342F14C1A2DE8ED5B7F5DA
SHA-256:	226627ACB824A4598BA288EDE98E7BA3CE8D829BDE59467CF0406F1A790ABAA0
SHA-512:	6907865D6B415D42D77B5DC3A4B30F5D28B0A3C143D4B29727BEA87F49084A899C34AF140DD5750A88984FE060820DF198B337AB1D9CB2FD02415A2673DB778F
Malicious:	false
Preview:	Search for XDR..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-T5V7E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRNVM3v:TFfcTVAv
MD5:	1091EAD6B82E5FD88C464BBD61CF97C4
SHA1:	222DE85BC4C17C273B19605376198918743FFFEF
SHA-256:	4EEBE6BF27E678E4CCBC42F4FDA2051BEB2E461AC98AF469B765C7A3C8F617B6
SHA-512:	ED33010C64A2152C865FA8867689F3917D5C3869C6F1E76628CAFCBBFAA17FE2ED034AC35D8CC25259830C2262C88A0C871FFE8E30C709D04DC3B06BC0565D5A
Malicious:	false
Preview:	Search for WAT..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-T6JCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDAxGcLRKfovn:TFfc0yn
MD5:	6291E0C418465725AA8DC0596F72D89D
SHA1:	3C25D40E1469C1D09A5447F336A6708FF1A3F3D6
SHA-256:	4DDEC872E951445E2C3F4A6AC01DECDC065717BB52B31BAEFDBA28B1E497BEC3
SHA-512:	92E709D888AAE0DFB747CBBF77FC3E8F90672EBDE40522590C5BA6D2B8079C9DF806228AF59AB5659A75315576E6F759AB072F0ED47B5ECCF5BA3F678D686060
Malicious:	false
Preview:	Search for WAT..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-T83AE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.807867658033499
Encrypted:	false
SSDEEP:	6:TFJPDGN51FmFErUd6lqNnmFEra6lqNt1FmFErzzIlqNti3FErpKyGBk/y:TPU5PuIlYn3lYtPZElYtiSKyGeq
MD5:	B4A8BE95942B1B265F754B6476BF004C
SHA1:	35B5BFB03E9DBFB446A35280AE4882EC21FA1C1E
SHA-256:	3DC66CB6BA3EA3C4931860BD6BA09B6B3B2828F60E0C496AB4055A7059BCA289
SHA-512:	FA0CCE4F924B4A5AE4DB4C6D0D6EA8AD786A4CD5329BC03A0CF50D9395E196B77398ECC373D59C7A7A6B7A112841110510942CBE6DF3AA191A7A383395178860
Malicious:	false
Preview:	Search for NSR..if( strcmp(#13, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#13, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#13, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#13, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-T943L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDnLFMf:TF7xK
MD5:	38BB0B8E4C27959F084DFCD3EC02C9CB
SHA1:	FB4CF5B1B7CFC835CF396EE73F77A8DF704FE263
SHA-256:	BF8C9252A0FD961B1C6BD662E08BA44460F752BCF86689CAE74008465F992C52
SHA-512:	7CA5531C02A3AAB4A3A9C33F8A8595E1D2898CBAA84A9670247A53714002339469742B7E7FE136108740667B869328ADB7A0EB52150FF8F3D86ADA796F644BCF
Malicious:	false
Preview:	Search for ALF..print(#9);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-TAB9D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.80307885118003
Encrypted:	false
SSDEEP:	6:TFUJVHqXlqaClsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TOElZClsAPlsKeEUhlsj4K7qgE
MD5:	9A49C5363B3F147F5CA5D397FB2AAA1C
SHA1:	DDE4105F41E0F57BC8FC6CCC8621B1342F9EAED9
SHA-256:	5F95A7F3FB33CDC23D9E4F5A296CED223BD5CE65A7F0E4D92820777874E6ACE4
SHA-512:	4CA5C341EC0C440E7E1630069C50B6163C7FD99F769E919EEBC69A8EDF27531116692F879DDBA982B2F2C2A4F6FC4CA1920AAC2001D0AFE52A4C6581673E1FE1
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-TC8KJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.818933061327559
Encrypted:	false
SSDEEP:	6:TFHmFErV2g/IlWXGjq0pxKGTHf5PYcKEbIAlFEraGDHK:TNT2ggl4GjVOQ/dYcKEbF/GbK
MD5:	232109F58F88675F382E0A35B0BD4BC3
SHA1:	99077499373C99DBF85B41BAE81FEF907CB40B16
SHA-256:	DB086F56E76AD8A506C8322CDEDF753243A069E855D7E42E72F16FCB36518757
SHA-512:	2FF2B30F5ABD48C595040894EC182C8F505D78D1C484AEFF9AE42307853CB5EF91E57BDD47C6DEFB83C9711023A43689A8A61DF45E6A7F9DDA5F92D3D5D140AD
Malicious:	false
Preview:	Search for TRD..if (strcmp(#6,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#6,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#5))); ..print ("%");..trend(double( #5 ));..if (double(#5) >= 0){.. print(" SB");.. return;..}..print(" PS");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-TCG8C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.666462569330563
Encrypted:	false
SSDEEP:	6:TFqV9HNFErV2g/IGtHUK2e3FErgW+6lqQFEro+lqGFEr2UF6GRPOy:TA3y2ggGtD8Bl8lpc6GZ
MD5:	DA22728E3D1D46EA91514300438D559A
SHA1:	B5C864132F6AE32F3F934874712DF15CE7E099D6
SHA-256:	289DE3F2A076FA65F1431BA82A0E91EBD61720AE9B1FD5C4290ECFE6F152E07E
SHA-512:	D479C56A46CDF62AEF1A5665F2C45F6A1219216CD533C8ABBB3EF792CAB7DBA5318391C49B44F2B79EACFDC9E8FF52A8449B0D3DB1C19815DBDEBA92564C8401
Malicious:	false
Preview:	Search for THS..if (strcmp(#3,"V")==0){.. print( "Data invalid");.. return;..}..print(#2, ".");..if (strcmp(#3,"E")==0){.. print( " Est");.. return;..}..if (strcmp(#3,"M")==0){.. print( " Man");.. return;..}..if (strcmp(#3,"S")==0){.. print( " Sim");.. return;..}..print( " Unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-TD6MD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFD3QMlJMey:TFLZXfy
MD5:	A663D17B1C29CF1172A35534BA35C61F
SHA1:	C1EF2DFE397146A26E41FD0E92075E67EC32856B
SHA-256:	57249D438D62E2EDC67DD0C2CF1965325D78001E9F98F5F335EF74CFCE60E3DF
SHA-512:	029078E235BA19882AA6CA8E5B27655EB8C3B2D4B5DE799306A84B8949898B9E5A7D156D1823DD8A90021B7E812EFBDA544A0705D15C0A1278A596E1F42F4BC5
Malicious:	false
Preview:	Search for FIR..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-TMM9E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.7967985228466175
Encrypted:	false
SSDEEP:	12:TKlilw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:m4bIEygGeygIVHiygBKeygaf3E
MD5:	ADEE5AC22C2DEE0C9F461F0792BBFEE8
SHA1:	D54E801EDA819DC81F378A7E06CCE52A27DAA2F7
SHA-256:	C908DFF94B61E02279A64711C3E9F510C9963325B3C84B02CA01F335A64317BF
SHA-512:	0C6CDF6413C2285D37BE003AAE5438091205F6BFC5D538715779975EBDFF8CE1BD1BF2FA341AF9C611D70FD046B3A3ABA0F8B37756EA4544AD91F04D343F3324
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"A") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-TOGGB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.936378661347794
Encrypted:	false
SSDEEP:	6:TFQLR32g/p3Fe6FOFErWq6e8rSj4FeUFErWq6e8rSjkWV4iPgK:Ty2glFHFEPF9RW2EN
MD5:	C10509CFFD8B49DF4E1692D33936FFBD
SHA1:	3F76CB5AED22423D637568F4C20620C8C0F41357
SHA-256:	1165850372C4BF50F5A3133EE7A6E02DF660728987E7C39E8B61BEB5A80B5D9D
SHA-512:	72388FA50648D6D8AA0C21C8612157CCC36AF5BDC0D7AE79B03731520C24886329A91CAE7B31B262B63EA846F94F3EE7270D87505097E974343A7B7376BE4B33
Malicious:	false
Preview:	Search for VBW..if (strcmp(#4,"A") !=0){...print( "Data invalid");...return;..}..if (double(#2) >=0 ){.. print( fmt("%2.1f",double(#2))) ;.. print(" knt Fwd");..}..if (double(#2) < 0 ){.. print( fmt("%2.1f",double(#2))) ;.. print(" knt Ast");..}..trend(double(#2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-TQTJK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.642282254934298
Encrypted:	false
SSDEEP:	3:5NFDgG6H2XUXmMJwQwUXVfHYQwUXoov:TF9UlwjUlfHYjUFv
MD5:	BDA918175C26FEE73E277324BC9F8242
SHA1:	74CED1AA141FC4D6767D215FAA077E38C4B1645C
SHA-256:	8A486C5AB541B1290F769D93E76F2A2629C87307AD4F6527EA7DD3CAA3F695F1
SHA-512:	B2B919935D772A1D74F88D27B4FAEC9E888FB7EFC872927F248AC31AD1CC2B739A02F9DB46CBC3E80E22D104C9F91328077FE2A16570F8955DCA27DCC2B23BD5
Malicious:	false
Preview:	Search for ALA..print( substr(#2,0,1),":",substr(#2,2,3),":",substr(#2,4,8));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-TRT2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.775567169733104
Encrypted:	false
SSDEEP:	6:TFyIxJFo9uKfIPGyU+hUIvIKrbYI+hIKrbAA4DTcGynXKrS:Tw2o91IPGy3xvIGWaGA38GyH
MD5:	2F2560F0846E110C120CE810E3752610
SHA1:	0E079F7CB82C0A156CE6D30FB69B9ACAC4411C32
SHA-256:	2DD72E6B1271493DD45D0A6E9FECD84B9F1C7111993AA9BC0BF08A2E5275C300
SHA-512:	D1EC4A0CEB6FFA6814DB6FA44762A8B8A30A7ED7C48B4CD3FFA1715E954DFC706CB8B8EFA683C02AC9F08AD547EDE9269125D7FAD77E648A583DBFC4073E8F20
Malicious:	false
Preview:	Search for ALC..print(#39, " ", #38, " ", #40, " ");..if (0 == strcmp(#5,"9"))..{.. if (0== strcmp(substr(#41,1,1),"")).. {.. print(substr(#41,0,0));.. }.. if (0== strcmp(substr(#41,2,2),"")).. {.. print(substr(#41,0,1));.. }..}..if (0 != strcmp(#5,"9"))..{.. print(#41);..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-U2G53.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.691435688769648
Encrypted:	false
SSDEEP:	6:TFJPDGLLHoFErvIlqLLHo1AFErYhlqLLHd3FErpKyGBk/y:TPu/IlCCqlC9SKyGeq
MD5:	303D0D2F4C32C22534533881243D5267
SHA1:	A13171CC51C9350A9164A04BB81DB05561C4BDC9
SHA-256:	CCC23DE69153FDAF2E8E624193C3273ED32C1735B2B05C698518024B9C022A3F
SHA-512:	593BDD59B7286C1A41E036FA9C63A19BBAD74DCA76C920DEA271C318A5F3F8027E06051C8A17F87C3DD281A22D4B70E2E59D581BDE5F51F173191C911CD4DD4E
Malicious:	false
Preview:	Search for NSR..if( strcmp(#7, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#7, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#7, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-U5DB6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	869
Entropy (8bit):	4.79852062472922
Encrypted:	false
SSDEEP:	12:TKlZClw4IlCyF6l219eyF6lqblyYldlUyF6lHKeyF6lUlDsYlpE:mSbIEygGeygIVHiygBKeygaf3E
MD5:	0CEF2FB0DD2BB0E0DFC458F23FC54CE4
SHA1:	3CCA4EA3DAF21991794CE6E82B6C3EDA13415A10
SHA-256:	9AF98741E55D0B3FF84588D02653AE1E503399D2F5247FAA18CB167C488B851E
SHA-512:	9951CD42FF12631CB9E8BADA5818A080ACEC091F39D49F3D518D1D4734BA5C2B4495AD6D69D89DA3D9826F593D97D9BAA32DEF4AF21A65A1D29D16E9BBE133C6
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#4,"00") == 0){.. print( "STOP");.. return;..}..if (strcmp(#4,"01") == 0){.. print( "AH-DEAD SLOW");.. return;..}..if (strcmp(#4,"02") == 0){.. print( "AH-SLOW");.. return;..}..if (strcmp(#4,"03") == 0){.. print( "AH-HALF");.. return;..}..if (strcmp(#4,"04") == 0){.. print( "AH-FULL");.. return;..}..if (strcmp(#4,"05") == 0){.. print( "AH-NAV.FULL");.. return;..}..if (strcmp(#4,"11") == 0){.. print( "AS-DEAD SLOW");.. return;..}..if (strcmp(#4,"12") == 0){.. print( "AS-SLOW");.. return;..}..if (strcmp(#4,"13") == 0){.. print( "AS-HALF");.. return;..}..if (strcmp(#4,"14") == 0){.. print( "AS-FULL");.. return;..}..if (strcmp(#4,"15") == 0){.. print( "AS-EMGCY.FULL");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-U7DFA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDqcJMey:TF7fy
MD5:	7C49E7807364975649412DC77DD30551
SHA1:	F8CB158215A90B66A65CB07A7B3873BB7AF84B11
SHA-256:	826A3362A264E57B38103AC2C57FF16D4F49B22F03DB7BE76CA82A9B119B1C5F
SHA-512:	C0CE7A1DD486E87B4FF5FBE13558B1CBF82ADB1B1F3BFBEC6FF23EA9544BBE718BF5BDD94CE5257778CC4057A53C0DC216EC79B644C41B7861EE44046A0BE788
Malicious:	false
Preview:	Search for VDO..print(#5);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-U9KV4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.770310755768087
Encrypted:	false
SSDEEP:	6:TFJPDGyVk1FmFErUd6lqyDsBmFEra6lqyBk1FmFErzzIlqyLR3FErpKyGBk/y:TPpkPuIlG3lRkPZEltSKyGeq
MD5:	4D390F3AFAF20423C562CA6ECC426AA7
SHA1:	874995D14DE9CF15996F8C923B4095B9D64BC63D
SHA-256:	818BF5E9EF0D4C3A23C05EFDCE4C8B1A47A9C72B9ECF77FAEBF849402ABD3C41
SHA-512:	766E80C0BADC51C359D92748EE636C0A388E34DAC3D69B40C74CE209A4CD4BE1B7115779DDA63557BB07AC4749816AC82B366291B011EA40B1DCEE2379380B56
Malicious:	false
Preview:	Search for NSR..if( strcmp(#2, "P") == 0 ){.. print("PASSED");.. return;..}..if( strcmp(#2, "F") == 0 ){.. print("FALLED");.. return;..}..if( strcmp(#2, "D") == 0 ){.. print("DOUBTFUL");.. return;..}..if( strcmp(#2, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-UBC11.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.4871228053977985
Encrypted:	false
SSDEEP:	3:5NFDLNVM3v:TFlVAv
MD5:	8F3A409F27D0EBDB6121DE1190AA2A0A
SHA1:	2F9031550CF93A7E318899919C018840E178EC39
SHA-256:	10054F2F458EC23770F85238708D0137AFA553E5B1853935559C12A27D81768F
SHA-512:	62EA7E67E5A7B0405730396E2EB757A752660AC65B5B3BB604CE01091059A6C49402AA05D4971F794A6A17D427DE95CA278AAD4E94AC96F716D07FDF96613448
Malicious:	false
Preview:	Search for DOR..print(#10);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-UE0BD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.928927480608119
Encrypted:	false
SSDEEP:	6:TFCjCluJimFErV2g/IluJcXGjq0pxCBvuPYhtCFMLR1MY+:TUjClJT2gglrGjVeAYnF+
MD5:	077300DC689235E2DFB2379F6A3EE612
SHA1:	4BA6CBBB2733DB5488EB6AF12202BD5142B87CEC
SHA-256:	930C1906031841A9AD7130462F33E6B2037234ABFD91220359B625191614B0F4
SHA-512:	DA83DFCC2480DDA1D626E7E6E7A97D9913F24C755822C8C8C32D631CF1B4D91BC783FAA1999A69351526E123312466BB5F9A2D1C8499CE56F6A9B37EFED7AA19
Malicious:	false
Preview:	Search for PRC..if (strcmp(#9,"2") != 0){ .. return;..}..if (strcmp(#7,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#7,"D") != 0){ .. return;..}..print( fmt("%4.1f",double(#6))); ..print (".");..trend(double( #6 ));..if (double(#6) < 0){...print(" Ast");...return;..}..print(" Fwd");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-UE4T9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6OK:TFd8
MD5:	9A98221B75E04495B57FD940FB905F52
SHA1:	E16E96ED4EEF6073A2AC0CD55B90D374ECB04CBD
SHA-256:	481CC45BC31A6C2165623D338F0F0E8AAD5E8B35DC31F4D0D1A5D7BF831910A5
SHA-512:	BCDADD853FC22A76FB8D538A0390BFF0902E99FEA0F5C3242EE03D5D0E4DF984D57862D95CC7EFF0C4F3EE9C51346AD66FF5987CE75BAFEC74B58BE30DED7CEF
Malicious:	false
Preview:	Search for GEN..print(#2);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-UINF6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.423251796980338
Encrypted:	false
SSDEEP:	3:5NFDUq6Kfovn:TFdpyn
MD5:	DD191062060590C0D600716C0000584F
SHA1:	FB43EED97C406A516B047A92AA14018EA551BAFD
SHA-256:	B165AB96689DB86DE9A3A64126C12CD7891F60C4CFD4F4A4834A37399E508B36
SHA-512:	C5B280224A29D1E1BE9E09768B2713B1D3E4EC75F91732C6CB68CF195AA6E6D8D8A57E116975896AD01854CD328021AC973072E2DE0ED660C5E8EB5FF456FA8C
Malicious:	false
Preview:	Search for GEN..print(#6);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-UJCS6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.691435688769648
Encrypted:	false
SSDEEP:	6:TFJPDGFsFErvIlqFfsF1AFErYhlqFHR3FErpKyGBk/y:TPcrIlQU7qlQxSKyGeq
MD5:	1099F9D77704C38755C4E0E9257561CC
SHA1:	E3A5EC8B5A09666EEAA6F5E3FEB7677CD8A3C6AB
SHA-256:	0F33ABE013C74A3136164DA66CEC2BEF7285AD88165AE5E2615FA90FDBD63272
SHA-512:	0469708CD802E0A1784E7DA7E1A77CF4E8B91A2E2F1E11F07D2CF7949C2C2B4AEA55D6C3369BF790E73479C5CF263B87D1E27F89918D1EC6926460246D02046A
Malicious:	false
Preview:	Search for NSR..if( strcmp(#9, "A") == 0 ){.. print("YES");.. return;..}..if( strcmp(#9, "V") == 0 ){.. print("NO");.. return;..}..if( strcmp(#9, "N") == 0 ){.. print("NOT AVAILABLE");.. return;..}..print("unknown");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-UV6DK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	4.737515256933273
Encrypted:	false
SSDEEP:	6:TFUJVHqXlqaCl6iHFErebAIlyFIFErcr+lPKFErohwlqHFErqqq4lUFErHgqgl9v:TOElZClXcIlWsr+lPDlqUllbglWE
MD5:	322E4C0407390097FEBF059F6809EAE3
SHA1:	87FE7237D7FF62AD7B2611E48DCEEA8D48CE53CA
SHA-256:	5B9AD1CB6CE0B1FBCDF3E3C1E5C3BE3822828C59B35E51850C77C456A2B5D0CD
SHA-512:	32362C709C8A83F0C6282618C2FF0159FDCE18CB41C710D807A3DF0D367CC88C8597C3349A5B486A4E1E28D43BA6FFDF3866D0934611BEF85ABF873DF3964EF5
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"0") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#6,"B") == 0){.. print( "BRIDGE");.. return;..}..if (strcmp(#6,"P") == 0){.. print( "PORT WING");.. return;..}..if (strcmp(#6,"S") == 0){.. print( "STBD WING");.. return;..}..if (strcmp(#6,"C") == 0){.. print( "CONTROL ROOM");.. return;..}..if (strcmp(#6,"E") == 0){.. print( "ENGINE SIDE");.. return;..}..if (strcmp(#6,"W") == 0){.. print( "WING");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-V11LN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.782390539923682
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJgeuo+UoU6X9Peco+3AGXKc31+CQHFxx:TFaoEFcrV2g/Itge9vfqeXGfkCSPmW
MD5:	98D1D4C295FADEAFB12E6F168FCD9237
SHA1:	77C7B7665CEC7C095301DB80D57F8C2660440838
SHA-256:	AFF41DF2DCD3054B991920CA632DFB13F63175502F6CA812D70789516E8E3E3C
SHA-512:	E558E5F2BB2F78FCF54B6BF0595BF5C7E40F7437969169A01244EEB87D33CF1D258ED5AE886E7588FB8864ADF70F11525D25A42715A9D4BA3181A923DA8B7AAE
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"E") != 0){ .. return; ..}..if (strcmp(#3,"0") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-VFQJD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.817503453132198
Encrypted:	false
SSDEEP:	6:TFUJLlqaClsAKFErowlsKemFEraUAd6lslEQFEra42t7qgE:TKlZClsAPlsKeEUhlsj4K7qgE
MD5:	B6EF21247E9C10DFA344FE31BA228D1B
SHA1:	45B28D423810630D17A299AE08A9F2A007FD3E7D
SHA-256:	4FA769729185DA8D6385EC4726ECA7F5007854C3FD80A7C899630E24D108A960
SHA-512:	F75351F6A8E37E26F84F6BDAF48FF211D8D85D574270A115B75302BB27A626F1226DE1639B3C1473DFC5660EEA33C808BC9CC2089CC0C20D4161CF9E1739B61A
Malicious:	false
Preview:	Search for ETL..if (strcmp(#7,"1") != 0){ .. return;..}..if (strcmp(#3,"O") != 0){ .. return;..}..if (strcmp(#5,"20") == 0){.. print( "STAND-BY");.. return;..}..if (strcmp(#5,"30") == 0){.. print( "RUN UP");.. return;..}..if (strcmp(#5,"40") == 0){.. print( "FINISH ENGINE");.. return;..}..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-VL0VV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.351823225551765
Encrypted:	false
SSDEEP:	3:5NFDgG6LM3vn:TFQAvn
MD5:	1BE0A0A531D7DFE5158294AE79787B4C
SHA1:	C3B62D3A7E7E4EF1BFB3EF9C8FFAF39DFBAC2A4D
SHA-256:	93AC6FCABB3A51A43E7AA35EAAAFDD100D5F97DD500A9932654DA5F1A59E1CD1
SHA-512:	2019EF2D01577DC022F0AF5D3A6976ACE733E55942DA4D63335E3246C5FA24B02AB9181B17C9F5C286DAE5ABBF29B32D0F02F6F04E6CFCA716A62A7300C3D70D
Malicious:	false
Preview:	Search for ALA..print(#7);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-VNI75.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	219
Entropy (8bit):	4.797208405210606
Encrypted:	false
SSDEEP:	3:5NFDq1vCmX9KdEBjH8rV2g/I+3ASbX9OJgeuo+UoU6X9PMMco+3AGXKc31+CQHFL:TFaoEFcrV2g/Itge9vfq5GfkCSPmW
MD5:	907BE00AD69828BFAFC26D4634EE73C5
SHA1:	017B1E0D8527780664D4A0C7E362742146AF3FF2
SHA-256:	EE954B4AA9CBCE49BE03A298E3BE24993CF503ECC655364986AA6B3A401470CB
SHA-512:	B691A5868CAB244F2B0F8AD8862E52ACF13A17E681A9C6E47C54FA3CE13941C520746A11195D985B8C1245B7289D392E63A3CE02646B074D101B0FC4825D8156
Malicious:	false
Preview:	Search for RPM..if (strcmp(#6,"A")!=0){ .. print( "Data invalid");.. return;..} ..if (strcmp(#2,"E") != 0){ .. return; ..}..if (strcmp(#3,"1") != 0){ .. return;..}..print( #4 ,"RPM");..trend( double( #4));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-VTAC6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.418157288156419
Encrypted:	false
SSDEEP:	3:5NFDf2plNXMf:TFbYXK
MD5:	FA44FD4263F7940EBE4F3211508FF122
SHA1:	B13BE419944B0007863D9715766312B5C5A96DE8
SHA-256:	8FC2D817D80B52DF2BEFD99A88395011AF1418CFE5ACD960FB13A0000FEA0B41
SHA-512:	F5B7243112F9CCBE69E19C7C4E9736E80721FFB5AF087F7E704610D53ED0AB6613A0C32C57AF498ACF12DCB5EDACE1C39BDE6BE49BAE97A1F2220556DFCDA2F7
Malicious:	false
Preview:	Search for GNS..print(#12);..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\is-VTFNQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.895840154756691
Encrypted:	false
SSDEEP:	6:TF4mFErV2g/Il0XGjq0pxMeTTHf5PYJIMgeLREH0Yu:TOT2gglmGjVXv/dYJIhdNu
MD5:	CF43C3C7BD49EAAB06248A5406A9DE63
SHA1:	CB83A5508051208D73DA310D9D53093584760459
SHA-256:	ABA5CB312F72847FE14F09D8CD4956B31A672311DDAC002B53773BDC81B255D0
SHA-512:	94CF6D3ED4685A31C7A36E9DC416AC02954CE97D1169358DBEECC99E09B07D1C7A7F5FD9F6D060F1C7FFCEEAAB12B4F4B9B4AA4874094038FE923DDE07AF1C1E
Malicious:	false
Preview:	Search for TRC..if (strcmp(#4,"V") == 0){.. print( "Data invalid");.. return;..}..if (strcmp(#4,"P") != 0){ .. return;..}..print( fmt("%4.1f",double(#3))); ..print ("%");..trend(double( #3 ));..if (double(#3) < 0){...print(" PS");...return;..}..print(" SB");..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\decoder\test.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.722027548259446
Encrypted:	false
SSDEEP:	3:5NFDB9KR4HBloFifn:TFN9DPYif
MD5:	5CE563CCF3AF24FEA99561755B50B3FC
SHA1:	08AD7E2680295ED57F63986C5E81156EB16DADB4
SHA-256:	86B2D4720434C65F59D4B92CB8C33769CFF920FBAC91F90ED37BC13C247963C6
SHA-512:	BAE1818CCAF0774FA7C4E52D9A93FFA5FDC764DD86BCE80892E7DCCF932DBFB99EE1E9CDEE811F91F7C17EF9A3098AEE92D073E72EA8C9D3DC75F034FD88C3D1
Malicious:	false
Preview:	Search for HDT..print( #2,"@");..trend(double( #2));..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\env.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	5.655995512493813
Encrypted:	false
SSDEEP:	48:4lCrKlH7BBJ4nYJczews7XANIL9+SOICmGAI9KImqwzUgltbo3VYPZfA:4lCriGYuBsbAw9+3zrGq146UfA
MD5:	2EFB185ACD63EA96FF009CA4CF96096E
SHA1:	EED13F85B8E92EF508A674BA0EA86403491DF0C5
SHA-256:	70C699E74AE2AA300D92CF442A3D605AAF39BDFEF9C81D955A27C90B50F7E433
SHA-512:	B2495ECED24EFE4D3CB88A5362CA73AFDAF63C59B4BAD228A913F562D343E802E36A067B066A41121259C27DBC16FACAC7C475D8823CAB91466D3A753500B53A
Malicious:	false
Preview:	@ECHO OFF....SET APP_DLL=./../dlls....SETLOCAL ENABLEDELAYEDEXPANSION..REM REQUIRE VERSION : 1.8 (supported 32bit version only)..SET VV_JAVA_REQUIRE_VERSION=1.8..SET VV_JAVA_HOME=....REM RECOGNIZE OS ARCHITECTURE (32bit OS / 64bit OS)..IF "%PROCESSOR_ARCHITECTURE%" EQU "x86" (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\AdoptOpenJDK\JRE..) ELSE (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AdoptOpenJDK\JRE..)....:MAKE_ADOPT_JAVA_HOME..echo Get Adopt Directory from Registory Key (primary)..for /f "tokens=1" %%A in ('reg query "%ADOPT_KEY%"') do set ADOPT_VER=%%A..if "%ADOPT_VER%" EQU "" goto MAKE_ORACLE_JAVA_HOME..for /f "tokens=1" %%A in ('reg query "%ADOPT_VER%"') do set ADOPT_HOT=%%A..for /f "tokens=1" %%A in ('reg query "%ADOPT_HOT%"') do set ADOPT_MSI=%%A..for /f "TOKENS=1,2,*" %%A IN ('REG QUERY "!ADOPT_

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\images\is-1BAIT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PNG image data, 986 x 517, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	29117
Entropy (8bit):	7.788435447270712
Encrypted:	false
SSDEEP:	768:V83JGlh06cabKVbX93c1FFE22v2Fxj3eOpZ:VyJohv3bCqFC2okxbeOj
MD5:	C86F08EF26B0425B60BAFFFA076E6E31
SHA1:	4A0075735272AE99D713A3891EB9D040E447834F
SHA-256:	FE8BAD3E3B6FC1663B1275709CA07170910D862498B1CB9578D4244739B072A9
SHA-512:	6A11A837A3280D9EEF368993023A43BC35D77D983736FA3D9BE968DB221A98F1C683C503F1643F91386E879964F01D05013D1C20D56335265D326CA76285445A
Malicious:	false
Preview:	.PNG........IHDR..............j.^....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..q;IDATx^...x........C......Hh.\....L5..f .L....J.....lK.S..m...{.w[.lK..._.#....vwvf...'.ng.3.{.....Yiii...@....@....@.......... .... ......<).B.@....@....@.Z..... .... ....x%@..J.r.@....@....`v.1.... .... ..w..{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@....... .... ....x'@.....@....@..../@.........@....@.;..w...... .... .x..x..... .... .........d..@....@.......?..@....@.....N.8.=%#.... .....^.8..!.... .... ..w..q..)....@....@ .........@....@..... .{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@....... .... ....x'@.....@....@..../@.........@....@.;..w...... .... .x..x..... .... .........d..@....@.......?..@....@.....N.8.=%#.... .....^.8..!.... .... ..w..q..)....@....@ .........@....@..... .{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@......

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\images\is-KKI70.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PNG image data, 986 x 517, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	29117
Entropy (8bit):	7.788435447270712
Encrypted:	false
SSDEEP:	768:V83JGlh06cabKVbX93c1FFE22v2Fxj3eOpZ:VyJohv3bCqFC2okxbeOj
MD5:	C86F08EF26B0425B60BAFFFA076E6E31
SHA1:	4A0075735272AE99D713A3891EB9D040E447834F
SHA-256:	FE8BAD3E3B6FC1663B1275709CA07170910D862498B1CB9578D4244739B072A9
SHA-512:	6A11A837A3280D9EEF368993023A43BC35D77D983736FA3D9BE968DB221A98F1C683C503F1643F91386E879964F01D05013D1C20D56335265D326CA76285445A
Malicious:	false
Preview:	.PNG........IHDR..............j.^....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..q;IDATx^...x........C......Hh.\....L5..f .L....J.....lK.S..m...{.w[.lK..._.#....vwvf...'.ng.3.{.....Yiii...@....@....@.......... .... ......<).B.@....@....@.Z..... .... ....x%@..J.r.@....@....`v.1.... .... ..w..{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@....... .... ....x'@.....@....@..../@.........@....@.;..w...... .... .x..x..... .... .........d..@....@.......?..@....@.....N.8.=%#.... .....^.8..!.... .... ..w..q..)....@....@ .........@....@..... .{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@....... .... ....x'@.....@....@..../@.........@....@.;..w...... .... .x..x..... .... .........d..@....@.......?..@....@.....N.8.=%#.... .....^.8..!.... .... ..w..q..)....@....@ .........@....@..... .{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@......

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\images\splash-vmv.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PNG image data, 986 x 517, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	29117
Entropy (8bit):	7.788435447270712
Encrypted:	false
SSDEEP:	768:V83JGlh06cabKVbX93c1FFE22v2Fxj3eOpZ:VyJohv3bCqFC2okxbeOj
MD5:	C86F08EF26B0425B60BAFFFA076E6E31
SHA1:	4A0075735272AE99D713A3891EB9D040E447834F
SHA-256:	FE8BAD3E3B6FC1663B1275709CA07170910D862498B1CB9578D4244739B072A9
SHA-512:	6A11A837A3280D9EEF368993023A43BC35D77D983736FA3D9BE968DB221A98F1C683C503F1643F91386E879964F01D05013D1C20D56335265D326CA76285445A
Malicious:	false
Preview:	.PNG........IHDR..............j.^....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..q;IDATx^...x........C......Hh.\....L5..f .L....J.....lK.S..m...{.w[.lK..._.#....vwvf...'.ng.3.{.....Yiii...@....@....@.......... .... ......<).B.@....@....@.Z..... .... ....x%@..J.r.@....@....`v.1.... .... ..w..{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@....... .... ....x'@.....@....@..../@.........@....@.;..w...... .... .x..x..... .... .........d..@....@.......?..@....@.....N.8.=%#.... .....^.8..!.... .... ..w..q..)....@....@ .........@....@..... .{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@....... .... ....x'@.....@....@..../@.........@....@.;..w...... .... .x..x..... .... .........d..@....@.......?..@....@.....N.8.=%#.... .....^.8..!.... .... ..w..q..)....@....@ .........@....@..... .{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@......

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\images\splash-vv.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PNG image data, 986 x 517, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	29117
Entropy (8bit):	7.788435447270712
Encrypted:	false
SSDEEP:	768:V83JGlh06cabKVbX93c1FFE22v2Fxj3eOpZ:VyJohv3bCqFC2okxbeOj
MD5:	C86F08EF26B0425B60BAFFFA076E6E31
SHA1:	4A0075735272AE99D713A3891EB9D040E447834F
SHA-256:	FE8BAD3E3B6FC1663B1275709CA07170910D862498B1CB9578D4244739B072A9
SHA-512:	6A11A837A3280D9EEF368993023A43BC35D77D983736FA3D9BE968DB221A98F1C683C503F1643F91386E879964F01D05013D1C20D56335265D326CA76285445A
Malicious:	false
Preview:	.PNG........IHDR..............j.^....sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<..q;IDATx^...x........C......Hh.\....L5..f .L....J.....lK.S..m...{.w[.lK..._.#....vwvf...'.ng.3.{.....Yiii...@....@....@.......... .... ......<).B.@....@....@.Z..... .... ....x%@..J.r.@....@....`v.1.... .... ..w..{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@....... .... ....x'@.....@....@..../@.........@....@.;..w...... .... .x..x..... .... .........d..@....@.......?..@....@.....N.8.=%#.... .....^.8..!.... .... ..w..q..)....@....@ .........@....@..... .{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@....... .... ....x'@.....@....@..../@.........@....@.;..w...... .... .x..x..... .... .........d..@....@.......?..@....@.....N.8.=%#.... .....^.8..!.... .... ..w..q..)....@....@ .........@....@..... .{gO.. .... ..... ..~...... .... ...q.;{JF....@.......q<.C....@....@........S2.. .... .@......

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-01ARM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255
Entropy (8bit):	5.47963889152615
Encrypted:	false
SSDEEP:	6:/kFDb1jOx0ec77Lr87KtJqdlsz49+pXWOtWBQCvn:/AR4C7Lr87zd+z4M5WOSv
MD5:	0507C51AF9DA9E6F7CEA66AD4CE143AF
SHA1:	C3ABA1B7F0D31D8FA7D4E12C9452E581BE88BB3C
SHA-256:	61DDEC5B36E39E1F077265DB29843FCB36AF14417300F891FDF36C5DF41CBA0A
SHA-512:	DFB35870621AC25700BA5663C46BBF01CE5166128EDECE351923CCBCB50ACAF091CE68B3DECED38061F8E22BED3ADA84A67A9D87188C8432E172F4F624F88907
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms64m -Xmx512m....SET SPLASH=./images/splash-vmv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP%....SET SPLASH_DISPLAY=jp.co.furuno.vdr.util.SplashViewer....SET MAIN_CLASS=jp/co/furuno/vdr/app/MaintenanceViewerApp..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-12RQJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3650
Entropy (8bit):	4.637588880744435
Encrypted:	false
SSDEEP:	48:k8w6SFSS6SBk2Ki+lazlS94uxzqy5R/QenRbqElAoSEXaajTXK8KMKdD:/QiU9x+lWRuxzPRYeRGotZXfTqD
MD5:	5E0A36C001C6E7713E2B68A7232000B2
SHA1:	1676241A91D7C77DD1CF9EEEBC4B2A3EF9163E0C
SHA-256:	823B40B213152A255F01E5BCA31B115EAC494DCC72EE0F5514AF417A43AC5EDD
SHA-512:	B9A8E9BA9BC07A07A35F025EC73C434727B72C769CAEF29C3AB7567904905CBC5EA5D333E988344C6DEF26C077F6D9315CEC6990720ECFA06485657AB3297BB1
Malicious:	false
Preview:	@ECHO OFF..echo ======================================================================..echo %0 %1 %2..echo ======================================================================..REM ----------------------------------------------------------------------..REM set destination version..REM ----------------------------------------------------------------------..if "%~2" == "previous" (.. set DEST_ENV=previous..) else (.. set DEST_ENV=latest..)..echo start-up [%DEST_ENV%]....setlocal ENABLEDELAYEDEXPANSION..REM ----------------------------------------------------------------------..REM check running application version..REM ----------------------------------------------------------------------..cscript versionCheck.vbs....REM errorlevel 0: none, 1:previous, 2:latest..if %errorlevel% == 1 (.. if %DEST_ENV% == latest (.. echo ** running [previous].. .. REM display MessageBox.. echo msgbox "Previous versio

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-25URM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2417
Entropy (8bit):	5.600665127439893
Encrypted:	false
SSDEEP:	48:Yzzyqy/mqD3baL5RoXBz2x6AiVolwg0t7+EIKCgLMeCMMLNLL7Cgb9BUocq:Yi/OquLroXV2x6TWwp7PBANCgb9Eq
MD5:	54CA503EFF1423862F6E74937F913DF9
SHA1:	4808997E8C0221F25C345BCB0339BE86AFB0DEED
SHA-256:	15CD6BC2F343D8478155DA284F9CE95C8CB2C236916E8F754145737F7A6EE2BC
SHA-512:	BF70003E7C77D2776B2193CDB5C125F23031972E38243DCF65DF0F9E5594555E073B828965AE940387AD3490722A6CA77D63A6695F60B67B15F566B065D95A2A
Malicious:	false
Preview:	' ############################################################..' .N.........Viewer...C.V.o.[.W..............`.F.b.N......' ..' return..' 0.FViewer..N............' 1.F...o.[.W......Viewer...N...........' 2.F.V.o.[.W......Viewer...N...........' ..' Create : 2017/05/12 S.Harada..' Update :..' ############################################################..Option Explicit....Dim WSHShell....' Live Player..^.C.g...o.[..\.............Const searchStrLP = "Live Player V5"....' VDR Maintenance Viewer..^.C.g...o.[..\.............Const searchStrMV = "VDR Maintenance Viewer"....' Viewer..V.o.[.W................Const searchStrVersion = "Version"....Set WSHShell = WScript.CreateObject("WScript.Shell")....' Viewer..o.[.W.......`.F.b.N....B..' Viewer...N............C......I......B..Call CheckVersion( )....' Viewer...N.............C......I......B..WScript.Quit(0)....' ############################################################..' .\......E.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-3GACO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	230
Entropy (8bit):	3.3099117792814483
Encrypted:	false
SSDEEP:	3:/qQK2gupgw9xuvn1afugAG/s3tbadbNnLAdN:/kHu7uN5gj/s3FWnLAdN
MD5:	E7BF3257C2B7ED8755A28FA49224AC46
SHA1:	50BB3B8C7A5F2E12203675C8CE9431D5F88AB053
SHA-256:	9CA952C86AC13AE709F56191B29978A91A88A78FD98CE62F7BB0AA747A9D1BB6
SHA-512:	C682D05786C0C5FD9CCAC38D6E7E6036F8956C56D3D6940C6E80AB9D11FBE0D301BE2B68F7F9C66200603432D095568FE6692557AC98AD449D811C47601EDE1B
Malicious:	false
Preview:	@ECHO OFF..SETLOCAL ENABLEEXTENSIONS....REM ------------------------------------------------------------..REM delete latest backup..REM ------------------------------------------------------------..rmdir /S /Q ..\_latest....exit..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-6E9GU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.317983857336911
Encrypted:	false
SSDEEP:	6:w5EMJNxMGOyXFrW5WZMcEWcycFIvA1GqVJMwZVMpTsnkJIJ+1S2Vcl:w5EMXxXOyVrW5WZMcE1y0IcqTskG4Sfl
MD5:	B18579A6A1D73835A638971F351140B4
SHA1:	A84E29B48083B075FC6BC2B9E1F9700E648BE84B
SHA-256:	4DF3F8E341004A4A4B06DC2C1189ADF2969AF231DD4DB667E2235C83A8968E38
SHA-512:	9CD8D28DECAF505826B074FDF5EF41172389DE0C93A8974714DA562CAED9AB3506A2643B9C6769C0FD6C698B1786C87347CB6C7D725CBBB9B0405756A653C525
Malicious:	false
Preview:	It failed in allocating a memory necessary for the running...Please allocate an empty memory by the method such as quit other applications..or increasing a physical memory, and restart Live Player V5.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-6GM6L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.75319606505958
Encrypted:	false
SSDEEP:	3:/qQKyn6AuBHofxVQUH4m5A3IrggA5Ao8Uov:/k9CVd4m57BA5Yv
MD5:	1A82800650E8277DA72DCAEEE4C6E57A
SHA1:	C1C1DB3FCECB5FE076231B340D098BA28E5928C5
SHA-256:	16CBA1A49548ACECA21875D917D30399B662E9C97DDA621459E80F3E17633077
SHA-512:	37D52E784030C1661BD53784032C3D2E12F9808B8CFC595F08CDFB87A2854BD5550C157349F9B776D5ABC19E6EAC896844D2F530F9BFE5941A69522478B49E7D
Malicious:	false
Preview:	@ECHO OFF....REM NO edit this file!!..REM (This file convert to maintenance.exe file)..CALL maintenance.bat %1..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-84QUO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	634880
Entropy (8bit):	5.830287591283141
Encrypted:	false
SSDEEP:	6144:JsSrVaADBmG9ksHN7IAuqfDD5UB/mcSD/bea+J04T9Tc6YL2GymlBKzdFv+zQ:JsHADvkkN7IXqvi/YbbeauBZcX8kWdZ
MD5:	935AB82B8DD966A4CA9ABB62DE6CF869
SHA1:	1807B34685A2886DFA02868F02C6F5EEBA2BD7E0
SHA-256:	A31D98CA993D7F41B2A0609DF5F941B05B1F443E7D596ED317EC16383FD910DC
SHA-512:	0879DDB17A3A3AFAA265F6961A1B03D6BB3FDDC8B4B8B1C7A924E00C55C6842D87B86246105AE8448C71E884208729374CB60E9C63858F64621ACA15F882B9FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.n;g..hg..hg..h.S~hn..h@Q}hF..h..]hn..h@Q{he..hg..h...h@Qmh...h@Qnh...h@Q\|hf..h@Qxhf..hRichg..h........PE..L......b.....................`......c.............@.............................................................................x.......................................................................................x............................textbss.................................text...5........................... ..`.rdata..............................@..@.data...0,..........................@....idata..W........ ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-AVUUC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	3.9275753732673406
Encrypted:	false
SSDEEP:	3:5KOAoApMA/0IiTLD5NZV:cOUMDtTLdjV
MD5:	7504F021590A476273ECB3D5493B91AE
SHA1:	CCFFA2FED7EB43D197C50BD110AAEE1BCEFAA389
SHA-256:	C9E1484D045E5A17562A7E5859914F12D2AB4BC44D7CECAF1DD903654F6F5AE2
SHA-512:	622C5CFA37A3DED6C5012092AB9F28AE3A4A7F72CE71F8CC721B2F14B45220C385DAA9833F0E01B9012645583872471BBFB29D9A38D8D31944B4DA52BD6A68EB
Malicious:	false
Preview:	maintenance.bat..vdrviewer.bat..vmv-env.bat..vv-env.bat..env.bat..splash.bat..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-B4QCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.460399365244328
Encrypted:	false
SSDEEP:	3:SXKVKwQzgKGWuKCFQZdlIXV5GQ9rAXVgKuJCVLOQFJEmKxUL4:S0+zIWXHblkHSXcCVxP4
MD5:	BE816084311BB68552900A9342B6CF6B
SHA1:	209167C831134C9FB593CC248C823048492E654D
SHA-256:	36D7B2270E4FD3FC3F6E32089929D854425044D12B501649FC82A63BC70E5114
SHA-512:	FDAEE278AEC06C1BF1BD17CBE0EAF813C45D8FAA071A8E1BD2999591064F0FBE8E022F0FCBDDEF4E374112D4507B9D14F6F5CB01E1ACDC45DB5AF3A992DAF1AD
Malicious:	false
Preview:	Error occurred during starting up, because JRE version is invalid...(Supported JRE version is 1.7 or later)..Please install a JRE later than 1.7.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-E3HEM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.8336642463816775
Encrypted:	false
SSDEEP:	3:/qQKyn6AuBHofxVQUHytsrghXAa2ov:/k9CVdytsuQ6v
MD5:	0249CD57C98C6A599BF599534A03A8D5
SHA1:	1686625571DB807C64E2C5B87D0532833D1BA77B
SHA-256:	DFEC622B2D51F19B53E96C7ED5EC9185EA9F6DD6B469A63CABA22F874022150D
SHA-512:	5A0C66860C6E6B072234D1FCC812F654462E23D84D5C0FB4F23E49EA1EA3DA6BA7C6AE18EC8D5C910DCEEB62898CC2D18289AAD62D2920F7686CDCC043ABCFA8
Malicious:	false
Preview:	@ECHO OFF....REM NO edit this file!!..REM (This file convert to liveplayer.exe file)..CALL vdrviewer.bat %1..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-FCUIO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	486
Entropy (8bit):	4.9144007171521285
Encrypted:	false
SSDEEP:	12:StpqbvWdwb24BURBSCPfl0Dxb//foKHBz4nKgs0g3aHrqms0g3aHAW:cqbASuT10t5HFd3M43MH
MD5:	8F64CDE5953656472AF7DBABEB328126
SHA1:	89BB49EB6815590D0FC84E7CD05059B9E926EF92
SHA-256:	9D16AE3A0B161CB9800959BB853B380F49639D8DB9BC64AEB53D602AA01E0B38
SHA-512:	A1B2F75F4385A06815C836E03DD052EDFD82F1500105A0D25E925012D15878DFC22A170F53890D43E068710FF495B2983F01E7CB6DED203B3D4337C81B52B29D
Malicious:	false
Preview:	Option Explicit..Dim fs, su, suStr..Set fs = WScript.CreateObject("Scripting.FileSystemObject")....On Error Resume Next..Set su = fs.OpenTextFile(WScript.Arguments.Item( 0 ))..If Err.Number = 0 Then.. Err.Clear.. suStr = su.ReadAll.. If Err.Number = 0 Then....MsgBox suStr,16,WScript.Arguments.Item( 1 ).. Else....MsgBox "Error occurred during proccessing.", 16, "Error".. End If.. su.Close..Else.. MsgBox "Error occurred during proccessing.", 16, "Error"..End If..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-GD191.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.460399365244328
Encrypted:	false
SSDEEP:	3:SXKVKwQzgKGWuKCFQZdlIXV5GQ9rAXVgKuJCVLOQFJEmKxUL4:S0+zIWXHblkHSXcCVxP4
MD5:	BE816084311BB68552900A9342B6CF6B
SHA1:	209167C831134C9FB593CC248C823048492E654D
SHA-256:	36D7B2270E4FD3FC3F6E32089929D854425044D12B501649FC82A63BC70E5114
SHA-512:	FDAEE278AEC06C1BF1BD17CBE0EAF813C45D8FAA071A8E1BD2999591064F0FBE8E022F0FCBDDEF4E374112D4507B9D14F6F5CB01E1ACDC45DB5AF3A992DAF1AD
Malicious:	false
Preview:	Error occurred during starting up, because JRE version is invalid...(Supported JRE version is 1.7 or later)..Please install a JRE later than 1.7.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-HJLRM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	5.065986743610286
Encrypted:	false
SSDEEP:	48:SY2dceWTMmzbJjQy7w4YFigqfpIcfNQIneySX8USo6cvReFIMFiCncy6yQjIX1Kq:8ubJjQOw4OigeBNxPqOiCnlWG1KP2jD
MD5:	78423506D10EB0261B7A9F3FFC6E437C
SHA1:	99619C0E9C41EEB8E2349D067DCE14BA26AF4CB9
SHA-256:	3ECC4732A7046EA3604834F68B39E76AC256674B95F32BC562552AEAA21806F1
SHA-512:	BA065788ACF0F813317D90EAD9D84E6B4295A9911D9444066CAB98DDB86593BD7509F541D05C069CADED4B4E7B38EB30E2014877597A0FB7150342839BB4F8EF
Malicious:	false
Preview:	@echo off..REM ====================================================================..REM File Name : Live Player V5 (VR-7000/S) Set Firewall..REM Create : 2016/02/16..REM Update :..REM ====================================================================..setlocal enableextensions enabledelayedexpansion....REM ---------------------------------------------------------------------..REM Set Environment..REM ---------------------------------------------------------------------..call env.bat....REM Delete Double Quotation..set JAVA_EXE=%JAVA_EXE:"=%....REM echo on....set SETUP_FIREWALL_LOG=%CD%\log\setupFirewall.log....REM ---------------------------------------------------------------------..REM MAIN..REM ---------------------------------------------------------------------....cd ..\.....REM Delete Old Log..del /q /f "%SETUP_FIREWALL_LOG%"....REM Windows XP.H..call :IS_WINDOWS_XP..set IsWindowsXP=%errorlevel%....REM [TEST] notepad.exe..REM call :SET_FIREWALL_RULE "VDR L

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-I844M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4794
Entropy (8bit):	5.105000295370866
Encrypted:	false
SSDEEP:	96:UJPoQMRQLWwmlMGXP37e4iqZ/P1qVqC8KqyqRtPuJqbDx70:qM+U/3a4ia3k8RtuIvxA
MD5:	7B3FC3129561DE48F925A6904E181EA7
SHA1:	B1087BD31D8230ABCDDCA95BC07F0F2682A0EF1B
SHA-256:	988304D91A86FDFE3ADFF267E2931104104C8EBDF0DA73B772F7553C177DA30D
SHA-512:	D8D2051D68DD8D837697710B3F0ED3896C71FFFB5EE1E1CE51FA4FA29A0FD1F6EC2E6B84797489EF7123614BC2CC6384D8AE743CEE455DE2D2462822516348C6
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..CALL vv-env.bat....REM display splash screen..start /b splash.bat....setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="Live Player V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)....REM ############################################################..REM Environment Check & Replacement..REM ##############

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-K3GG7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.489934819189806
Encrypted:	false
SSDEEP:	3:SXKVKwQzgKGWuKCFQZdlIW3RhgOBLZlX7ERMDDV/dA0y1JCVLOQLn:S0+zIWXHbleOBLZhjdD+CVxL
MD5:	982FCEFC9B84EFEF75FB81B7B7DB2E1B
SHA1:	2B2507AAF509883B764B36A41B65742A03B35E6F
SHA-256:	3F89F3B895CE6404B23AC134F5BAF3BFE743D5AF01208A21A1AB006C7FF646CD
SHA-512:	46A3344E011DFE49B1DB9ECC4F75399823D0C6D9E9879163B48A93ECDC46F4E7D172170F2A376600AF8639FA7BA23BB5E667335228FF880A3C9240D80283877A
Malicious:	false
Preview:	Error occurred during starting up, because JRE has not installed...("JRE" is foundation software to start up VDR Maintenance Viewer)..Please install a JRE.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-LJT7B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.54641866126203
Encrypted:	false
SSDEEP:	3:SXKVKwQzgKGWuKCFQZdlIW3RhgOBLZlX7ERMDDV3xEc0oJCVLOQLn:S0+zIWXHbleOBLZhbCcRYVxL
MD5:	913E80B4EDE93D8F437DE6722E16CC68
SHA1:	858CEA17D3659B3F6D7891597462542516DB7535
SHA-256:	021E6E83FA416330B0A951C530FCC9560C2427A1BBAA7604376AC529C048D0B9
SHA-512:	6ECC9D93A1CA1AD62F6561BD8015FB0F7B209765534940DF8112B0FDD979A9472B6457EFB66C0933F2582A55C46D4DB888D662E96D4E72A447496640575509CE
Malicious:	false
Preview:	Error occurred during starting up, because JRE has not installed...("JRE" is foundation software to start up Live Player V5)..Please install a JRE.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-MA2HG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4811
Entropy (8bit):	5.101209286895512
Encrypted:	false
SSDEEP:	96:3nPoQMRQzWwmlMGXP37e4iqZ/P1qVqC8KqyqRkuJ4bjJ79:VMYU/3a4ia3k8RkuWXJR
MD5:	CE0E47D3300F3A350E7D61BB5DBB9DEE
SHA1:	BE3266904F001F50A57E23C93D4DD0F09BC1F04C
SHA-256:	C1140DA81AA4A0A81AAC118B084AEFDBF0932AA224780BA9683055EBAB4358B7
SHA-512:	C2B38C666CAB95D453F7B4C6FAF4830E99405BA72901B6D7DAB4D96E78BEDC8B4D64262AD480E56AD66E7142505400CF63B58A097A0592C778B426B5F747D8C1
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..CALL vmv-env.bat....REM display splash screen..start /b splash.bat....setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="VDR Maintenance Viewer V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)....REM ############################################################..REM Environment Check & Replacement..REM ##

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-MFO1U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	7.692998803999232
Encrypted:	false
SSDEEP:	768:/dL5jeeDoqEZ74Xug7UnZxfHrQQNF7Dq:/dNjeD74b0Zx8Q
MD5:	19BB07DFB40E27A42BA2E3EBF3ABC1B3
SHA1:	638A6C12D290F102E11C8B289033CA5ACFE37500
SHA-256:	1148416F2B78FB9261C314DE1A0BDE9191F0F04A35576D30D71C1DB1CBB08B4D
SHA-512:	43BEEED736345D42F60B505C10535312144E86941222858E3145CB0C78F287D03AE6295FC06FAAC099510575F74B0353335FF3C22D683680B1461F35C354F205
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26% Antivirus: Virustotal, Detection: 34%, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L......M...............2.....$....................@.............................................. .............................. .......................................................................................H............................MPRESS1.........N.......................MPRESS2.............P...................rsrc................^..............@..............................................................................v2.17...M.....43..C.c....j.&.....9.>R.....Q.RhN}=g..}..1^-...f.IR..F...rQ.,......f..._?.....O;.YW....'g.I#..+.,&....I........4w;,.I..~)L...$.....{.?l8...R/..>...3.p....P..V4....L$<..GV.._:........8y..p..L.....X.+.xsp.....V)...3..if.......[..hz@B...T..6...PJ:..Wy..9..h......e..a..7..y.wc....[...D..IO.v.~2..\\|.....\|Z.H..-ng0]We.....\.w..k.QRLj.:y...I.o...7....sq.x1#N..8G...x...-.*.s$#.2Gw.%.o....a....p...y.&.....f..lpt....s.S.u..g.aP.......p...G.]%...2...?.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-NE3N5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	5.631556032915055
Encrypted:	false
SSDEEP:	6:/keR56QS4vWht6FqL9EKVD/ovkPYuMYy2+t6WYrcVHbzgXXopN2is0WA:/76oW+yV+zInWYo7iXa5WA
MD5:	963EC3BE6D7AC55CA8CF1988AB867AE4
SHA1:	36BD0F20B825C9688A2BEF8236A047035FBBF9DE
SHA-256:	16A0E02C7675255E032C90402FF436FDD99A06AA20B16E37A64A488559CCF8B3
SHA-512:	D0EFE1E7FB093B304208DDDAF5EA643BECE05B4AA538B5D94953E246166EED2E1F0BD39C272F5B4CEECB43AEAB8020776BFCBE11D88C62FB0D1571E0B44B1354
Malicious:	false
Preview:	@ECHO OFF....setlocal....REM .\......i.b.j..SET DISPLAYTIME=15....REM ...s.t.@.C....SET CLASSPATH_SP=./bin;.;../_latest/Viewer/lib/vdr-client.jar;....REM Java.I.v.V......SET JVM_SP_OPTION=-cp %CLASSPATH_SP% -Duser.language=%LANG% -Djava.net.preferIPv4Stack=true....REM ...S.\....%JAVA_EXE% %JVM_SP_OPTION% -splash:%SPLASH% %SPLASH_DISPLAY% %DISPLAYTIME%....endlocal..exit..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-NEH7S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.518537632651269
Encrypted:	false
SSDEEP:	6:/kFDb1iWVICbec77Lr87KtJqdlsz49+pXWJV:/ARiSICaC7Lr87zd+z4M5Wb
MD5:	7B94FB5A39E1AC3E86A4447EA6488E85
SHA1:	916508C8CF634D73254A0A7F6C17321CD785338D
SHA-256:	B41115A1AFE407203903E20FD011D3035D116795A996C5AA229C19FE0F23B7DF
SHA-512:	F25D8C33239A0CBB40D137258C1E7CF243823E22DFDC1C5108CBBFD6217BBFA45DDE5351392582BCA8D8107F4D898849EBD14E1473D36B1BE938881B98FD21B0
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms512m -Xmx1024m....SET SPLASH=./images/splash-vv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP%....SET SPLASH_DISPLAY=jp.co.furuno.vdr.util.SplashViewer....SET MAIN_CLASS=jp/co/furuno/vdr/app/VDRViewerApp

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-P1HVI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	528
Entropy (8bit):	4.64282523445514
Encrypted:	false
SSDEEP:	6:/kHu7uNhRzj/s3FWnbnLNS6GFNAFS6W5x4fLVUaxJpeOzUKzq56KfsL/:/osuNhsW1dm95xUx9zBCfsL/
MD5:	5D2853DD89B04C09F6AFC0E0307FF7D4
SHA1:	414E14F1829A0F894E16FF25BF93432F32C33819
SHA-256:	A42744B020EFBB0D3DA88773434EE28920AC76A2D5946D8A76EF3BCA0B55A008
SHA-512:	0D6F905531BD425BA937F077EBB6AD340878CE1D542819799CB9AD601608B0BCF63BA3F0A582F825B43637B0FAA8EF57069270DB1BFFD52562AAE53644336999
Malicious:	false
Preview:	@ECHO OFF..SETLOCAL ENABLEEXTENSIONS....REM ------------------------------------------------------------..REM create latest backup..REM ------------------------------------------------------------..rmdir /S /Q ..\_latest..mkdir ..\_latest....REM copy previous to latest (make a state with files)..xcopy /E /Y ..\_previous ..\_latest....REM copy current to latest (only existing files)..xcopy /E /Y /U ..\dlls ..\_latest\dlls..xcopy /E /Y /U ..\server ..\_latest\server..xcopy /E /Y /U ..\Viewer ..\_latest\Viewer....exit..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-PVGSK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	352256
Entropy (8bit):	5.802065785822964
Encrypted:	false
SSDEEP:	6144:K7wMUPVG6p6aH0hgfLt9o8/2Q4/u8EE4evApyT0zQEVIFzhCOvkohG93dBNlHYMr:K75UPVOELSynwGQDf0/L3KpfCFiBV9ZK
MD5:	1669F9908DBDCA5C41F3C3716B69F0F6
SHA1:	65CB7E616D5AF8F7FDD7C42ADFEFD12678A53086
SHA-256:	EAE40AB4DA851C51CA3358A89F5F192F358390C43BD57231D3BE0C53106679ED
SHA-512:	7ECE3BBEECE2B9EB23BA54EAFBEB7014D46C78DA9C811890E9A0C9F7055E8BB44727AD634AB275AC51EF720783C003C0A5CD891FA9347203BE3D804396136488
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|...\|...\|....R.~...[P.k...[P.}...[P.}...Rich\|...........................PE..L....\|.[.................p..........<.............@..........................`.......G....@..................................;..(....@.......................P......p...................................................................H............text....j.......p.................. ..`.rdata..z...........................@..@.rsrc........@.......@..............@..@.reloc.......P.......P..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-QCI2L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.7169715185739918
Encrypted:	false
SSDEEP:	3:dxMqRxukd:jM2xd
MD5:	F1C83E89BF8327FBE4EFE919240E2A8E
SHA1:	AD322A7B3CDE552EB04E40EB088A28B84506A29A
SHA-256:	765BF2B1D540BFDACA9A7F78F38D939C0482996EF82652DF7C5CD7503A4689AF
SHA-512:	CC8B07ADB18890D8ABEF58145CD40A6A585678F799BE175A58DCF4B240ED3E0E89E82FF5252C6269C41C5C23E2E11188B6F396C53176A9171FA54754C69785B3
Malicious:	false
Preview:	LP:2450104-01.64-30..MV:2450105-01.64-30..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-QTH30.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	35328
Entropy (8bit):	7.132664117578073
Encrypted:	false
SSDEEP:	768:/2L5jeeD7Jtyvf9/ODY9ea6cI96G9akwq7hKHC5WEL7DbkPdryF:/2Nje8nKfMMBhY8qICWEId+F
MD5:	7235E09CBCB89FA040C2462E3A1C7078
SHA1:	8A1BE555C5B378C5A5102FE00E992786923451A8
SHA-256:	AEFF758C8FF69AB7811EE337854205EB8A7A9735AE0F485198EE9E81915C545D
SHA-512:	9D33F9CED3FDBAE3E20BB57470BE608720B4133AE015C8B07EED54C11612CBB5254DCDF04960FE41B0DE92A80857CA7E1283E8C625AED90B7193AC448C4EAF40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22% Antivirus: Virustotal, Detection: 34%, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L......M...............2.....F....................@..........................@................... .............................. .......\+..............................................................................H............................MPRESS1.........N.......................MPRESS2.............P...................rsrc...\+.......,...^..............@..............................................................................v2.17...M.....43..C.c....j.&.....9.>R.....Q.RhN}=g..}..1^-...f.IR..F...rQ.,......f..._?.....O;.YW....'g.I#..+.,&....I........4w;,.I..~)L...$.....{.?l8...R/..>...3.p....P..V4....L$<..GV.._:........8y..p..L.....X.+.xsp.....V)...3..if.......[..hz@B...T..6...PJ:..Wy..9..h......e..a..7..y.wc....[...D..IO.v.~2..\\|.....\|Z.H..-ng0]We.....\.w..k.QRLj.:y...I.o...7....sq.x1#N..8G...x...-.*.s$#.2Gw.%.o....a....p...y.&.....f..lpt....s.S.u..g.aP.......p...G.]%...2...?.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-RKI16.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	4.305809813655651
Encrypted:	false
SSDEEP:	6:w5EMJNxMGOyXFrW5WZMcEWcycFIvA1GqVJMwTQTsnkJIJ+1Sq+s:w5EMXxXOyVrW5WZMcE1y0I3TskG4Sq
MD5:	446D5EA4B21086BCB46122F2BA5C1854
SHA1:	326D0FB4592676825418DFCAEBD531D72A99E6EC
SHA-256:	38BF8519390E5F6D4832726B02BD8E58427AFBFE2D625AEB42EECCECEE534B2A
SHA-512:	8AF339E820CEC3A1CF88DC6DFA2ED4A23C8666A0C5B425DE6641BE2B0BE76027F25495774E0EC2ABDFED586DC65B08B7ED2691F25DD1FA0A8592178E19F9FD13
Malicious:	false
Preview:	It failed in allocating a memory necessary for the running...Please allocate an empty memory by the method such as quit other applications ..or increasing a physical memory, and restart VDR Maintenance Viewer.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-T4A3Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	5.655995512493813
Encrypted:	false
SSDEEP:	48:4lCrKlH7BBJ4nYJczews7XANIL9+SOICmGAI9KImqwzUgltbo3VYPZfA:4lCriGYuBsbAw9+3zrGq146UfA
MD5:	2EFB185ACD63EA96FF009CA4CF96096E
SHA1:	EED13F85B8E92EF508A674BA0EA86403491DF0C5
SHA-256:	70C699E74AE2AA300D92CF442A3D605AAF39BDFEF9C81D955A27C90B50F7E433
SHA-512:	B2495ECED24EFE4D3CB88A5362CA73AFDAF63C59B4BAD228A913F562D343E802E36A067B066A41121259C27DBC16FACAC7C475D8823CAB91466D3A753500B53A
Malicious:	false
Preview:	@ECHO OFF....SET APP_DLL=./../dlls....SETLOCAL ENABLEDELAYEDEXPANSION..REM REQUIRE VERSION : 1.8 (supported 32bit version only)..SET VV_JAVA_REQUIRE_VERSION=1.8..SET VV_JAVA_HOME=....REM RECOGNIZE OS ARCHITECTURE (32bit OS / 64bit OS)..IF "%PROCESSOR_ARCHITECTURE%" EQU "x86" (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\AdoptOpenJDK\JRE..) ELSE (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AdoptOpenJDK\JRE..)....:MAKE_ADOPT_JAVA_HOME..echo Get Adopt Directory from Registory Key (primary)..for /f "tokens=1" %%A in ('reg query "%ADOPT_KEY%"') do set ADOPT_VER=%%A..if "%ADOPT_VER%" EQU "" goto MAKE_ORACLE_JAVA_HOME..for /f "tokens=1" %%A in ('reg query "%ADOPT_VER%"') do set ADOPT_HOT=%%A..for /f "tokens=1" %%A in ('reg query "%ADOPT_HOT%"') do set ADOPT_MSI=%%A..for /f "TOKENS=1,2,*" %%A IN ('REG QUERY "!ADOPT_

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\is-U7GO5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385024
Entropy (8bit):	6.511547612155607
Encrypted:	false
SSDEEP:	6144:Q/SyaDgv0IFu2fVkcUjPfa/fCiDtE1p8Dv9X:uSFebXfVkcD3zyYDvV
MD5:	FCCDFB2D9A2CD700B1E2C0D7814E97BE
SHA1:	0465B089A6898AC6B86125E32DF6368A5ACFF7F8
SHA-256:	34D5C7451F47D57ED1ED7E85A29DC3C94847D87A60472461048443140B405985
SHA-512:	0025C4D5E35B4E9E206EB13CFA820E37CC4A984F4F6278051D4F042781162A42623A13812BE01DC432A426D9CFC0E838F2A35DCA74631DEE7BA8CD5F74F8AA8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B]..]..]...5..Q..z7..B..z7.....].........Z..z7.....z7..\..Rich]..........................PE..L......b.............................W............@..........................P......\|M.........................................P....@..............................p..................................@............................................text...S........................... ..`.rdata..............................@..@.data............ ..................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\LICENSE (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11969
Entropy (8bit):	4.486509106233647
Encrypted:	false
SSDEEP:	192:THfTT8UGqxTScKX6Z05qVWGbN231KLvk5LFX8FF/4ae2VxAJGyaK1TPB/zJb1k9P:PAZUNNM1dpKNt0lTcBW0oa7ZkTE2jm
MD5:	77B00E2CC37D39BB47F9FC11C24D1A82
SHA1:	3978B453D806D26B4C4E4AA3AF2421372A05F1FF
SHA-256:	2F2F7C23C936578AC3D402C58C151E83C1451F9B47D4754C467771393E125B92
SHA-512:	24116A8DB4B6190029A7DDB92A5D1146498B10A71764E63141FC0EB59B16C8D84D6DC946D4B513A418D7B5A70BA142AC47BCA6F0FCDDA703A8033358359E0F18
Malicious:	false
Preview:	/.. Apache License.. * Version 2.0, January 2004.. * http://www.apache.org/licenses/.. .. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. .. 1. Definitions... .. "License" shall mean the terms and conditions for use, reproduction,.. * and distribution as defined by Sections 1 through 9 of this document... .. "Licensor" shall mean the copyright owner or entity authorized by.. * the copyright owner that is granting the License... .. "Legal Entity" shall mean the union of the acting entity and all.. * other entities that control, are controlled by, or are under common.. * control with that entity. For the purposes of this definition,.. * "control" means (i) the power, direct or indirect, to cause the.. * direction or management of such entity, whether by contract or.. * otherwise, or (ii) ownership of fifty percent (50%) or

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\ant.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1289806
Entropy (8bit):	7.932553095620212
Encrypted:	false
SSDEEP:	24576:4xVcwZd39YnmPKYbJb8At5cXlfzHNENd/wE5:aJ39amPKIJb3+XJzHNA
MD5:	133E8979E9C11450F557CA890177FE0A
SHA1:	9746AF1A485E50CF18DCB232489032A847067066
SHA-256:	92F72307E7440F1E352C916F2438D2BBAB3FFD2CF730C71316117AD04ABADEA8
SHA-512:	24AD0D5BC6B1A283B3E7A8091F674848266FC0EF6D2B23167BAE8C7B7F2FDA687758C6730161A04664A49122C150885E2499D7BC2AC0E435CE23425EC59CE208
Malicious:	false
Preview:	PK.........9.5................META-INF/....PK.........9.5.R..............META-INF/MANIFEST.MF..N.0.......T$...u.Q+u(K.+:%....-.............w..@.....C..6jeJ).L..;.q6..)...c..?..3.k.....\T...j7..c.U{j..F..X.u.1n..o..N......I@.).`.L..)2)FRH..`..)M..j..G...l......%.`.<........:>C@.s'j3.b?...$.u.......U..u)..PK.........9.5................org/PK.........9.5................org/apache/PK.........9.5................org/apache/tools/PK.........9.5................org/apache/tools/ant/PK.........9.5................org/apache/tools/ant/dispatch/PK.........9.5................org/apache/tools/ant/filters/PK.........9.5............"...org/apache/tools/ant/filters/util/PK.........9.5................org/apache/tools/ant/helper/PK.........9.5................org/apache/tools/ant/input/PK.........9.5................org/apache/tools/ant/launch/PK.........9.5................org/apache/tools/ant/listener/PK.........9.5................org/apache/tools/ant/loader/PK.........9.5................org/apache/

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\comm.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	28043
Entropy (8bit):	7.820842155394776
Encrypted:	false
SSDEEP:	768:M7BE7rv/R41VxQNTq1PSCSW1hJgtuTMc/Sx2y3:0EfZGaTeSCSAJgwTz/k
MD5:	67F04ECDDB9171962A222308ADDB5C84
SHA1:	E1CFFE12249CA60D0A6AB6772C632DF9942AB417
SHA-256:	17E856646323B55F4C1103E75290BEE9433C3BD24EFFD8E6995BC1D64FFF092F
SHA-512:	636AFECEA9C90285BE564A88F3AF4D60F1D9586B6B0E538DC48EFE03E766F881F28233B878CC0851C79E1AC8773D0299CD2A7A303E41C54BB5D18E4686025546
Malicious:	false
Preview:	PK.........o%................META-INF/MANIFEST.MF....X...{%.?.....VI.dG.D.....P6Y..~.....[.b<<.O...=./.#h./6...,...............+..y....U.~?.W..M......,..M....Vo......}.v...5uU^..l..1.\.<9;RN....r;..d.m].S....e..I..S...]....=.B...-n..a.+#$..J7..j.....t....(...El.....MWU7..>hz.j...._CP.....'mwl..S...).h..........(a..C.#..@..=.?...(.....aYF....%..L.W=.ej.I.d.Dz..,3...=...d.%...H.\|\f.@..6....Z...Q.X.p.9..`lR...-..p...!...d.P.?I+...f%5.m....U.4......\|.$.xf./..6.v..v&Ci1.K.7is....M=i....X...qhh42.P....d..CbzG...a..<.n%....8....b.qU+..Y...-.}....0...nX..we&.y....V.].\|....(.D.T...*T...h..'.Y.h\._.....$.6Y..X(.[c..X....;N.`]f...../..H...'..L.p.`.j6U...i{~.............M.......p.d4X..ze..Qg....G`T44....~...L.G.....KJ{7....t....\|^....\|M.E.....<fPYN.:..g[....dO.K...?..P.j....^..,....T"R ...n{$...F.^..k..^O.V..ZY..-.Gc...n.).c..<.......&g0.m.rqk....>....5]....>../d!..mb.n.K.g.Dm.A..m0....z/9...\-).#"...k.O..ITT...&.....%..F.S&..8...W...?...]...k

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\commons-collections-3.2.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	571259
Entropy (8bit):	7.871042230671787
Encrypted:	false
SSDEEP:	12288:0pyvVrrCHWWD0K+8CfLWCsIyx98TNrxraIPRWR5gvjdGJ6g:0IV33WDT+8eLUn8prfoRn6g
MD5:	7B9216B608D550787BDF43A63D88BF3B
SHA1:	F951934AA5AE5A88D7E6DFAA6D32307D834A88BE
SHA-256:	093FEA360752DE55AFCB80CF713403EB1A66CB7DC0D529955B6F4A96F975DF5C
SHA-512:	4C3361C8CF553C6FC34FE10624985BC1A08EA84547F4FB970487E99DC795A67B4BD36A0A1015492019E36DC1AE8B36DEF98F3ED3BF3E8382057923DDF67EE5EF
Malicious:	false
Preview:	PK...........4................META-INF/PK...........4..9.............META-INF/MANIFEST.MF..AK.0...............UV...Mb:..dR....o.....!..o..$..B.w..v.f.XP......z..zI........g.._....f'.l..w.."...T.[....k.. .q.P.Z.!Uc@....\.F...7.&....3.#(.k%..k.U.m.a....Z....]....e...h.w..M..6v4`..o.....Y._.<.7]...........+.W........~.XH...PK...........4.._I{...(-......META-INF/LICENSE.txt.Zmo....^ .aK....e'M....Xr...I.......#.>.2.w.._.gf_..e..V!h.....<...}.;....J.......P.i...^T.o.....^......}...n...\|....?.=..w......;q....n.W.....N......+q{......+z\.[W.......I....q.Z........?.p..pk.ub.d/..xPv...Q....Dk.....U[k....U.^n...^...!.h.T..^....%..f\....E.=S......{$[m.{.W.A.]...TX.....6V..O...Z2.. p..J..W.R..D.........{.%_A.Y.>Q.....}...Bj.....`MW.iU..c.+..=....j..>n...;=..F.....X.d;...d.&.'[..63...g..5;e+...Z$....+1.QKX..........^..Y.Nvc...Ub.V.....,y.vv....i..Vrk...Z.B.[ek.....8...T.v..7@.d......K.C...A'.......3q.../;;/...H1...i7+J?.;.GH.....7.9v.v9..l..^w..k.$.m

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\commons-lang-2.3.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	245274
Entropy (8bit):	7.945063255754872
Encrypted:	false
SSDEEP:	6144:gycxE5gCBLmjqT+5salGjHS27rLkL76EA/uHg:FuE5JBLY5flGjy2fIpdA
MD5:	DCDCBB47176603907C9F79A1349193EB
SHA1:	0EECDAC8C86BC84B4BDFC24371BA8C785A1FC552
SHA-256:	069361C71F22F8D7FBD4C3A568C015E2809327FC2E68699AEB63A64178CDE56F
SHA-512:	9363AF7AD6AB1ADD7AED7547A790D7DDFDD1DC72266ACCEC61B4FF69B5708204D689D55A45B328FA68A7961943B28D4328818116FFA9FBCA8B9A46DB3E5F305C
Malicious:	false
Preview:	PK..........I6................META-INF/....PK..........I66.$.............META-INF/MANIFEST.MF..MK.0......'....+..Z...B..&C:...4E..&]w)..^.yg.....j....}..Y.L.)...;.o.b-.3......k~......./.....r.:d..n..OXi...S....Z\1.[..@!.......Rr...$!....?.oh.P.FI.).[.T,.....m].&\|.Gvc.S......]...!.......h.o....r....4....j...t^.!...%......h...E.%.\|.PK..........I6................org/PK..........I6................org/apache/PK..........I6................org/apache/commons/PK........#.I6................org/apache/commons/lang/PK........$.I6............ ...org/apache/commons/lang/builder/PK........#.I6................org/apache/commons/lang/enum/PK........$.I6................org/apache/commons/lang/enums/PK........$.I6............"...org/apache/commons/lang/exception/PK........#.I6................org/apache/commons/lang/math/PK........#.I6............ ...org/apache/commons/lang/mutable/PK........$.I6................org/apache/commons/lang/text/PK........#.I6................org/apache/commons/lang/time/P

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\commons-net-1.4.0.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	180799
Entropy (8bit):	7.875521799409909
Encrypted:	false
SSDEEP:	3072:fvgP127G3MIEVGnlF7NMmT4nHNg977OYgjwxy91SBoXeyzFd5:Hg47G3Lh447/QcyPzFn
MD5:	B79A2562EABCFB4423ED4F77EE93F88E
SHA1:	EB47E8CAD2DD7F92FD7E77DF1D1529CAE87361F7
SHA-256:	61FC639D7C60D80F523C76867B4D83EBB54A4740E8CA1D9C61216668CEB25988
SHA-512:	BA8AD3963F270B8ADDC0A32E8C92558546883FFEFC66F45268B5E56AA6E74CF27FA0143019D8FC22808CE2AEB5B5C995215FAACF7C0E6E993B67555DE07F8C1E
Malicious:	false
Preview:	PK.........2................META-INF/PK.........2................META-INF/MANIFEST.MF..Ak.1........k..7.....x-C2.a7.%;...7.-...........c}...H3.`FR..N..`/....S.X&.F..._..."I....{.....`k8.L.t6...."u.....K.._FOR.n.T...B6.:t.8.h}.-p....Ll............).*......7H...J..............g........PK....1.........PK..........2................org/PK..........2................org/apache/PK..........2................org/apache/commons/PK..........2................org/apache/commons/net/PK..........2................org/apache/commons/net/bsd/PK..........2................org/apache/commons/net/ftp/PK..........2............"...org/apache/commons/net/ftp/parser/PK..........2................org/apache/commons/net/io/PK..........2................org/apache/commons/net/nntp/PK..........2................org/apache/commons/net/ntp/PK..........2................org/apache/commons/net/pop3/PK..........2................org/apache/commons/net/smtp/PK..........2................org/apache/

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\commons-net-3.5.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	303658
Entropy (8bit):	7.9079053517780356
Encrypted:	false
SSDEEP:	6144:DDVseijt4M4craHwK6HbwS9mqD3h40piw43FmcShW/xGrA+:3At4kDKg463hNML/8rh
MD5:	67CDD14323977FA71A21D9603B3D59B6
SHA1:	342FC284019F590E1308056990FDB24A08F06318
SHA-256:	C25B0DA668B3C5649F002D504DEF22D1B4CB30D206F05428D2FE168FA1A901C2
SHA-512:	EDFF097520A11CC08E04E84FFEF0C20638E525055B09FE63655269D3E55F2524E681663E32FFC5249E0889B3561A3D29EB48F2AF13005D9B63F3F282EEB96A66
Malicious:	false
Preview:	PK...........H................META-INF/PK...........H................META-INF/MANIFEST.MF.V]o.8.}...`.a.jIH.P5..\.[(..V.d.o.;k;..... .R.F+...L..#c....v..TL....g[.M&.v.4..K...K.f4Z...4.\....g.4......H.s../l..VT....F;g.1.j.B3.1.a...3...H.s.^0.....Bg......fT...F;u....#...9..\74.5.i..D.m.K.M]......)\|..0.Ap.\|.5K...z%.:F..T.O...C..4K@...7b..$$R.)e...u....H(#V.9g...Ll...)pM5..L'..}A..K.d.x..9K.......B!..<.....:...n}..v......L.3...Y.4...d...........\.......FW..`.n.......c!...w;'gb..T.y.9....5.).w=.e.....p.q.....+...v{.^.s....X._....l.t0,zS...\ jB....r...C\|h..v...nZx..Z..^..1....V......L......~.'.&.&........C...j...@.O.$.3..\FPc.s.9+...s.a.o\...f.....&._..c.c..s..w....o{...x7V....7P.d...O.H.6.Tn..ax.nR\&.DF..,....... ...f. ......%.(.....PA.1..GI..U.p..c1..?...dR<.c.:.^.Zd6...",....{....7.....t8.....\|.Fr.i.........+W).JB..."'.~.>........Q.{$o......uF.5......q_..d..u......O...u.<..z].P.Ej.D.jOF.{....6..&..k......}..9.O:....z._1O....^F+.].z.4.M.....l._P

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\dooars-t.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	815544
Entropy (8bit):	7.892984118213049
Encrypted:	false
SSDEEP:	12288:sKu2y2XjChIcHOjMteTtwRCPRH3jxqlew+YhRScOwaAhsqD75tkBPuxOtyKNVy+3:tjBKHOXwRAH1yewvm0xse9N49NVyM
MD5:	D9F6295776D41CA2B4D8E7E15472B8CA
SHA1:	0EC558D0F90C77C3F96F1F5073F5CF63BEA31105
SHA-256:	4B960DB1A6404BD0BBF898B72F96BD5716B776268502643B7136DBC72B99DB12
SHA-512:	5AED9B6C1D4262F3C4CFAC0401E16198409B40FA0DE65503FAC7207C8E97A4F257163EE308CD8F83D59BEEBF55BCD78A6E383CFF2C8CF3BF37E96FD367124AF5
Malicious:	false
Preview:	PK.........YRT................META-INF/....PK.........YRT..~T...b.......META-INF/MANIFEST.MF....b.......T........M..LK-...K-*...R0.3..r.C.q,HL.HU...%-A..E..%.).N. ..z..F.F.I.....)..%...y^...\.\.PK.........YRT................dooars/PK.........YRT................dooars/app/PK.........YRT................dooars/applet/PK.........YRT................dooars/applet/infobus/PK.........YRT................dooars/beans/PK.........YRT................dooars/beans/ctrl/PK.........YRT................dooars/beans/furuno/PK.........YRT................dooars/beans/trend/PK.........YRT................dooars/beans/ts/PK.........YRT................dooars/bridge/PK.........YRT................dooars/development/PK.........YRT................dooars/event/PK.........YRT................dooars/event/app/PK.........YRT................dooars/factory/PK.........YRT................dooars/foundation/PK.........YRT................dooars/graphics/PK.........YRT................dooars/net/PK.........YRT................

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-10LR9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	245274
Entropy (8bit):	7.945063255754872
Encrypted:	false
SSDEEP:	6144:gycxE5gCBLmjqT+5salGjHS27rLkL76EA/uHg:FuE5JBLY5flGjy2fIpdA
MD5:	DCDCBB47176603907C9F79A1349193EB
SHA1:	0EECDAC8C86BC84B4BDFC24371BA8C785A1FC552
SHA-256:	069361C71F22F8D7FBD4C3A568C015E2809327FC2E68699AEB63A64178CDE56F
SHA-512:	9363AF7AD6AB1ADD7AED7547A790D7DDFDD1DC72266ACCEC61B4FF69B5708204D689D55A45B328FA68A7961943B28D4328818116FFA9FBCA8B9A46DB3E5F305C
Malicious:	false
Preview:	PK..........I6................META-INF/....PK..........I66.$.............META-INF/MANIFEST.MF..MK.0......'....+..Z...B..&C:...4E..&]w)..^.yg.....j....}..Y.L.)...;.o.b-.3......k~......./.....r.:d..n..OXi...S....Z\1.[..@!.......Rr...$!....?.oh.P.FI.).[.T,.....m].&\|.Gvc.S......]...!.......h.o....r....4....j...t^.!...%......h...E.%.\|.PK..........I6................org/PK..........I6................org/apache/PK..........I6................org/apache/commons/PK........#.I6................org/apache/commons/lang/PK........$.I6............ ...org/apache/commons/lang/builder/PK........#.I6................org/apache/commons/lang/enum/PK........$.I6................org/apache/commons/lang/enums/PK........$.I6............"...org/apache/commons/lang/exception/PK........#.I6................org/apache/commons/lang/math/PK........#.I6............ ...org/apache/commons/lang/mutable/PK........$.I6................org/apache/commons/lang/text/PK........#.I6................org/apache/commons/lang/time/P

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-1445O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11969
Entropy (8bit):	4.486509106233647
Encrypted:	false
SSDEEP:	192:THfTT8UGqxTScKX6Z05qVWGbN231KLvk5LFX8FF/4ae2VxAJGyaK1TPB/zJb1k9P:PAZUNNM1dpKNt0lTcBW0oa7ZkTE2jm
MD5:	77B00E2CC37D39BB47F9FC11C24D1A82
SHA1:	3978B453D806D26B4C4E4AA3AF2421372A05F1FF
SHA-256:	2F2F7C23C936578AC3D402C58C151E83C1451F9B47D4754C467771393E125B92
SHA-512:	24116A8DB4B6190029A7DDB92A5D1146498B10A71764E63141FC0EB59B16C8D84D6DC946D4B513A418D7B5A70BA142AC47BCA6F0FCDDA703A8033358359E0F18
Malicious:	false
Preview:	/.. Apache License.. * Version 2.0, January 2004.. * http://www.apache.org/licenses/.. .. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. .. 1. Definitions... .. "License" shall mean the terms and conditions for use, reproduction,.. * and distribution as defined by Sections 1 through 9 of this document... .. "Licensor" shall mean the copyright owner or entity authorized by.. * the copyright owner that is granting the License... .. "Legal Entity" shall mean the union of the acting entity and all.. * other entities that control, are controlled by, or are under common.. * control with that entity. For the purposes of this definition,.. * "control" means (i) the power, direct or indirect, to cause the.. * direction or management of such entity, whether by contract or.. * otherwise, or (ii) ownership of fifty percent (50%) or

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-7EOVJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	180799
Entropy (8bit):	7.875521799409909
Encrypted:	false
SSDEEP:	3072:fvgP127G3MIEVGnlF7NMmT4nHNg977OYgjwxy91SBoXeyzFd5:Hg47G3Lh447/QcyPzFn
MD5:	B79A2562EABCFB4423ED4F77EE93F88E
SHA1:	EB47E8CAD2DD7F92FD7E77DF1D1529CAE87361F7
SHA-256:	61FC639D7C60D80F523C76867B4D83EBB54A4740E8CA1D9C61216668CEB25988
SHA-512:	BA8AD3963F270B8ADDC0A32E8C92558546883FFEFC66F45268B5E56AA6E74CF27FA0143019D8FC22808CE2AEB5B5C995215FAACF7C0E6E993B67555DE07F8C1E
Malicious:	false
Preview:	PK.........2................META-INF/PK.........2................META-INF/MANIFEST.MF..Ak.1........k..7.....x-C2.a7.%;...7.-...........c}...H3.`FR..N..`/....S.X&.F..._..."I....{.....`k8.L.t6...."u.....K.._FOR.n.T...B6.:t.8.h}.-p....Ll............).*......7H...J..............g........PK....1.........PK..........2................org/PK..........2................org/apache/PK..........2................org/apache/commons/PK..........2................org/apache/commons/net/PK..........2................org/apache/commons/net/bsd/PK..........2................org/apache/commons/net/ftp/PK..........2............"...org/apache/commons/net/ftp/parser/PK..........2................org/apache/commons/net/io/PK..........2................org/apache/commons/net/nntp/PK..........2................org/apache/commons/net/ntp/PK..........2................org/apache/commons/net/pop3/PK..........2................org/apache/commons/net/smtp/PK..........2................org/apache/

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-923QC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	303658
Entropy (8bit):	7.9079053517780356
Encrypted:	false
SSDEEP:	6144:DDVseijt4M4craHwK6HbwS9mqD3h40piw43FmcShW/xGrA+:3At4kDKg463hNML/8rh
MD5:	67CDD14323977FA71A21D9603B3D59B6
SHA1:	342FC284019F590E1308056990FDB24A08F06318
SHA-256:	C25B0DA668B3C5649F002D504DEF22D1B4CB30D206F05428D2FE168FA1A901C2
SHA-512:	EDFF097520A11CC08E04E84FFEF0C20638E525055B09FE63655269D3E55F2524E681663E32FFC5249E0889B3561A3D29EB48F2AF13005D9B63F3F282EEB96A66
Malicious:	false
Preview:	PK...........H................META-INF/PK...........H................META-INF/MANIFEST.MF.V]o.8.}...`.a.jIH.P5..\.[(..V.d.o.;k;..... .R.F+...L..#c....v..TL....g[.M&.v.4..K...K.f4Z...4.\....g.4......H.s../l..VT....F;g.1.j.B3.1.a...3...H.s.^0.....Bg......fT...F;u....#...9..\74.5.i..D.m.K.M]......)\|..0.Ap.\|.5K...z%.:F..T.O...C..4K@...7b..$$R.)e...u....H(#V.9g...Ll...)pM5..L'..}A..K.d.x..9K.......B!..<.....:...n}..v......L.3...Y.4...d...........\.......FW..`.n.......c!...w;'gb..T.y.9....5.).w=.e.....p.q.....+...v{.^.s....X._....l.t0,zS...\ jB....r...C\|h..v...nZx..Z..^..1....V......L......~.'.&.&........C...j...@.O.$.3..\FPc.s.9+...s.a.o\...f.....&._..c.c..s..w....o{...x7V....7P.d...O.H.6.Tn..ax.nR\&.DF..,....... ...f. ......%.(.....PA.1..GI..U.p..c1..?...dR<.c.:.^.Zd6...",....{....7.....t8.....\|.Fr.i.........+W).JB..."'.~.>........Q.{$o......uF.5......q_..d..u......O...u.<..z].P.Ej.D.jOF.{....6..&..k......}..9.O:....z._1O....^F+.].z.4.M.....l._P

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-CG9QK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	815544
Entropy (8bit):	7.892984118213049
Encrypted:	false
SSDEEP:	12288:sKu2y2XjChIcHOjMteTtwRCPRH3jxqlew+YhRScOwaAhsqD75tkBPuxOtyKNVy+3:tjBKHOXwRAH1yewvm0xse9N49NVyM
MD5:	D9F6295776D41CA2B4D8E7E15472B8CA
SHA1:	0EC558D0F90C77C3F96F1F5073F5CF63BEA31105
SHA-256:	4B960DB1A6404BD0BBF898B72F96BD5716B776268502643B7136DBC72B99DB12
SHA-512:	5AED9B6C1D4262F3C4CFAC0401E16198409B40FA0DE65503FAC7207C8E97A4F257163EE308CD8F83D59BEEBF55BCD78A6E383CFF2C8CF3BF37E96FD367124AF5
Malicious:	false
Preview:	PK.........YRT................META-INF/....PK.........YRT..~T...b.......META-INF/MANIFEST.MF....b.......T........M..LK-...K-*...R0.3..r.C.q,HL.HU...%-A..E..%.).N. ..z..F.F.I.....)..%...y^...\.\.PK.........YRT................dooars/PK.........YRT................dooars/app/PK.........YRT................dooars/applet/PK.........YRT................dooars/applet/infobus/PK.........YRT................dooars/beans/PK.........YRT................dooars/beans/ctrl/PK.........YRT................dooars/beans/furuno/PK.........YRT................dooars/beans/trend/PK.........YRT................dooars/beans/ts/PK.........YRT................dooars/bridge/PK.........YRT................dooars/development/PK.........YRT................dooars/event/PK.........YRT................dooars/event/app/PK.........YRT................dooars/factory/PK.........YRT................dooars/foundation/PK.........YRT................dooars/graphics/PK.........YRT................dooars/net/PK.........YRT................

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-D7FLH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1229289
Entropy (8bit):	7.9067088766813605
Encrypted:	false
SSDEEP:	24576:uFHEK3iBVLnK2/pbPpWg5onPfUJ+M5ga4pXtqKsuUrQ:uZt3iLLK2hboLPi5gVxtq3u9
MD5:	DA09B75B562CA9A8E9A535D2148BE8E4
SHA1:	1136D197E2755BBDE296CEEE217EC5FE2917477B
SHA-256:	9B4A8557217FE93C3A274D301E45C3F93CAEB36F89B720A5F42AC34F7D27CD88
SHA-512:	37A13B129F3536A53F2A553151A53997DA6DE7CE4D7231EFEEFD26A68C92BE309666F2EE1F527D3B8C38BC6ADDC9FCCBBDD0D134759FD88667976B0CFF842435
Malicious:	false
Preview:	PK........0..7................META-INF/....PK......../..76.{.d...........META-INF/MANIFEST.MF.Qo.0......q...a.4..I .V.+}5..F...&...9....Nb...9.._...\.1.[.Am..mh..W..;+.......y.FE...D.D.1.Jo........v..[..w+..bM....^.Lin).W.j.<.6(=.y.._...."....E.7."U...mx-j.=..w..j]F...?......ee(s.l.z.k.z<..e....@..k..j...`...6L.....ks..[......a.&..K..w.Mi....x...\Z.'...W.6.0.c..I.8fzqO].+..a.m....s.C......-..i...s:$#.S..%T....b.ZeZ.0...}..V..=.......G.......1..Z.Uv.J'1.E.0......b.Vz.......Y..c..q...vm...cX.:1.c..x.\.0...kg....3..p3.......d.G..c....ye...p.z....PDZ.......U....9..:%..8..;.z....kC..*.k...n5....k._..-....y"..R..../3n.W.. .8..........(;GB%.c..\|..q.Y.C.Ti....k...2^.i...>..PK..........7................META-INF/services/PK........!..7................org/PK........"..7................org/apache/PK...........7................org/apache/html/PK........"..7................org/apache/html/dom/PK........"..7................org/apache/wml/PK........"..7................o

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-FF9AH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3472143
Entropy (8bit):	7.873152172954716
Encrypted:	false
SSDEEP:	98304:rTIlzujdp6DsGVR/jH9vka8ttMw0lyI5v:gJujdDSBdvka+MXv
MD5:	717C657BF38389EC31901542403E71F2
SHA1:	79A1C7FBAE69F76A3C82CAC951A487FA8015AA12
SHA-256:	2586461A684E2502C0926C35A118EB4397D078C60F0ECF570F8EEBC6766A6CED
SHA-512:	C122A3F225B8BB1C3E8B6368EDDFD485C4A312A9A2292CB70D12D71F79DFB8C386A68C4A5564D3A324E4EBB3890B7E2E88BED11A525A7BBD43E1D555AF286FDE
Malicious:	false
Preview:	PK.........ZRT................META-INF/....PK.........ZRT................META-INF/MANIFEST.MF....................u.Ak.0...{ ..=x.CB...DAg...^%....I..C...al.].....zw.kb.......%..S.....c...}..m.-ow.sqP.bG........<.(Y.......\|......(.L.:....oT6.RdLH..QRY..z.O......}."..s(@.....%.T.@..1%.....?..t.l4..Z.)...PK.........YRT................jp/PK.........YRT................jp/co/PK.........YRT................jp/co/furuno/PK.........YRT................jp/co/furuno/vdr/PK.........YRT................jp/co/furuno/vdr/app/PK.........YRT................jp/co/furuno/vdr/conf/PK.........YRT............ ...jp/co/furuno/vdr/conf/component/PK.........YRT................jp/co/furuno/vdr/controller/PK.........YRT............$...jp/co/furuno/vdr/controller/extract/PK.........YRT............(...jp/co/furuno/vdr/controller/maintenance/PK.........YRT................jp/co/furuno/vdr/dataview/PK.........YRT................jp/co/furuno/vdr/debug/PK.........YRT................jp/co/furuno/vdr/decoder/PK..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-HB7UI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1289806
Entropy (8bit):	7.932553095620212
Encrypted:	false
SSDEEP:	24576:4xVcwZd39YnmPKYbJb8At5cXlfzHNENd/wE5:aJ39amPKIJb3+XJzHNA
MD5:	133E8979E9C11450F557CA890177FE0A
SHA1:	9746AF1A485E50CF18DCB232489032A847067066
SHA-256:	92F72307E7440F1E352C916F2438D2BBAB3FFD2CF730C71316117AD04ABADEA8
SHA-512:	24AD0D5BC6B1A283B3E7A8091F674848266FC0EF6D2B23167BAE8C7B7F2FDA687758C6730161A04664A49122C150885E2499D7BC2AC0E435CE23425EC59CE208
Malicious:	false
Preview:	PK.........9.5................META-INF/....PK.........9.5.R..............META-INF/MANIFEST.MF..N.0.......T$...u.Q+u(K.+:%....-.............w..@.....C..6jeJ).L..;.q6..)...c..?..3.k.....\T...j7..c.U{j..F..X.u.1n..o..N......I@.).`.L..)2)FRH..`..)M..j..G...l......%.`.<........:>C@.s'j3.b?...$.u.......U..u)..PK.........9.5................org/PK.........9.5................org/apache/PK.........9.5................org/apache/tools/PK.........9.5................org/apache/tools/ant/PK.........9.5................org/apache/tools/ant/dispatch/PK.........9.5................org/apache/tools/ant/filters/PK.........9.5............"...org/apache/tools/ant/filters/util/PK.........9.5................org/apache/tools/ant/helper/PK.........9.5................org/apache/tools/ant/input/PK.........9.5................org/apache/tools/ant/launch/PK.........9.5................org/apache/tools/ant/listener/PK.........9.5................org/apache/tools/ant/loader/PK.........9.5................org/apache/

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-KDNOP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	194354
Entropy (8bit):	7.6968628231831735
Encrypted:	false
SSDEEP:	3072:tKHSI8s531xQp5tk6k15FFGFVLG2TLp5ayAVuTuc6cqQMUGyLfm3p/V:4Hd8831+NJkcf/poXV1Gf0/V
MD5:	9AE9C29E4497FC35A3EADE1E6DD0BBEB
SHA1:	90B215F48FE42776C8C7F6E3509EC54E84FD65EF
SHA-256:	D404AA881EB9C5F7A4FB546E84EA11506CD417A72B5972E88EFF17F43F9F8A64
SHA-512:	1086A52924ADD2406E0B4EC7219A8783AC20E02A32A7A2461EFBF092F0070501F7CADE9C0588907C403352F1A48F80B950E6D40B2E4E3E9EB886E7DB4E97BDEC
Malicious:	false
Preview:	PK........2.s5................META-INF/....PK........1.s5#..S,...........META-INF/MANIFEST.MF.UM..0..#...V...B..n,..+.]m.W...UbG...........h#q..7o.L\......D.....#.fc..N.1.W...\....H"..t....'w.<.0.2..jS.n6..o4....thF.l...Q$.r.v.e.....F.(....(9.a!$.....-%9.....y,......Da.1...-U6@.;.a...w'..'E...I..;.<.rg.'.zM%.W.. ....x..D.^.{e@......s.)........?..cvB.>O2.Wwz.,e.i..pq.d\Ym.........=.o_..l`..gT....t...zm[..d......N ...=.~by.in....Ch...6L15.}....jgB...X.0....R.$..".x..7..Q\|.?...i~..mk}3.+"...Mah........ABU.D.hj...?1..Lp.P....u.?..y...Y...b\|i...k..m.....P[.1R0.>..!...Bs....T..\......\j..Nt..Ii.r.[Jf.....6..1.R0......^.R&......PK........0.s5................javax/PK........1.s5................javax/xml/PK........0.s5................javax/xml/datatype/PK........0.s5................javax/xml/namespace/PK........0.s5................javax/xml/parsers/PK........0.s5................javax/xml/transform/PK........0.s5................javax/xml/transform/dom/PK........0.s5..........

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-KSUV4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	914597
Entropy (8bit):	7.990703942256781
Encrypted:	true
SSDEEP:	24576:QmOyBLsRQ/6DU0VO1tT977DS1QErj1t/V:QmOyB4CqUn1tT97vSaEn1t/V
MD5:	B0E08C9936DC52AA40439C71FCAD6297
SHA1:	1C12D070E602EFD8021891CDD7FD18BC129372D4
SHA-256:	1AA37E9EA6BAA0EE152D89509F758F0847EAC66EC179B955CAFE0919E540A92E
SHA-512:	EA1B400CF25C6032160553F19BAEDB21103341F1C4236FBECF5F8462CC4DB06F3459D7812ED0AD07A0B9FAA3B576F8FA6EDBD9ED64F9486B85E5BF982C21775E
Malicious:	false
Preview:	PK.........@fD................META-INF/....PK.........@fD...............META-INF/MANIFEST.MF..As.0......1...!.M`8...B3%.kG.D.-...._..el7=...>....?...'P.K1&.Q..f..2.({..k..&...\..!.o.F.9........\\|S.%@.ReR...?..r......0.Fz+.7A...v.{_.,..Dn..G.'.(.$O b...~5#w..Df.%y..6..F..6G.6C....g.-.....1.Z....L.}].....nE.@8..^.....?...8....V4.#..;.L.,.Bc.+.(..G...nd.YQ.dY.X.....+..{`[._..WR..q..z.^F...+.R4c.....x........8%y.@.O.........y...U5.s`s.#. z(.ge..z.O<.:.9{..$..LIs.RM..G.G...&5.%A3%...@.)D]..........)......Jm.K..J...B.vwj......Z..9EPNs.4,W....SXV.1...!.m...nj<.H.>..1.Xo.JB.;.+.&D=..9.e1.'.b[7..W.-..9.#..G.f...L.9...r&..s.(.4.g}.Zi. .9m...........;..FT#9.g...1......DU...,...`C\gD.....Da.....e.{i...OwX......S._.:......)eR.'...)....8~a\|./PK.........@fD................com/PK.........@fD................com/sun/PK.........@fD................com/sun/jna/PK.........@fD................com/sun/jna/ptr/PK.........@fD................com/sun/jna/win32/PK.........@fD.Y..m..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-MF5B9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	571259
Entropy (8bit):	7.871042230671787
Encrypted:	false
SSDEEP:	12288:0pyvVrrCHWWD0K+8CfLWCsIyx98TNrxraIPRWR5gvjdGJ6g:0IV33WDT+8eLUn8prfoRn6g
MD5:	7B9216B608D550787BDF43A63D88BF3B
SHA1:	F951934AA5AE5A88D7E6DFAA6D32307D834A88BE
SHA-256:	093FEA360752DE55AFCB80CF713403EB1A66CB7DC0D529955B6F4A96F975DF5C
SHA-512:	4C3361C8CF553C6FC34FE10624985BC1A08EA84547F4FB970487E99DC795A67B4BD36A0A1015492019E36DC1AE8B36DEF98F3ED3BF3E8382057923DDF67EE5EF
Malicious:	false
Preview:	PK...........4................META-INF/PK...........4..9.............META-INF/MANIFEST.MF..AK.0...............UV...Mb:..dR....o.....!..o..$..B.w..v.f.XP......z..zI........g.._....f'.l..w.."...T.[....k.. .q.P.Z.!Uc@....\.F...7.&....3.#(.k%..k.U.m.a....Z....]....e...h.w..M..6v4`..o.....Y._.<.7]...........+.W........~.XH...PK...........4.._I{...(-......META-INF/LICENSE.txt.Zmo....^ .aK....e'M....Xr...I.......#.>.2.w.._.gf_..e..V!h.....<...}.;....J.......P.i...^T.o.....^......}...n...\|....?.=..w......;q....n.W.....N......+q{......+z\.[W.......I....q.Z........?.p..pk.ub.d/..xPv...Q....Dk.....U[k....U.^n...^...!.h.T..^....%..f\....E.=S......{$[m.{.W.A.]...TX.....6V..O...Z2.. p..J..W.R..D.........{.%_A.Y.>Q.....}...Bj.....`MW.iU..c.+..=....j..>n...;=..F.....X.d;...d.&.'[..63...g..5;e+...Z$....+1.QKX..........^..Y.Nvc...Ub.V.....,y.vv....i..Vrk...Z.B.[ek.....8...T.v..7@.d......K.C...A'.......3q.../;;/...H1...i7+J?.;.GH.....7.9v.v9..l..^w..k.$.m

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-P7FO5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	358180
Entropy (8bit):	7.909141156954573
Encrypted:	false
SSDEEP:	6144:+ZyWLQScRA6Q9IRnJ3efO7+7SRsLw4ZJM/fqzOSPzPkt0aZMj40tsrOHX:+AjSi12IRnxTiXw4ZmKLzvaZMLsrA
MD5:	52169B4A318E3246483F39F62B84B948
SHA1:	8B1B85D04EEA979C33109EA42808B7D3F6D355AB
SHA-256:	C8ED615889A62D7957C4EA44B0D1D290B9F308C88EDABAC325526957259D7F14
SHA-512:	3FB663E1507E87680001AE678ED46D58CB4386BAD363C3F07FF941A636DA8599C4D4C9F9EB8E0128140A5D692DBAEAA31BF863E8C4A406ED9232B3A69090BE4B
Malicious:	false
Preview:	PK...........3................META-INF/....PK...........3................META-INF/MANIFEST.MFm....0.E.&...I......&&..`\M.....%......].9y.T\....o`..'....j..#o.@..aFS.N...6<..PvgY..3..'E..mg.@ZR...1...%.D.>..h.}..0*.8......p..W..7...?\...$.6.son..........PK...........3................org/PK...........3................org/apache/PK...........3................org/apache/log4j/PK...........3`..hL...........org/apache/log4j/Appender.class}.9O.@..gs9..8.....%..........DA.......F...G!..1W...O......7.q...=.....W....p..)-m.r.Q....;.=;}...\.8.......j./.N?#.\|?.(:...C.U.a(...dE.HI..r8.Al.-...O4.E..>...i.cM:JlF".j..5.\?..U.?U.)....Z..,.B.#...1CoI\..._&....ki.([.._.4.jh.<...2C....:VS..j.f.i.B.%.....L...N.}..'.10.Z..Q..E..-..+sV.fXC...a....4.B.p.;...P....9t?.PK...........3.? .........'...org/apache/log4j/AppenderSkeleton.class.V[p.U...M.i...P.r. X..xA..h.r.B.R.@.mr.l...P.......v...f.00.#.......A_.q....l..4."...9.._...\|....P...8...P.b.u.h.r.$....e..Y.T.8.1.......!...8.3

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-RB1LO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	484
Entropy (8bit):	4.794696349914124
Encrypted:	false
SSDEEP:	6:nTlpAiyjDYKGvlzYNs7LUoyJFoneDrCuj8rNJau4vG/dAi+MFLQkKpLKBM7eVNu6:nRbywfkkBzo+r/dA0skKpMM7oFAcC+
MD5:	E349FB3DD18116706D457C3DAA33175E
SHA1:	BC5EE41378733CED531BA99C93D13E0F8D5C6640
SHA-256:	12226C3D9B053C2FE8CA992CA4EA069567037DF7FDF923B1CFC2E628CE7A4F7B
SHA-512:	D8165D0453997E55DAF72BF0FD94E7FDF5E9EC493163C39F54947A7E6E0E50BA4C27A975B7C6AC9DA2008A185FB9973B214E41C01266A72904093CDD785AEA17
Malicious:	false
Preview:	#..# Drivers loaded by the Java Communications API standard extension..# at initialization time..#..# Format:..#.Each line must contain ONE driver definition only..#.Each line must be of the form:..#...driver=<ClassName>..#..No spaces or tabs in the line...#..ClassName must implement the interface javax.comm.CommDriver..#...example: driver=Win32Serial..#...#..# The hash(#) character indicates comment till end of line...#..# Windows Serial Driver..Driver=com.sun.comm.Win32Driver..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\is-S7F6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	28043
Entropy (8bit):	7.820842155394776
Encrypted:	false
SSDEEP:	768:M7BE7rv/R41VxQNTq1PSCSW1hJgtuTMc/Sx2y3:0EfZGaTeSCSAJgwTz/k
MD5:	67F04ECDDB9171962A222308ADDB5C84
SHA1:	E1CFFE12249CA60D0A6AB6772C632DF9942AB417
SHA-256:	17E856646323B55F4C1103E75290BEE9433C3BD24EFFD8E6995BC1D64FFF092F
SHA-512:	636AFECEA9C90285BE564A88F3AF4D60F1D9586B6B0E538DC48EFE03E766F881F28233B878CC0851C79E1AC8773D0299CD2A7A303E41C54BB5D18E4686025546
Malicious:	false
Preview:	PK.........o%................META-INF/MANIFEST.MF....X...{%.?.....VI.dG.D.....P6Y..~.....[.b<<.O...=./.#h./6...,...............+..y....U.~?.W..M......,..M....Vo......}.v...5uU^..l..1.\.<9;RN....r;..d.m].S....e..I..S...]....=.B...-n..a.+#$..J7..j.....t....(...El.....MWU7..>hz.j...._CP.....'mwl..S...).h..........(a..C.#..@..=.?...(.....aYF....%..L.W=.ej.I.d.Dz..,3...=...d.%...H.\|\f.@..6....Z...Q.X.p.9..`lR...-..p...!...d.P.?I+...f%5.m....U.4......\|.$.xf./..6.v..v&Ci1.K.7is....M=i....X...qhh42.P....d..CbzG...a..<.n%....8....b.qU+..Y...-.}....0...nX..we&.y....V.].\|....(.D.T...*T...h..'.Y.h\._.....$.6Y..X(.[c..X....;N.`]f...../..H...'..L.p.`.j6U...i{~.............M.......p.d4X..ze..Qg....G`T44....~...L.G.....KJ{7....t....\|^....\|M.E.....<fPYN.:..g[....dO.K...?..P.j....^..,....T"R ...n{$...F.^..k..^O.V..ZY..-.Gc...n.).c..<.......&g0.m.rqk....>....5]....>../d!..mb.n.K.g.Dm.A..m0....z/9...\-).#"...k.O..ITT...&.....%..F.S&..8...W...?...]...k

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\javax.comm.properties (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	484
Entropy (8bit):	4.794696349914124
Encrypted:	false
SSDEEP:	6:nTlpAiyjDYKGvlzYNs7LUoyJFoneDrCuj8rNJau4vG/dAi+MFLQkKpLKBM7eVNu6:nRbywfkkBzo+r/dA0skKpMM7oFAcC+
MD5:	E349FB3DD18116706D457C3DAA33175E
SHA1:	BC5EE41378733CED531BA99C93D13E0F8D5C6640
SHA-256:	12226C3D9B053C2FE8CA992CA4EA069567037DF7FDF923B1CFC2E628CE7A4F7B
SHA-512:	D8165D0453997E55DAF72BF0FD94E7FDF5E9EC493163C39F54947A7E6E0E50BA4C27A975B7C6AC9DA2008A185FB9973B214E41C01266A72904093CDD785AEA17
Malicious:	false
Preview:	#..# Drivers loaded by the Java Communications API standard extension..# at initialization time..#..# Format:..#.Each line must contain ONE driver definition only..#.Each line must be of the form:..#...driver=<ClassName>..#..No spaces or tabs in the line...#..ClassName must implement the interface javax.comm.CommDriver..#...example: driver=Win32Serial..#...#..# The hash(#) character indicates comment till end of line...#..# Windows Serial Driver..Driver=com.sun.comm.Win32Driver..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\jna.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	914597
Entropy (8bit):	7.990703942256781
Encrypted:	true
SSDEEP:	24576:QmOyBLsRQ/6DU0VO1tT977DS1QErj1t/V:QmOyB4CqUn1tT97vSaEn1t/V
MD5:	B0E08C9936DC52AA40439C71FCAD6297
SHA1:	1C12D070E602EFD8021891CDD7FD18BC129372D4
SHA-256:	1AA37E9EA6BAA0EE152D89509F758F0847EAC66EC179B955CAFE0919E540A92E
SHA-512:	EA1B400CF25C6032160553F19BAEDB21103341F1C4236FBECF5F8462CC4DB06F3459D7812ED0AD07A0B9FAA3B576F8FA6EDBD9ED64F9486B85E5BF982C21775E
Malicious:	false
Preview:	PK.........@fD................META-INF/....PK.........@fD...............META-INF/MANIFEST.MF..As.0......1...!.M`8...B3%.kG.D.-...._..el7=...>....?...'P.K1&.Q..f..2.({..k..&...\..!.o.F.9........\\|S.%@.ReR...?..r......0.Fz+.7A...v.{_.,..Dn..G.'.(.$O b...~5#w..Df.%y..6..F..6G.6C....g.-.....1.Z....L.}].....nE.@8..^.....?...8....V4.#..;.L.,.Bc.+.(..G...nd.YQ.dY.X.....+..{`[._..WR..q..z.^F...+.R4c.....x........8%y.@.O.........y...U5.s`s.#. z(.ge..z.O<.:.9{..$..LIs.RM..G.G...&5.%A3%...@.)D]..........)......Jm.K..J...B.vwj......Z..9EPNs.4,W....SXV.1...!.m...nj<.H.>..1.Xo.JB.;.+.&D=..9.e1.'.b[7..W.-..9.#..G.f...L.9...r&..s.(.4.g}.Zi. .9m...........;..FT#9.g...1......DU...,...`C\gD.....Da.....e.{i...OwX......S._.:......)eR.'...)....8~a\|./PK.........@fD................com/PK.........@fD................com/sun/PK.........@fD................com/sun/jna/PK.........@fD................com/sun/jna/ptr/PK.........@fD................com/sun/jna/win32/PK.........@fD.Y..m..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\log4j-1.2.13.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	358180
Entropy (8bit):	7.909141156954573
Encrypted:	false
SSDEEP:	6144:+ZyWLQScRA6Q9IRnJ3efO7+7SRsLw4ZJM/fqzOSPzPkt0aZMj40tsrOHX:+AjSi12IRnxTiXw4ZmKLzvaZMLsrA
MD5:	52169B4A318E3246483F39F62B84B948
SHA1:	8B1B85D04EEA979C33109EA42808B7D3F6D355AB
SHA-256:	C8ED615889A62D7957C4EA44B0D1D290B9F308C88EDABAC325526957259D7F14
SHA-512:	3FB663E1507E87680001AE678ED46D58CB4386BAD363C3F07FF941A636DA8599C4D4C9F9EB8E0128140A5D692DBAEAA31BF863E8C4A406ED9232B3A69090BE4B
Malicious:	false
Preview:	PK...........3................META-INF/....PK...........3................META-INF/MANIFEST.MFm....0.E.&...I......&&..`\M.....%......].9y.T\....o`..'....j..#o.@..aFS.N...6<..PvgY..3..'E..mg.@ZR...1...%.D.>..h.}..0*.8......p..W..7...?\...$.6.son..........PK...........3................org/PK...........3................org/apache/PK...........3................org/apache/log4j/PK...........3`..hL...........org/apache/log4j/Appender.class}.9O.@..gs9..8.....%..........DA.......F...G!..1W...O......7.q...=.....W....p..)-m.r.Q....;.=;}...\.8.......j./.N?#.\|?.(:...C.U.a(...dE.HI..r8.Al.-...O4.E..>...i.cM:JlF".j..5.\?..U.?U.)....Z..,.B.#...1CoI\..._&....ki.([.._.4.jh.<...2C....:VS..j.f.i.B.%.....L...N.}..'.10.Z..Q..E..-..+sV.fXC...a....4.B.p.;...P....9t?.PK...........3.? .........'...org/apache/log4j/AppenderSkeleton.class.V[p.U...M.i...P.r. X..xA..h.r.B.R.@.mr.l...P.......v...f.00.#.......A_.q....l..4."...9.._...\|....P...8...P.b.u.h.r.$....e..Y.T.8.1.......!...8.3

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\vdr-client.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3472143
Entropy (8bit):	7.873152172954716
Encrypted:	false
SSDEEP:	98304:rTIlzujdp6DsGVR/jH9vka8ttMw0lyI5v:gJujdDSBdvka+MXv
MD5:	717C657BF38389EC31901542403E71F2
SHA1:	79A1C7FBAE69F76A3C82CAC951A487FA8015AA12
SHA-256:	2586461A684E2502C0926C35A118EB4397D078C60F0ECF570F8EEBC6766A6CED
SHA-512:	C122A3F225B8BB1C3E8B6368EDDFD485C4A312A9A2292CB70D12D71F79DFB8C386A68C4A5564D3A324E4EBB3890B7E2E88BED11A525A7BBD43E1D555AF286FDE
Malicious:	false
Preview:	PK.........ZRT................META-INF/....PK.........ZRT................META-INF/MANIFEST.MF....................u.Ak.0...{ ..=x.CB...DAg...^%....I..C...al.].....zw.kb.......%..S.....c...}..m.-ow.sqP.bG........<.(Y.......\|......(.L.:....oT6.RdLH..QRY..z.O......}."..s(@.....%.T.@..1%.....?..t.l4..Z.)...PK.........YRT................jp/PK.........YRT................jp/co/PK.........YRT................jp/co/furuno/PK.........YRT................jp/co/furuno/vdr/PK.........YRT................jp/co/furuno/vdr/app/PK.........YRT................jp/co/furuno/vdr/conf/PK.........YRT............ ...jp/co/furuno/vdr/conf/component/PK.........YRT................jp/co/furuno/vdr/controller/PK.........YRT............$...jp/co/furuno/vdr/controller/extract/PK.........YRT............(...jp/co/furuno/vdr/controller/maintenance/PK.........YRT................jp/co/furuno/vdr/dataview/PK.........YRT................jp/co/furuno/vdr/debug/PK.........YRT................jp/co/furuno/vdr/decoder/PK..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\xercesImpl.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1229289
Entropy (8bit):	7.9067088766813605
Encrypted:	false
SSDEEP:	24576:uFHEK3iBVLnK2/pbPpWg5onPfUJ+M5ga4pXtqKsuUrQ:uZt3iLLK2hboLPi5gVxtq3u9
MD5:	DA09B75B562CA9A8E9A535D2148BE8E4
SHA1:	1136D197E2755BBDE296CEEE217EC5FE2917477B
SHA-256:	9B4A8557217FE93C3A274D301E45C3F93CAEB36F89B720A5F42AC34F7D27CD88
SHA-512:	37A13B129F3536A53F2A553151A53997DA6DE7CE4D7231EFEEFD26A68C92BE309666F2EE1F527D3B8C38BC6ADDC9FCCBBDD0D134759FD88667976B0CFF842435
Malicious:	false
Preview:	PK........0..7................META-INF/....PK......../..76.{.d...........META-INF/MANIFEST.MF.Qo.0......q...a.4..I .V.+}5..F...&...9....Nb...9.._...\.1.[.Am..mh..W..;+.......y.FE...D.D.1.Jo........v..[..w+..bM....^.Lin).W.j.<.6(=.y.._...."....E.7."U...mx-j.=..w..j]F...?......ee(s.l.z.k.z<..e....@..k..j...`...6L.....ks..[......a.&..K..w.Mi....x...\Z.'...W.6.0.c..I.8fzqO].+..a.m....s.C......-..i...s:$#.S..%T....b.ZeZ.0...}..V..=.......G.......1..Z.Uv.J'1.E.0......b.Vz.......Y..c..q...vm...cX.:1.c..x.\.0...kg....3..p3.......d.G..c....ye...p.z....PDZ.......U....9..:%..8..;.z....kC..*.k...n5....k._..-....y"..R..../3n.W.. .8..........(;GB%.c..\|..q.Y.C.Ti....k...2^.i...>..PK..........7................META-INF/services/PK........!..7................org/PK........"..7................org/apache/PK...........7................org/apache/html/PK........"..7................org/apache/html/dom/PK........"..7................org/apache/wml/PK........"..7................o

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\lib\xml-apis.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	194354
Entropy (8bit):	7.6968628231831735
Encrypted:	false
SSDEEP:	3072:tKHSI8s531xQp5tk6k15FFGFVLG2TLp5ayAVuTuc6cqQMUGyLfm3p/V:4Hd8831+NJkcf/poXV1Gf0/V
MD5:	9AE9C29E4497FC35A3EADE1E6DD0BBEB
SHA1:	90B215F48FE42776C8C7F6E3509EC54E84FD65EF
SHA-256:	D404AA881EB9C5F7A4FB546E84EA11506CD417A72B5972E88EFF17F43F9F8A64
SHA-512:	1086A52924ADD2406E0B4EC7219A8783AC20E02A32A7A2461EFBF092F0070501F7CADE9C0588907C403352F1A48F80B950E6D40B2E4E3E9EB886E7DB4E97BDEC
Malicious:	false
Preview:	PK........2.s5................META-INF/....PK........1.s5#..S,...........META-INF/MANIFEST.MF.UM..0..#...V...B..n,..+.]m.W...UbG...........h#q..7o.L\......D.....#.fc..N.1.W...\....H"..t....'w.<.0.2..jS.n6..o4....thF.l...Q$.r.v.e.....F.(....(9.a!$.....-%9.....y,......Da.1...-U6@.;.a...w'..'E...I..;.<.rg.'.zM%.W.. ....x..D.^.{e@......s.)........?..cvB.>O2.Wwz.,e.i..pq.d\Ym.........=.o_..l`..gT....t...zm[..d......N ...=.~by.in....Ch...6L15.}....jgB...X.0....R.$..".x..7..Q\|.?...i~..mk}3.+"...Mah........ABU.D.hj...?1..Lp.P....u.?..y...Y...b\|i...k..m.....P[.1R0.>..!...Bs....T..\......\j..Nt..Ii.r.[Jf.....6..1.R0......^.R&......PK........0.s5................javax/PK........1.s5................javax/xml/PK........0.s5................javax/xml/datatype/PK........0.s5................javax/xml/namespace/PK........0.s5................javax/xml/parsers/PK........0.s5................javax/xml/transform/PK........0.s5................javax/xml/transform/dom/PK........0.s5..........

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\liveplayer.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	35328
Entropy (8bit):	7.132664117578073
Encrypted:	false
SSDEEP:	768:/2L5jeeD7Jtyvf9/ODY9ea6cI96G9akwq7hKHC5WEL7DbkPdryF:/2Nje8nKfMMBhY8qICWEId+F
MD5:	7235E09CBCB89FA040C2462E3A1C7078
SHA1:	8A1BE555C5B378C5A5102FE00E992786923451A8
SHA-256:	AEFF758C8FF69AB7811EE337854205EB8A7A9735AE0F485198EE9E81915C545D
SHA-512:	9D33F9CED3FDBAE3E20BB57470BE608720B4133AE015C8B07EED54C11612CBB5254DCDF04960FE41B0DE92A80857CA7E1283E8C625AED90B7193AC448C4EAF40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22% Antivirus: Virustotal, Detection: 34%, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L......M...............2.....F....................@..........................@................... .............................. .......\+..............................................................................H............................MPRESS1.........N.......................MPRESS2.............P...................rsrc...\+.......,...^..............@..............................................................................v2.17...M.....43..C.c....j.&.....9.>R.....Q.RhN}=g..}..1^-...f.IR..F...rQ.,......f..._?.....O;.YW....'g.I#..+.,&....I........4w;,.I..~)L...$.....{.?l8...R/..>...3.p....P..V4....L$<..GV.._:........8y..p..L.....X.+.xsp.....V)...3..if.......[..hz@B...T..6...PJ:..Wy..9..h......e..a..7..y.wc....[...D..IO.v.~2..\\|.....\|Z.H..-ng0]We.....\.w..k.QRLj.:y...I.o...7....sq.x1#N..8G...x...-.*.s$#.2Gw.%.o....a....p...y.&.....f..lpt....s.S.u..g.aP.......p...G.]%...2...?.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4811
Entropy (8bit):	5.101209286895512
Encrypted:	false
SSDEEP:	96:3nPoQMRQzWwmlMGXP37e4iqZ/P1qVqC8KqyqRkuJ4bjJ79:VMYU/3a4ia3k8RkuWXJR
MD5:	CE0E47D3300F3A350E7D61BB5DBB9DEE
SHA1:	BE3266904F001F50A57E23C93D4DD0F09BC1F04C
SHA-256:	C1140DA81AA4A0A81AAC118B084AEFDBF0932AA224780BA9683055EBAB4358B7
SHA-512:	C2B38C666CAB95D453F7B4C6FAF4830E99405BA72901B6D7DAB4D96E78BEDC8B4D64262AD480E56AD66E7142505400CF63B58A097A0592C778B426B5F747D8C1
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..CALL vmv-env.bat....REM display splash screen..start /b splash.bat....setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="VDR Maintenance Viewer V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)....REM ############################################################..REM Environment Check & Replacement..REM ##

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	7.692998803999232
Encrypted:	false
SSDEEP:	768:/dL5jeeDoqEZ74Xug7UnZxfHrQQNF7Dq:/dNjeD74b0Zx8Q
MD5:	19BB07DFB40E27A42BA2E3EBF3ABC1B3
SHA1:	638A6C12D290F102E11C8B289033CA5ACFE37500
SHA-256:	1148416F2B78FB9261C314DE1A0BDE9191F0F04A35576D30D71C1DB1CBB08B4D
SHA-512:	43BEEED736345D42F60B505C10535312144E86941222858E3145CB0C78F287D03AE6295FC06FAAC099510575F74B0353335FF3C22D683680B1461F35C354F205
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26% Antivirus: Virustotal, Detection: 34%, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L......M...............2.....$....................@.............................................. .............................. .......................................................................................H............................MPRESS1.........N.......................MPRESS2.............P...................rsrc................^..............@..............................................................................v2.17...M.....43..C.c....j.&.....9.>R.....Q.RhN}=g..}..1^-...f.IR..F...rQ.,......f..._?.....O;.YW....'g.I#..+.,&....I........4w;,.I..~)L...$.....{.?l8...R/..>...3.p....P..V4....L$<..GV.._:........8y..p..L.....X.+.xsp.....V)...3..if.......[..hz@B...T..6...PJ:..Wy..9..h......e..a..7..y.wc....[...D..IO.v.~2..\\|.....\|Z.H..-ng0]We.....\.w..k.QRLj.:y...I.o...7....sq.x1#N..8G...x...-.*.s$#.2Gw.%.o....a....p...y.&.....f..lpt....s.S.u..g.aP.......p...G.]%...2...?.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\msend.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	385024
Entropy (8bit):	6.511547612155607
Encrypted:	false
SSDEEP:	6144:Q/SyaDgv0IFu2fVkcUjPfa/fCiDtE1p8Dv9X:uSFebXfVkcD3zyYDvV
MD5:	FCCDFB2D9A2CD700B1E2C0D7814E97BE
SHA1:	0465B089A6898AC6B86125E32DF6368A5ACFF7F8
SHA-256:	34D5C7451F47D57ED1ED7E85A29DC3C94847D87A60472461048443140B405985
SHA-512:	0025C4D5E35B4E9E206EB13CFA820E37CC4A984F4F6278051D4F042781162A42623A13812BE01DC432A426D9CFC0E838F2A35DCA74631DEE7BA8CD5F74F8AA8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B]..]..]...5..Q..z7..B..z7.....].........Z..z7.....z7..\..Rich]..........................PE..L......b.............................W............@..........................P......\|M.........................................P....@..............................p..................................@............................................text...S........................... ..`.rdata..............................@..@.data............ ..................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\replacementEnvironment.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3650
Entropy (8bit):	4.637588880744435
Encrypted:	false
SSDEEP:	48:k8w6SFSS6SBk2Ki+lazlS94uxzqy5R/QenRbqElAoSEXaajTXK8KMKdD:/QiU9x+lWRuxzPRYeRGotZXfTqD
MD5:	5E0A36C001C6E7713E2B68A7232000B2
SHA1:	1676241A91D7C77DD1CF9EEEBC4B2A3EF9163E0C
SHA-256:	823B40B213152A255F01E5BCA31B115EAC494DCC72EE0F5514AF417A43AC5EDD
SHA-512:	B9A8E9BA9BC07A07A35F025EC73C434727B72C769CAEF29C3AB7567904905CBC5EA5D333E988344C6DEF26C077F6D9315CEC6990720ECFA06485657AB3297BB1
Malicious:	false
Preview:	@ECHO OFF..echo ======================================================================..echo %0 %1 %2..echo ======================================================================..REM ----------------------------------------------------------------------..REM set destination version..REM ----------------------------------------------------------------------..if "%~2" == "previous" (.. set DEST_ENV=previous..) else (.. set DEST_ENV=latest..)..echo start-up [%DEST_ENV%]....setlocal ENABLEDELAYEDEXPANSION..REM ----------------------------------------------------------------------..REM check running application version..REM ----------------------------------------------------------------------..cscript versionCheck.vbs....REM errorlevel 0: none, 1:previous, 2:latest..if %errorlevel% == 1 (.. if %DEST_ENV% == latest (.. echo ** running [previous].. .. REM display MessageBox.. echo msgbox "Previous versio

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\replacementExclude.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	3.9275753732673406
Encrypted:	false
SSDEEP:	3:5KOAoApMA/0IiTLD5NZV:cOUMDtTLdjV
MD5:	7504F021590A476273ECB3D5493B91AE
SHA1:	CCFFA2FED7EB43D197C50BD110AAEE1BCEFAA389
SHA-256:	C9E1484D045E5A17562A7E5859914F12D2AB4BC44D7CECAF1DD903654F6F5AE2
SHA-512:	622C5CFA37A3DED6C5012092AB9F28AE3A4A7F72CE71F8CC721B2F14B45220C385DAA9833F0E01B9012645583872471BBFB29D9A38D8D31944B4DA52BD6A68EB
Malicious:	false
Preview:	maintenance.bat..vdrviewer.bat..vmv-env.bat..vv-env.bat..env.bat..splash.bat..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\setupFirewall.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	5.065986743610286
Encrypted:	false
SSDEEP:	48:SY2dceWTMmzbJjQy7w4YFigqfpIcfNQIneySX8USo6cvReFIMFiCncy6yQjIX1Kq:8ubJjQOw4OigeBNxPqOiCnlWG1KP2jD
MD5:	78423506D10EB0261B7A9F3FFC6E437C
SHA1:	99619C0E9C41EEB8E2349D067DCE14BA26AF4CB9
SHA-256:	3ECC4732A7046EA3604834F68B39E76AC256674B95F32BC562552AEAA21806F1
SHA-512:	BA065788ACF0F813317D90EAD9D84E6B4295A9911D9444066CAB98DDB86593BD7509F541D05C069CADED4B4E7B38EB30E2014877597A0FB7150342839BB4F8EF
Malicious:	false
Preview:	@echo off..REM ====================================================================..REM File Name : Live Player V5 (VR-7000/S) Set Firewall..REM Create : 2016/02/16..REM Update :..REM ====================================================================..setlocal enableextensions enabledelayedexpansion....REM ---------------------------------------------------------------------..REM Set Environment..REM ---------------------------------------------------------------------..call env.bat....REM Delete Double Quotation..set JAVA_EXE=%JAVA_EXE:"=%....REM echo on....set SETUP_FIREWALL_LOG=%CD%\log\setupFirewall.log....REM ---------------------------------------------------------------------..REM MAIN..REM ---------------------------------------------------------------------....cd ..\.....REM Delete Old Log..del /q /f "%SETUP_FIREWALL_LOG%"....REM Windows XP.H..call :IS_WINDOWS_XP..set IsWindowsXP=%errorlevel%....REM [TEST] notepad.exe..REM call :SET_FIREWALL_RULE "VDR L

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\speedtest.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	634880
Entropy (8bit):	5.830287591283141
Encrypted:	false
SSDEEP:	6144:JsSrVaADBmG9ksHN7IAuqfDD5UB/mcSD/bea+J04T9Tc6YL2GymlBKzdFv+zQ:JsHADvkkN7IXqvi/YbbeauBZcX8kWdZ
MD5:	935AB82B8DD966A4CA9ABB62DE6CF869
SHA1:	1807B34685A2886DFA02868F02C6F5EEBA2BD7E0
SHA-256:	A31D98CA993D7F41B2A0609DF5F941B05B1F443E7D596ED317EC16383FD910DC
SHA-512:	0879DDB17A3A3AFAA265F6961A1B03D6BB3FDDC8B4B8B1C7A924E00C55C6842D87B86246105AE8448C71E884208729374CB60E9C63858F64621ACA15F882B9FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.n;g..hg..hg..h.S~hn..h@Q}hF..h..]hn..h@Q{he..hg..h...h@Qmh...h@Qnh...h@Q\|hf..h@Qxhf..hRichg..h........PE..L......b.....................`......c.............@.............................................................................x.......................................................................................x............................textbss.................................text...5........................... ..`.rdata..............................@..@.data...0,..........................@....idata..W........ ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\splash.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	5.631556032915055
Encrypted:	false
SSDEEP:	6:/keR56QS4vWht6FqL9EKVD/ovkPYuMYy2+t6WYrcVHbzgXXopN2is0WA:/76oW+yV+zInWYo7iXa5WA
MD5:	963EC3BE6D7AC55CA8CF1988AB867AE4
SHA1:	36BD0F20B825C9688A2BEF8236A047035FBBF9DE
SHA-256:	16A0E02C7675255E032C90402FF436FDD99A06AA20B16E37A64A488559CCF8B3
SHA-512:	D0EFE1E7FB093B304208DDDAF5EA643BECE05B4AA538B5D94953E246166EED2E1F0BD39C272F5B4CEECB43AEAB8020776BFCBE11D88C62FB0D1571E0B44B1354
Malicious:	false
Preview:	@ECHO OFF....setlocal....REM .\......i.b.j..SET DISPLAYTIME=15....REM ...s.t.@.C....SET CLASSPATH_SP=./bin;.;../_latest/Viewer/lib/vdr-client.jar;....REM Java.I.v.V......SET JVM_SP_OPTION=-cp %CLASSPATH_SP% -Duser.language=%LANG% -Djava.net.preferIPv4Stack=true....REM ...S.\....%JAVA_EXE% %JVM_SP_OPTION% -splash:%SPLASH% %SPLASH_DISPLAY% %DISPLAYTIME%....endlocal..exit..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\startLivePlayerV5.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	109
Entropy (8bit):	4.8336642463816775
Encrypted:	false
SSDEEP:	3:/qQKyn6AuBHofxVQUHytsrghXAa2ov:/k9CVdytsuQ6v
MD5:	0249CD57C98C6A599BF599534A03A8D5
SHA1:	1686625571DB807C64E2C5B87D0532833D1BA77B
SHA-256:	DFEC622B2D51F19B53E96C7ED5EC9185EA9F6DD6B469A63CABA22F874022150D
SHA-512:	5A0C66860C6E6B072234D1FCC812F654462E23D84D5C0FB4F23E49EA1EA3DA6BA7C6AE18EC8D5C910DCEEB62898CC2D18289AAD62D2920F7686CDCC043ABCFA8
Malicious:	false
Preview:	@ECHO OFF....REM NO edit this file!!..REM (This file convert to liveplayer.exe file)..CALL vdrviewer.bat %1..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\startMaintenanceViewer.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.75319606505958
Encrypted:	false
SSDEEP:	3:/qQKyn6AuBHofxVQUH4m5A3IrggA5Ao8Uov:/k9CVd4m57BA5Yv
MD5:	1A82800650E8277DA72DCAEEE4C6E57A
SHA1:	C1C1DB3FCECB5FE076231B340D098BA28E5928C5
SHA-256:	16CBA1A49548ACECA21875D917D30399B662E9C97DDA621459E80F3E17633077
SHA-512:	37D52E784030C1661BD53784032C3D2E12F9808B8CFC595F08CDFB87A2854BD5550C157349F9B776D5ABC19E6EAC896844D2F530F9BFE5941A69522478B49E7D
Malicious:	false
Preview:	@ECHO OFF....REM NO edit this file!!..REM (This file convert to maintenance.exe file)..CALL maintenance.bat %1..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\vdrviewer.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4794
Entropy (8bit):	5.105000295370866
Encrypted:	false
SSDEEP:	96:UJPoQMRQLWwmlMGXP37e4iqZ/P1qVqC8KqyqRtPuJqbDx70:qM+U/3a4ia3k8RtuIvxA
MD5:	7B3FC3129561DE48F925A6904E181EA7
SHA1:	B1087BD31D8230ABCDDCA95BC07F0F2682A0EF1B
SHA-256:	988304D91A86FDFE3ADFF267E2931104104C8EBDF0DA73B772F7553C177DA30D
SHA-512:	D8D2051D68DD8D837697710B3F0ED3896C71FFFB5EE1E1CE51FA4FA29A0FD1F6EC2E6B84797489EF7123614BC2CC6384D8AE743CEE455DE2D2462822516348C6
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..CALL vv-env.bat....REM display splash screen..start /b splash.bat....setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="Live Player V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)....REM ############################################################..REM Environment Check & Replacement..REM ##############

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\version.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.7169715185739918
Encrypted:	false
SSDEEP:	3:dxMqRxukd:jM2xd
MD5:	F1C83E89BF8327FBE4EFE919240E2A8E
SHA1:	AD322A7B3CDE552EB04E40EB088A28B84506A29A
SHA-256:	765BF2B1D540BFDACA9A7F78F38D939C0482996EF82652DF7C5CD7503A4689AF
SHA-512:	CC8B07ADB18890D8ABEF58145CD40A6A585678F799BE175A58DCF4B240ED3E0E89E82FF5252C6269C41C5C23E2E11188B6F396C53176A9171FA54754C69785B3
Malicious:	false
Preview:	LP:2450104-01.64-30..MV:2450105-01.64-30..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\versionCheck.vbs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2417
Entropy (8bit):	5.600665127439893
Encrypted:	false
SSDEEP:	48:Yzzyqy/mqD3baL5RoXBz2x6AiVolwg0t7+EIKCgLMeCMMLNLL7Cgb9BUocq:Yi/OquLroXV2x6TWwp7PBANCgb9Eq
MD5:	54CA503EFF1423862F6E74937F913DF9
SHA1:	4808997E8C0221F25C345BCB0339BE86AFB0DEED
SHA-256:	15CD6BC2F343D8478155DA284F9CE95C8CB2C236916E8F754145737F7A6EE2BC
SHA-512:	BF70003E7C77D2776B2193CDB5C125F23031972E38243DCF65DF0F9E5594555E073B828965AE940387AD3490722A6CA77D63A6695F60B67B15F566B065D95A2A
Malicious:	false
Preview:	' ############################################################..' .N.........Viewer...C.V.o.[.W..............`.F.b.N......' ..' return..' 0.FViewer..N............' 1.F...o.[.W......Viewer...N...........' 2.F.V.o.[.W......Viewer...N...........' ..' Create : 2017/05/12 S.Harada..' Update :..' ############################################################..Option Explicit....Dim WSHShell....' Live Player..^.C.g...o.[..\.............Const searchStrLP = "Live Player V5"....' VDR Maintenance Viewer..^.C.g...o.[..\.............Const searchStrMV = "VDR Maintenance Viewer"....' Viewer..V.o.[.W................Const searchStrVersion = "Version"....Set WSHShell = WScript.CreateObject("WScript.Shell")....' Viewer..o.[.W.......`.F.b.N....B..' Viewer...N............C......I......B..Call CheckVersion( )....' Viewer...N.............C......I......B..WScript.Quit(0)....' ############################################################..' .\......E.

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\vmv-env.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255
Entropy (8bit):	5.47963889152615
Encrypted:	false
SSDEEP:	6:/kFDb1jOx0ec77Lr87KtJqdlsz49+pXWOtWBQCvn:/AR4C7Lr87zd+z4M5WOSv
MD5:	0507C51AF9DA9E6F7CEA66AD4CE143AF
SHA1:	C3ABA1B7F0D31D8FA7D4E12C9452E581BE88BB3C
SHA-256:	61DDEC5B36E39E1F077265DB29843FCB36AF14417300F891FDF36C5DF41CBA0A
SHA-512:	DFB35870621AC25700BA5663C46BBF01CE5166128EDECE351923CCBCB50ACAF091CE68B3DECED38061F8E22BED3ADA84A67A9D87188C8432E172F4F624F88907
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms64m -Xmx512m....SET SPLASH=./images/splash-vmv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP%....SET SPLASH_DISPLAY=jp.co.furuno.vdr.util.SplashViewer....SET MAIN_CLASS=jp/co/furuno/vdr/app/MaintenanceViewerApp..

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\vv-env.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.518537632651269
Encrypted:	false
SSDEEP:	6:/kFDb1iWVICbec77Lr87KtJqdlsz49+pXWJV:/ARiSICaC7Lr87zd+z4M5Wb
MD5:	7B94FB5A39E1AC3E86A4447EA6488E85
SHA1:	916508C8CF634D73254A0A7F6C17321CD785338D
SHA-256:	B41115A1AFE407203903E20FD011D3035D116795A996C5AA229C19FE0F23B7DF
SHA-512:	F25D8C33239A0CBB40D137258C1E7CF243823E22DFDC1C5108CBBFD6217BBFA45DDE5351392582BCA8D8107F4D898849EBD14E1473D36B1BE938881B98FD21B0
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms512m -Xmx1024m....SET SPLASH=./images/splash-vv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP%....SET SPLASH_DISPLAY=jp.co.furuno.vdr.util.SplashViewer....SET MAIN_CLASS=jp/co/furuno/vdr/app/VDRViewerApp

C:\Program Files (x86)\FURUNO\VR-7000\_latest\Viewer\data\empty_config.xml

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1200418
Entropy (8bit):	4.457764155962315
Encrypted:	false
SSDEEP:	1536:X1mtgbyt80F2vwxtG/AQPKx0jeFIHNmr85SXYVu+lUDqRwv2dTk1O/Ah6LccLGt7:EaA
MD5:	DDC994C447826488D0C14E012D6B1E68
SHA1:	17CB905E26B756CE095247366658B5E09E5AD353
SHA-256:	6B964B6EF677A01D768C28756D0779D432588A75D799887E09B5ECD080D9B665
SHA-512:	6488D0C34FCEA46E3443EB3D2E244B0ED1C7E080EADF2D87D0E0993DC01994DC18B5DEC9B8E4C56375717DE60BACE5F7CFB2342AEEC54E4708D7685C75FB5816
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<config>.. <category id="ImageRecordSetting">.. <data>.. <channel id="1" validity="true">.. <parameter id="1" name="Active" value="true"/>.. <parameter id="2" name="No" value="Radar1"/>.. <parameter id="38" name="Check" value="0"/>.. <parameter id="27" name="Recording method" value="0"/>.. <parameter id="28" name="No.1 Input source" value="1"/>.. <parameter id="29" name="No.2 Input source" value="0"/>.. <parameter id="30" name="No.3 Input source" value="0"/>.. <parameter id="31" name="No.4 Input source" value="0"/>.. <parameter id="39" name="Fixed DRU Recording" value="true"/>.. <parameter id="40" name="Float DRU Recording" value="true"/>.. <parameter id="41" name="Long Term Device Recording" value="true"/>.. <parameter id="46" name="User Disk Recording" value="true"/>.. <parameter id="42" name="Network Output" value="true"/>..

C:\Program Files (x86)\FURUNO\VR-7000\_latest\Viewer\env.bat

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	5.655995512493813
Encrypted:	false
SSDEEP:	48:4lCrKlH7BBJ4nYJczews7XANIL9+SOICmGAI9KImqwzUgltbo3VYPZfA:4lCriGYuBsbAw9+3zrGq146UfA
MD5:	2EFB185ACD63EA96FF009CA4CF96096E
SHA1:	EED13F85B8E92EF508A674BA0EA86403491DF0C5
SHA-256:	70C699E74AE2AA300D92CF442A3D605AAF39BDFEF9C81D955A27C90B50F7E433
SHA-512:	B2495ECED24EFE4D3CB88A5362CA73AFDAF63C59B4BAD228A913F562D343E802E36A067B066A41121259C27DBC16FACAC7C475D8823CAB91466D3A753500B53A
Malicious:	false
Preview:	@ECHO OFF....SET APP_DLL=./../dlls....SETLOCAL ENABLEDELAYEDEXPANSION..REM REQUIRE VERSION : 1.8 (supported 32bit version only)..SET VV_JAVA_REQUIRE_VERSION=1.8..SET VV_JAVA_HOME=....REM RECOGNIZE OS ARCHITECTURE (32bit OS / 64bit OS)..IF "%PROCESSOR_ARCHITECTURE%" EQU "x86" (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\AdoptOpenJDK\JRE..) ELSE (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AdoptOpenJDK\JRE..)....:MAKE_ADOPT_JAVA_HOME..echo Get Adopt Directory from Registory Key (primary)..for /f "tokens=1" %%A in ('reg query "%ADOPT_KEY%"') do set ADOPT_VER=%%A..if "%ADOPT_VER%" EQU "" goto MAKE_ORACLE_JAVA_HOME..for /f "tokens=1" %%A in ('reg query "%ADOPT_VER%"') do set ADOPT_HOT=%%A..for /f "tokens=1" %%A in ('reg query "%ADOPT_HOT%"') do set ADOPT_MSI=%%A..for /f "TOKENS=1,2,*" %%A IN ('REG QUERY "!ADOPT_

C:\Program Files (x86)\FURUNO\VR-7000\_latest\Viewer\lib\dooars-t.jar

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	815544
Entropy (8bit):	7.892984118213049
Encrypted:	false
SSDEEP:	12288:sKu2y2XjChIcHOjMteTtwRCPRH3jxqlew+YhRScOwaAhsqD75tkBPuxOtyKNVy+3:tjBKHOXwRAH1yewvm0xse9N49NVyM
MD5:	D9F6295776D41CA2B4D8E7E15472B8CA
SHA1:	0EC558D0F90C77C3F96F1F5073F5CF63BEA31105
SHA-256:	4B960DB1A6404BD0BBF898B72F96BD5716B776268502643B7136DBC72B99DB12
SHA-512:	5AED9B6C1D4262F3C4CFAC0401E16198409B40FA0DE65503FAC7207C8E97A4F257163EE308CD8F83D59BEEBF55BCD78A6E383CFF2C8CF3BF37E96FD367124AF5
Malicious:	false
Preview:	PK.........YRT................META-INF/....PK.........YRT..~T...b.......META-INF/MANIFEST.MF....b.......T........M..LK-...K-*...R0.3..r.C.q,HL.HU...%-A..E..%.).N. ..z..F.F.I.....)..%...y^...\.\.PK.........YRT................dooars/PK.........YRT................dooars/app/PK.........YRT................dooars/applet/PK.........YRT................dooars/applet/infobus/PK.........YRT................dooars/beans/PK.........YRT................dooars/beans/ctrl/PK.........YRT................dooars/beans/furuno/PK.........YRT................dooars/beans/trend/PK.........YRT................dooars/beans/ts/PK.........YRT................dooars/bridge/PK.........YRT................dooars/development/PK.........YRT................dooars/event/PK.........YRT................dooars/event/app/PK.........YRT................dooars/factory/PK.........YRT................dooars/foundation/PK.........YRT................dooars/graphics/PK.........YRT................dooars/net/PK.........YRT................

C:\Program Files (x86)\FURUNO\VR-7000\_latest\Viewer\lib\vdr-client.jar

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3472143
Entropy (8bit):	7.873152172954716
Encrypted:	false
SSDEEP:	98304:rTIlzujdp6DsGVR/jH9vka8ttMw0lyI5v:gJujdDSBdvka+MXv
MD5:	717C657BF38389EC31901542403E71F2
SHA1:	79A1C7FBAE69F76A3C82CAC951A487FA8015AA12
SHA-256:	2586461A684E2502C0926C35A118EB4397D078C60F0ECF570F8EEBC6766A6CED
SHA-512:	C122A3F225B8BB1C3E8B6368EDDFD485C4A312A9A2292CB70D12D71F79DFB8C386A68C4A5564D3A324E4EBB3890B7E2E88BED11A525A7BBD43E1D555AF286FDE
Malicious:	false
Preview:	PK.........ZRT................META-INF/....PK.........ZRT................META-INF/MANIFEST.MF....................u.Ak.0...{ ..=x.CB...DAg...^%....I..C...al.].....zw.kb.......%..S.....c...}..m.-ow.sqP.bG........<.(Y.......\|......(.L.:....oT6.RdLH..QRY..z.O......}."..s(@.....%.T.@..1%.....?..t.l4..Z.)...PK.........YRT................jp/PK.........YRT................jp/co/PK.........YRT................jp/co/furuno/PK.........YRT................jp/co/furuno/vdr/PK.........YRT................jp/co/furuno/vdr/app/PK.........YRT................jp/co/furuno/vdr/conf/PK.........YRT............ ...jp/co/furuno/vdr/conf/component/PK.........YRT................jp/co/furuno/vdr/controller/PK.........YRT............$...jp/co/furuno/vdr/controller/extract/PK.........YRT............(...jp/co/furuno/vdr/controller/maintenance/PK.........YRT................jp/co/furuno/vdr/dataview/PK.........YRT................jp/co/furuno/vdr/debug/PK.........YRT................jp/co/furuno/vdr/decoder/PK..

C:\Program Files (x86)\FURUNO\VR-7000\_latest\Viewer\maintenance.bat

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4811
Entropy (8bit):	5.101209286895512
Encrypted:	false
SSDEEP:	96:3nPoQMRQzWwmlMGXP37e4iqZ/P1qVqC8KqyqRkuJ4bjJ79:VMYU/3a4ia3k8RkuWXJR
MD5:	CE0E47D3300F3A350E7D61BB5DBB9DEE
SHA1:	BE3266904F001F50A57E23C93D4DD0F09BC1F04C
SHA-256:	C1140DA81AA4A0A81AAC118B084AEFDBF0932AA224780BA9683055EBAB4358B7
SHA-512:	C2B38C666CAB95D453F7B4C6FAF4830E99405BA72901B6D7DAB4D96E78BEDC8B4D64262AD480E56AD66E7142505400CF63B58A097A0592C778B426B5F747D8C1
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..CALL vmv-env.bat....REM display splash screen..start /b splash.bat....setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="VDR Maintenance Viewer V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)....REM ############################################################..REM Environment Check & Replacement..REM ##

C:\Program Files (x86)\FURUNO\VR-7000\_latest\Viewer\vdrviewer.bat

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4794
Entropy (8bit):	5.105000295370866
Encrypted:	false
SSDEEP:	96:UJPoQMRQLWwmlMGXP37e4iqZ/P1qVqC8KqyqRtPuJqbDx70:qM+U/3a4ia3k8RtuIvxA
MD5:	7B3FC3129561DE48F925A6904E181EA7
SHA1:	B1087BD31D8230ABCDDCA95BC07F0F2682A0EF1B
SHA-256:	988304D91A86FDFE3ADFF267E2931104104C8EBDF0DA73B772F7553C177DA30D
SHA-512:	D8D2051D68DD8D837697710B3F0ED3896C71FFFB5EE1E1CE51FA4FA29A0FD1F6EC2E6B84797489EF7123614BC2CC6384D8AE743CEE455DE2D2462822516348C6
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..CALL vv-env.bat....REM display splash screen..start /b splash.bat....setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="Live Player V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)....REM ############################################################..REM Environment Check & Replacement..REM ##############

C:\Program Files (x86)\FURUNO\VR-7000\_latest\Viewer\version.txt

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.7169715185739918
Encrypted:	false
SSDEEP:	3:dxMqRxukd:jM2xd
MD5:	F1C83E89BF8327FBE4EFE919240E2A8E
SHA1:	AD322A7B3CDE552EB04E40EB088A28B84506A29A
SHA-256:	765BF2B1D540BFDACA9A7F78F38D939C0482996EF82652DF7C5CD7503A4689AF
SHA-512:	CC8B07ADB18890D8ABEF58145CD40A6A585678F799BE175A58DCF4B240ED3E0E89E82FF5252C6269C41C5C23E2E11188B6F396C53176A9171FA54754C69785B3
Malicious:	false
Preview:	LP:2450104-01.64-30..MV:2450105-01.64-30..

C:\Program Files (x86)\FURUNO\VR-7000\_latest\Viewer\vmv-env.bat

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255
Entropy (8bit):	5.47963889152615
Encrypted:	false
SSDEEP:	6:/kFDb1jOx0ec77Lr87KtJqdlsz49+pXWOtWBQCvn:/AR4C7Lr87zd+z4M5WOSv
MD5:	0507C51AF9DA9E6F7CEA66AD4CE143AF
SHA1:	C3ABA1B7F0D31D8FA7D4E12C9452E581BE88BB3C
SHA-256:	61DDEC5B36E39E1F077265DB29843FCB36AF14417300F891FDF36C5DF41CBA0A
SHA-512:	DFB35870621AC25700BA5663C46BBF01CE5166128EDECE351923CCBCB50ACAF091CE68B3DECED38061F8E22BED3ADA84A67A9D87188C8432E172F4F624F88907
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms64m -Xmx512m....SET SPLASH=./images/splash-vmv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP%....SET SPLASH_DISPLAY=jp.co.furuno.vdr.util.SplashViewer....SET MAIN_CLASS=jp/co/furuno/vdr/app/MaintenanceViewerApp..

C:\Program Files (x86)\FURUNO\VR-7000\_latest\Viewer\vv-env.bat

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.518537632651269
Encrypted:	false
SSDEEP:	6:/kFDb1iWVICbec77Lr87KtJqdlsz49+pXWJV:/ARiSICaC7Lr87zd+z4M5Wb
MD5:	7B94FB5A39E1AC3E86A4447EA6488E85
SHA1:	916508C8CF634D73254A0A7F6C17321CD785338D
SHA-256:	B41115A1AFE407203903E20FD011D3035D116795A996C5AA229C19FE0F23B7DF
SHA-512:	F25D8C33239A0CBB40D137258C1E7CF243823E22DFDC1C5108CBBFD6217BBFA45DDE5351392582BCA8D8107F4D898849EBD14E1473D36B1BE938881B98FD21B0
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms512m -Xmx1024m....SET SPLASH=./images/splash-vv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP%....SET SPLASH_DISPLAY=jp.co.furuno.vdr.util.SplashViewer....SET MAIN_CLASS=jp/co/furuno/vdr/app/VDRViewerApp

C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRAVCtrlJNI.dll

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	405504
Entropy (8bit):	5.780562511553602
Encrypted:	false
SSDEEP:	3072:j2UJUIPtaqPHX/mh0GVLLiabBQSOrtKZ52+TT1ZyAHgx0baEIVv1eSTnxHs3tStc:jLXmLVVbBQSSE9AEICegl2v
MD5:	F0BA0BAEAFE8D485FCF8F23C60745DD0
SHA1:	A365B8231D98088EA7B2F807CA1AA2FB8C0D5A2A
SHA-256:	E32C740D1ADD0D9556BE1E37E9B23BB34E1CACECAE7C537189843F2A17FF4675
SHA-512:	2EB4A1917DD503A40F07D2A01B5C50CAB328A8E6908B8D4820DAFE2A7DB2B9C35A087950887DF976E1429C37B29DEA6223C01EB2BBC04919947829AA9D4CEE6C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rNO.6/!.6/!.6/!...Z.:/!.YY..7/!.?W..4/!.. \|.</!...\.(/!...L../!.....3/!.6/ ../!...O.g/!...[.7/!...].7/!...Y.7/!.Rich6/!.........................PE..L......b...........!.....p..........&J.......................................`.......................................b..j.......,............................ .../......................................@............................................text....h.......p.................. ..`.rdata..............................@..@.data...4z...p...P...p..............@....idata..D........ ..................@....rsrc...............................@..@.reloc..W6... ...@..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_latest\dlls\VDRTransRtp.dll

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.501689591810636
Encrypted:	false
SSDEEP:	768:wuWX6ZY7Dsl0lKVnUxHuQuIIsYHJ2TlixPXVth:w7XMY7DzlKVnUDIsYcMxNt
MD5:	E03F1FF95E5F5E470B60B98CF8DABA7E
SHA1:	5FF6B61CB323F6F2EC9F1BAEF64B4574CF0955A3
SHA-256:	B18D1CAD6EC5E7FC416CE61BB0C2D8F5ADB7645C5C378FD9D66EBB77057A9429
SHA-512:	0B8D2F24896032C8DD9C52F521A5555DF7A18516C0E6F464C41E4776238269C6F67F9E09FEABE82276B306F175E830BA0722156C16D1D031343939456D1652FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..H...H...H...3...H...5...H...&...H...I...H.U.....H...%...H...2...H...0...H.Rich..H.........................PE..L......W...........!.........`.......#..............................................VQ..............................P..........d...............................P......................................@...............4............................text....p.......................... ..`.rdata...!.......0..................@..@.data...d...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\clientrecorder.exe

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1490944
Entropy (8bit):	5.918416150691233
Encrypted:	false
SSDEEP:	24576:Uo02dPZXnHI47KOUWujnfZp3hHHLJw01Lxtykgdl4/8:Uo02dPZXh2OUWMJ1Lxty8/8
MD5:	D5738D9829DF5D18855EFB675231CB8B
SHA1:	F6D1067DEA9A11E1916D7CFBCCB00E4262F1471F
SHA-256:	F67FDE05EB130F74C43C2894C7C8154BD773FEC890BAD4769956F216F3DCB9EA
SHA-512:	BD4D021C59145B7CE42B5F31014A3B4B0A46AE8B494EA0C2450D5E5ACE91CAC69EC4FBBEE5377F8E0EA06EB4FD67EFAAE33FB2DFC05E973DD2BB0B286E0874BD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 4%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G.d..d..d.Dh...d..j...d..j...d...9..d..e...d..j..6.d..j..p.d..j...d..j...d.Rich.d.........................PE..L...:..b..................... .......3............@........................... ............................................... ....... ............................................................................... ..............................textbss.................................text....... ...................... ..`.rdata...7.......@..................@..@.data...T...........................@....idata..(..... .. ..................@....rsrc......... .....................@..@........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\extclient.exe

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2662400
Entropy (8bit):	5.915842537430716
Encrypted:	false
SSDEEP:	49152:S0ied+UyJl7e2zlNdwO7EQla5biyKi14z328:diedw/pwwEQGz1
MD5:	B4809CE2B21C498EF4ECCFB4B506F784
SHA1:	BEFEC7DB7F0A795A2E041B1F0669CF81FAF34539
SHA-256:	47F1F189B99A4074705FBE2FD247ED5B48E2D815D69B514BDD471810F8BE81BC
SHA-512:	CDE74D2751B0FBD87A89A22A709EA1E32326D314E10BCE10A6EBAF871F582E71B73C97CD6C1558872BDB37EE758F31D176854C1C83891E2A4A8A2CA076FD081E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$".wJq.wJq.wJql.4q.wJq.7q.wJq8x*q.wJq.1q.wJq8x.q.wJq.wKq.vJq.'q.vJq.$q.wJq.0q.wJq.6q.wJq.2q.wJqRich.wJq................PE..L...P..b.........................................@...........................:..................................... w6......p:.,.....:............................. ...............................................xx:.L............................textbss.................................text....{... ...................... ..`.rdata..............................@..@.data.........6......p'.............@....idata..((...p:..0...`(.............@....rsrc.........:.......(.............@..@................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\rcplayer.exe

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1396736
Entropy (8bit):	6.530224476491686
Encrypted:	false
SSDEEP:	24576:xm1oPnzDyv8kCv8p30Ed0DxKlTxRor2nmyylX1Tq/PIh99dlkkPbW3/VSAk90/Td:IOPzWkkCvMxsxjjyya/PIh9zHYsz9+
MD5:	44E3F6CCE9AB5A045165330DB87205AE
SHA1:	87456956E251AC0FCFD5874C5AF8375433550103
SHA-256:	245160BAC02DA98439B6D243486B6FE23F3A75310C685412E2AD50D60A4604F1
SHA-512:	39DAABB6CD644FC6EB67FA23D008C26E9F0E74A36934DAEA84634E12981F69C0C8C18BE480C0145EAEA2E4C9944C7BAB5EF2D5C64FB2F4E69E4C3474EEF7910E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>%..zD..zD..zD....wD..]...MD..]...rD..K..}D..zD...D..]...D..]....D..]...{D..RichzD..........................PE..L......b.................@..........`........P....@.................................T...............................................................................@T..................................@............P...............................text....:.......@.................. ..`.rdata...B...P...P...P..............@..@.data...............................@....rsrc................@..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\rserv.exe

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	552960
Entropy (8bit):	6.502032146686435
Encrypted:	false
SSDEEP:	12288:vQfdbvXmARDcl5RAam2hv8YXJGapNLED++ANt5kP+yciW9sllVJ9gr8izBAop7xT:0vXDRDY5Xl8YXJAizBAedCs
MD5:	0D6B3D038E635907A8296EB3BF137F20
SHA1:	530701890DD67AB505CBF4EADFDC2DF7A8E2EBFA
SHA-256:	C409D7F5F5158669C5D7F1593A116876326F7E5D18434BCB941CEE527CF73B39
SHA-512:	CE08EADC561A1287DDAE3641C84F89441614BC462FF7FDF67FD005C0DCA2B86130F16FA654F2494FFE7E2ADD40C97EEDCF817B490A3E78F023DF2FEF56608CDB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 5%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.@._.@._.@..U>.S.@.xW=.~.@.....X.@._.A..@.xW-...@.xW..%.@.xW8.^.@.Rich_.@.................PE..L...%..b.................0...0.......k.......@....@.......................... ......dd..........................................P...................................................................H...@............@...............................text..../.......0.................. ..`.rdata......@.......@..............@..@.data............p..................@....rsrc................`..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\bin\server.bat

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.4127659163167
Encrypted:	false
SSDEEP:	6:xqOFECtFrEw5tFErMAT8RAE1T/A2we4iX+3y7FQ:xvECfrEw5LEtT8RBdwe4044Q
MD5:	DD38EB05852B8BC83871AABAE9935465
SHA1:	5400A62AE69C5FFE62C99CF707D4A31F029EC04A
SHA-256:	7EF19D070E82D00DB30974C6E32B7BF0DCF0116E96B4F6C81188985D855D6CBD
SHA-512:	35EAC0444CFB65DEDA9CECDADF7CAFC23A5B3507CC3AA8AEA946F5E39B4CFDF478EA37108CC4306C4FC549D3693F2A216F802CF8588CDEA56FEF6E21546265AD
Malicious:	false
Preview:	start "extclient" extclient.exe -cons -debug -v..start "rcplayer" rcplayer.exe -cons -debug -v..start "rserv" rserv.exe -cons -debug -v..start "clientRecorder" clientrecorder.exe -cons -ftpuser furuno -ftppass furuno -debug 0x10000..start "remoteclient" remoteclient.exe -cons -debug -v

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\etc\class.def

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8406
Entropy (8bit):	4.7248589356062975
Encrypted:	false
SSDEEP:	192:sUylxbUT/t1VcfbfZpBZp8xFI+OrU5h2P:Glh8/3obJuewuP
MD5:	499EC3F872B9F8E910D79AC5B0A613DC
SHA1:	1496A8261E2123EDD21644E702899AE7E962271C
SHA-256:	0E16CE7D50F83E415C48B0FADD9B0C0A63B56FF74820E5A3715F113CCDFDD2C5
SHA-512:	8C09C6E395C011902AA89B46256CAE5C147A4C6D39CB2826292242686B3C8B0DDE1DCEA9F268A028D5CB9D260EED2B146E7FF7CE89FD52B5872B6DA12BA5C886
Malicious:	false
Preview:	# generated date: Fri Aug 30 16:30:00 2019..e openclose_t 1..v 0 \|open..v 1 \|close..e onoff_t 2..v 0 \|off..v 1 \|on..e power_status_t 3..v 0 \|green..v 1 \|yellow..v 2 \|red..e save_button_t 4..v 0 \|lighting..v 1 \|lights-out..v 2 \|blinking..e normal_button_t 5..v 0 \|lighting..v 1 \|lights-out..e error_button_t 6..v 0 \|green..v 1 \|blinking-in-red..v 2 \|red..e power_type_t 7..v 1 \|AC..v 2 \|DC..v 3 \|BATT..e land_mark_type_t 8..v 0 \|unknown..v 1 \|Input Device..v 2 \|Terminal Board Ether..v 3 \|Junction Box..v 4 \|Audio Board..v 5 \|MIC..v 6 \|Video LAN Converter..v 7 \|Radar..v 8 \|Terminal Board..v 9 \|Serial Input..v 10 \|Analog..v 11 \|Digital..v 12 \|Alarm..v 13 \|Power Status..v 14 \|System Status..v 15 \|VHF..v 16 \|Sentence..v 17 \|Process..v 18 \|Config Status..v 19 \|Sensor(LAN) Input..v 20 \|AMS Input..e internal_value_type_t 9..v 0 \|unknown..v 1 \|Power Trigger..v 2 \|Current Value..v 3 \|Test Value..v 4 \|Test Result..v 5 \|Capture Resolution (H)..v 6 \|Capture Resolution (V)..v 7 \|Capture Size..v 8 \|Diag R

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\etc\class.desc

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13789
Entropy (8bit):	5.051328041173336
Encrypted:	false
SSDEEP:	96:WxPp6HuGAnQmO3JmyJpmPZcOuKTHymp32ml5Kdt4BleMkhkNu171FtAi8lr2U35P:unOoyUOAHyUG05KzgleFhP1bJpHZs
MD5:	3306236F69013E5C3AEF09D36294B655
SHA1:	BFFEED6C74F4F85508AF31925FA0E81A54824A79
SHA-256:	C3D6878FF5B457C9DE85FCD77551E6E4448100038639B489DDCF5A831E5D1E0E
SHA-512:	E4B795003C183F5465C29A1913617D9083E6B9869C177E520436D11FC8819626BE620F01759BCC99B4021F9D33593E030D0055239A04F9F97B6C90DF44775FEB
Malicious:	false
Preview:	# 1 "class.cpp"..# 1 "<built-in>"..# 1 "<command-line>"..# 1 "class.cpp"..# 10 "class.cpp"..enum openclose_t {.. {0,"open"},.. {1,"close"},..};..enum onoff_t {.. {0,"off"},.. {1,"on"},..};..enum power_status_t {.. {0,"green"},.. {1,"yellow"},.. {2,"red"},..};..enum save_button_t {.. {0,"lighting"},.. {1,"lights-out"},.. {2,"blinking"},..};..enum normal_button_t {.. {0,"lighting"},.. {1,"lights-out"},..};..enum error_button_t {.. {0,"green"},.. {1,"blinking-in-red"},.. {2,"red"},..};..enum power_type_t {.. {1,"AC"},.. {2,"DC"},.. {3,"BATT"},..};....enum land_mark_type_t..{.. {0, "unknown"},.. {1, "Input Device"},.. {2, "Terminal Board Ether"},.. {3, "Junction Box"},.. {4, "Audio Board"},.. {5, "MIC"},.. {6, "Video LAN Converter"},.. {7, "Radar"},.. {8, "Terminal Board"},.. {9, "Serial Input"},.. {10,"Analog"},.. {11,"Digital"},.. {12,"Alarm"},.. {13,"Power Status"},.. {14,"System Status"

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\etc\minit.conf

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	362
Entropy (8bit):	4.3744796318157215
Encrypted:	false
SSDEEP:	6:n/MW//Did+V6jMHeBLNmAIQ1dGJeMei1AxRADyT/A2weyyCp+ep:n0G4+V67B51Bi18RHdweyXNp
MD5:	066BD77D49DB45FA283042AB2F1BC8AE
SHA1:	FE2AFB82C819936ABB896FEEC897897120B95E91
SHA-256:	9C3B9AF44DBB2E4A147F69A33BD966E8AC61D3FEBF0A5B772BA97036E403436F
SHA-512:	26652A6ED8A0719028F1B8CE44919357DCE06707F3616B393E18B3C83447D7D76CEB7E65BD0836999897413BC592AD79786F410BA7553BBF1B31482622C6DC78
Malicious:	false
Preview:	#..# type procname command & args..#..respawn rserv rserv -debug 0x10000..respawn rcplayer rcplayer -debug 0x10000 -timeStamp 112:0x100001:10..respawn extclient extclient -debug 0x10000..respawn clientrecorder clientrecorder -ftpuser furuno -ftppass furuno -debug 0x10000 -v..respawn remoteclient remoteclient -debug 0x10000..

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\etc\serv.def

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	680
Entropy (8bit):	4.162406236493623
Encrypted:	false
SSDEEP:	12:i+bTVheO/OI9WD33V0+PO7I4vjh+SQic0+n:i+bTD9+i1Qm+n
MD5:	DB551FA8DC64E8B58619D7D0E142F638
SHA1:	46FC47809B3AF871928E69C0CA14981EA90BB2A6
SHA-256:	4790F553AFA3E6AEF151A7C3C36EDD700A33D2C02311261CFF5D459AB258C8EA
SHA-512:	010AD9B84E78A1950A430BE45AEF3876F99B787568949D6139DCD586ADF6F65FF1834809061AE311531F85A8CAC0C28029F0DB85107C0CE090E8A2D2378079AB
Malicious:	false
Preview:	# id.type.priority [systemid].ip:port.or file..ip:port.or file..1.modelserv.0.1.localhost..2.logger..0.1.localhost:10020..1.crntserv.0.1.localhost:15000..51.ioserv .0.1.localhost:12001....15 rcplayer 0 1 localhost:10105..16 extserv 0 1 10.0.0.100:10106..17 extclient 0 1 localhost:10107......#1.modelserv.0.1.localhost..#2.logger..0.1.localhost:10020..#1.crntserv.0.1.localhost:15000..#51.ioserv .0.1.localhost:12001....#15 rcplayer 0 1 localhost:10105..#16 extserv 0 1 10.160.155.164:10106..#17 extclient 0 1 localhost:10107......

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\etc\services.def

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	3.983068315890039
Encrypted:	false
SSDEEP:	3:TR29QKB3JU25xecgXsGXR1fCaAOgqJEF/FFJcVM9YdRT64MbvyZuFcqkwOKDeNFR:o9fBqG/gcifNJENhklTBmVc1dVEUn
MD5:	D5BE99A24E4FA518C483C54427DCB976
SHA1:	F8DD2C1A9646CAB3F67813049C74114A06802F6B
SHA-256:	779717057FF3FB7D74E07B6C1A5A72B91923AB9660486299B24AE22716A04E88
SHA-512:	F0AFD27F8925AE2240EB3D5AEAD36B75D1B6E20F9E4AFCAC22239BAADB70E87A5BBD26CC3D457E04086A18D7DE33C7F8F641F7B9F8DF99129214D3B00B2F2EF5
Malicious:	false
Preview:	#.name.type.port..modelserv.1.24001..crntserv 3 15000..logger..4.10020..ioserv..5.12001....rcplayer 1005 10105..extclient 1007 10107..extserv 1006 10106....sysinfo 9 0..

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\onlndb\Config.ini

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	Generic INItialization configuration [drucapa]
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.696032879598639
Encrypted:	false
SSDEEP:	3:7F8zRIXKyJHSKVJ+3fsfWcYFHyeWiXAsLvsXAsNYRekGW0AsfUeov:7SzEhyM+3fTysQCEQDRepk/eov
MD5:	22C30E24367DBB6D49595D5FDD86CC43
SHA1:	19FF654DFFAB542693655C4309FB46DC442A1A56
SHA-256:	3D2633567D669EF6DD0893974361204F643A898CA70EF2181A99EEAD3F6F78CC
SHA-512:	EE63A543A85F5FCE18B87AFEEABB55444702F1D9B46B52CFF35C7982CB40BB67E9DE37C711E74A76138FB9C918E39169F2D614AC9A35F087E61A5DC5DCF8B2FE
Malicious:	false
Preview:	[extract]..restore = /opt/vr/data/restore;....[drucapa]..capacity = 30000;....[audio]..startOffset = 4600..deliveryCount = 1;..;startOffset = 7488..;startOffset = 9504..; -4896..;startOffset = 4608..;..

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\onlndb\equipment.db

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	data
Category:	dropped
Size (bytes):	68960
Entropy (8bit):	4.889017390182576
Encrypted:	false
SSDEEP:	768:pmHS0+rz2TejydHTbOFVqFUCfnO5LTwnKTvUkIjXxCbv1ByUQVULap4/ukl2HI5J:pmHN+3IHTbUqFi1UkIjhCbXyU/D
MD5:	9EC77F47DC53838FC3CC7079D180E34F
SHA1:	ECB48D106FF6878A49B3F717CB12D94BFC86EAC9
SHA-256:	7AB11DEA44E4C5FF38C2A33D7C3D222E29955D1D47388B8F071F6E6F5DCB8A10
SHA-512:	1571C81EEA2F9BF07703FD79360C16CA893D6FDBBE6EFA0420FA163B7809D55D3938F7E0CB4A2A9ACA01F15315B1A48D2C1D0DACD7B000923F9657B8EF5CEDA8
Malicious:	false
Preview:	.VC.U.o`....(...(...........q..........K...........n...................n...................n...................n...........!.......n...........).......n...........1.......n...........9.......n...........A.......n...........I.......n...........Q.......n...........Y.......n...........a.......n...........i.......n...........q.......n...........y.......n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n... ...............n...!...............n..."...............n...#...............n...$.......!.......n...%.......).......n...&.......1.......n...'.......9.......n...(.......A.......n...).......I.......n...*.......Q.......n...+.......Y.......n...,.......a.......n...-.......i.......n...........q.......n.../.......y.......n...0...

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\onlndb\monattr.txt

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	280471
Entropy (8bit):	4.825966410766605
Encrypted:	false
SSDEEP:	6144:c05idHv11NzvZpLxxLXzVL8qXRCdVijVz3hxJrj9lgWD9njTBbNv/UMJH4URnrKy:xreX
MD5:	A602B91DDC542E56F4D2A44E6D25D638
SHA1:	EC4A4C9EBDFFC358E7EA640CC39DB3532145FA88
SHA-256:	8F10D42FF5383DA8FAEEAD0C4F0B9C91AD4B1278CB8EF42884CB99300B46B1B1
SHA-512:	2D27636FB8572617B526C376CAF51B2A21C208DD29E7AEF5AB91019624C59E580E85D2AED3E2DB4DB6C9650638AABF2DA4207D7E2263804C489DCDA9D3959F32
Malicious:	false
Preview:	@i 0 5 0 0 0 278 840 0 0 476 1376 1174 35 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100001 13 4\|\|\|0\|\|\|DRU:Device Num:Fixed DRU.5 3 202 0x100001 14 4\|\|\|0\|\|\|DRU:Round Trip:Fixed DRU.5 4 202 0x100001 15 4\|\|\|0\|\|\|DRU:Index:Fixed DRU.5 5 202 0x100001 16 4\|\|\|0\|\|\|DRU:Restart Counter:Fixed DRU.5 6 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 7 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 8 202 0x100002 13 4\|\|\|0\|\|\|DRU:Device Num:Float DRU.5 9 202 0x100002 14 4\|\|\|0\|\|\|DRU:Round Trip:Float DRU.5 10 202 0x100002 15 4\|\|\|0\|\|\|DRU:Index:Float DRU.5 11 202 0x100002 16 4\|\|\|0\|\|\|DRU:Restart Counter:Float DRU.5 12 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Lon

C:\Program Files (x86)\FURUNO\VR-7000\_latest\server\data\onlndb\sporadic.txt

Download File

Process:	C:\Windows\System32\xcopy.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	66614
Entropy (8bit):	4.712231082284398
Encrypted:	false
SSDEEP:	1536:MwdHuAW61Np1wn0ZyGLOSxLlxzVL8qX7MueZrql:1dHv11Nzw0ZpLOSxLlxzVL8qXQuehql
MD5:	E566BB30590682C468E9F9AF0B4F514B
SHA1:	CFE919552115B95CAB2FB11ABAA112814BFA2014
SHA-256:	221D72A03B4C2B164D455D763484EA27712B20CF383C2B3E272F0DC9429775A4
SHA-512:	ECB0DB14DEC33640A0F59EFAADE432F1DFC4F41999C5DCDD79EA9032446976B5C9B19EF72E60CD5F23100CB18C05BC7A8DE05020AEB656A7BC309E55DC228299
Malicious:	false
Preview:	@i 0 5 0 0 0 6 778 0 0 0 0 268 2 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 3 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 4 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Long Term Device.5 5 203 0x100001 12 4\|\|\|0\|\|\|HDD:SIZE:Long Term Device.6 0 110 0x100001 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH001.6 1 110 0x100002 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH002.6 2 110 0x100003 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH003.6 3 110 0x100004 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH004.6 4 110 0x100005 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH005.6 5 110 0x100006 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH006.6 6 110 0x100007 1 4\|\|\|0\|\|

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\data\empty_config.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1170699
Entropy (8bit):	4.448309377017215
Encrypted:	false
SSDEEP:	1536:X1mtgbyt80F2vwxtG/AQPKx0jeFIHNmr85SXYVu+lUDqRwv2dTk1O/Ah6LccLGtY:ESJ
MD5:	89730B7ECADC6D34C6FA8AA16A747420
SHA1:	94571C2F3AC44657978910ADE581763287E5B6D6
SHA-256:	681F67296E5B4B170DD32B79718A51064FB0F1E05CFF6DDE6D93D556513C3ECC
SHA-512:	D9181B1624D027E580E56C1C79C38AC74FA63E0718C687119A91698D248F5AB196F4DEBCA8E05EABFB28A7D80A8BAB3C43B95E0916F0843746D61526FEA689C5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<config>.. <category id="ImageRecordSetting">.. <data>.. <channel id="1" validity="true">.. <parameter id="1" name="Active" value="true"/>.. <parameter id="2" name="No" value="Radar1"/>.. <parameter id="38" name="Check" value="0"/>.. <parameter id="27" name="Recording method" value="0"/>.. <parameter id="28" name="No.1 Input source" value="1"/>.. <parameter id="29" name="No.2 Input source" value="0"/>.. <parameter id="30" name="No.3 Input source" value="0"/>.. <parameter id="31" name="No.4 Input source" value="0"/>.. <parameter id="39" name="Fixed DRU Recording" value="true"/>.. <parameter id="40" name="Float DRU Recording" value="true"/>.. <parameter id="41" name="Long Term Device Recording" value="true"/>.. <parameter id="46" name="User Disk Recording" value="true"/>.. <parameter id="42" name="Network Output" value="true"/>..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\data\is-K0A4L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1170699
Entropy (8bit):	4.448309377017215
Encrypted:	false
SSDEEP:	1536:X1mtgbyt80F2vwxtG/AQPKx0jeFIHNmr85SXYVu+lUDqRwv2dTk1O/Ah6LccLGtY:ESJ
MD5:	89730B7ECADC6D34C6FA8AA16A747420
SHA1:	94571C2F3AC44657978910ADE581763287E5B6D6
SHA-256:	681F67296E5B4B170DD32B79718A51064FB0F1E05CFF6DDE6D93D556513C3ECC
SHA-512:	D9181B1624D027E580E56C1C79C38AC74FA63E0718C687119A91698D248F5AB196F4DEBCA8E05EABFB28A7D80A8BAB3C43B95E0916F0843746D61526FEA689C5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<config>.. <category id="ImageRecordSetting">.. <data>.. <channel id="1" validity="true">.. <parameter id="1" name="Active" value="true"/>.. <parameter id="2" name="No" value="Radar1"/>.. <parameter id="38" name="Check" value="0"/>.. <parameter id="27" name="Recording method" value="0"/>.. <parameter id="28" name="No.1 Input source" value="1"/>.. <parameter id="29" name="No.2 Input source" value="0"/>.. <parameter id="30" name="No.3 Input source" value="0"/>.. <parameter id="31" name="No.4 Input source" value="0"/>.. <parameter id="39" name="Fixed DRU Recording" value="true"/>.. <parameter id="40" name="Float DRU Recording" value="true"/>.. <parameter id="41" name="Long Term Device Recording" value="true"/>.. <parameter id="46" name="User Disk Recording" value="true"/>.. <parameter id="42" name="Network Output" value="true"/>..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\env.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2558
Entropy (8bit):	5.658284950015424
Encrypted:	false
SSDEEP:	48:4lf4alH7BBJ4HJczews7XANIL9+SOICmGAI9KImqwzUgltbo3TGYPZfA:4lf4SYuBsbAw9+3zrGq146TnfA
MD5:	AE9C15353864A1246B36516103365593
SHA1:	AC3524CCC2653F70DAADC7619DA352BE37922C79
SHA-256:	8EC627FB916178D4FA6BCBC3B841AEFA304DDBF552B5C738B106C2AE3EE7759B
SHA-512:	EDFE8B18BC1F096AA242D901F1A6BCD92D4D0EFA3A7796038DE0A67C0FA1CD75613B71EA280D5B2B39AD3378B966B083B26F986E8AC8794B42E4D512DEF5FAD1
Malicious:	false
Preview:	@ECHO OFF....SET APP_DLL=./../dlls....SETLOCAL ENABLEDELAYEDEXPANSION..REM REQUIRE VERSION : 1.7 (supported 32bit version only)..SET VV_JAVA_REQUIRE_VERSION=1.7..SET VV_JAVA_HOME=....REM RECOGNIZE OS ARCHITECTURE (32bit OS / 64bit OS)..IF "%PROCESSOR_ARCHITECTURE%" EQU "x86" (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\AdoptOpenJDK..) ELSE (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AdoptOpenJDK\JRE..)....:MAKE_ADOPT_JAVA_HOME..echo Get Adopt Directory from Registory Key (primary)..for /f "tokens=1" %%A in ('reg query "%ADOPT_KEY%"') do set ADOPT_VER=%%A..if "%ADOPT_VER%" EQU "" goto MAKE_ORACLE_JAVA_HOME..for /f "tokens=1" %%A in ('reg query "%ADOPT_VER%"') do set ADOPT_HOT=%%A..for /f "tokens=1" %%A in ('reg query "%ADOPT_HOT%"') do set ADOPT_MSI=%%A..for /f "TOKENS=1,2,*" %%A IN ('REG QUERY "!ADOPT_MSI!

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\is-A4SCN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4502
Entropy (8bit):	5.153810388662076
Encrypted:	false
SSDEEP:	96:iJPoQMRQxwmlMGXP37e4iqZ/P1qVqC8KqyqRtPuJqbDx70:0MxU/3a4ia3k8RtuIvxA
MD5:	E5E7FD82A500BD50A2AEF6FA401877ED
SHA1:	D43AC5937FE4E39FBFEA0D11ABDCCCA6B2054974
SHA-256:	B9FABCDEDEAFD9FDA0763BF35EC4A836D1B29F58A6BAEDB7F04AE2026DE39575
SHA-512:	7148D32A486CCE27B4375600F25C6C7B7F206F6ACA01D5BC04E5EAAE545E7487FE616914D5E0BC1E9D5725812F9AF007029898DDAC33574AC3C1930369DBA636
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="Live Player V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)..endlocal....CALL vv-env.bat....REM ############################################################..REM Checking installed JRE, or not...REM ######################################################

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\is-PR2EQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3730
Entropy (8bit):	4.889614411755457
Encrypted:	false
SSDEEP:	48:ysoAxUPoAk4rjwRQsag1i1kd7lMiRjM+dykGYz5JSa7e4gWyuJsDbjJr4+gTTWw8:inPoQMRQWwmlMGXP37e4uuJ4bjJ79
MD5:	EF3F917109AB48FE95B423C8261B823A
SHA1:	A081481E8C6BBE76108A74026E3440414B697A05
SHA-256:	979565AB78B93A5FE7D15A8EE01417B679BAF9273B07F733488AD7DC629000A1
SHA-512:	B0D31C7DA5B59A5C70BA8108D2ED928A5E44977974D13FE334F92468A2CFE6DD4E605331CEA350007557A10FA12FFAA466EBF4CF9EE37DF4605C254BDB773A21
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="VDR Maintenance Viewer V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)..endlocal....CALL vmv-env.bat....REM ############################################################..REM Checking installed JRE, or not...REM ##########################################

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\is-U0920.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.45187981568043
Encrypted:	false
SSDEEP:	3:/qQKGgynib1nxFnUXVf9MIEDYy6L4Hfelz2dpxB1xLxthKyvWNfAC+pXWBadKOA/:/kFDb1jOx0ec77Lr81NIpXWOtWBQCvn
MD5:	4DB13C9E68F954038F1894482D35C7FF
SHA1:	57FF69D81501F8EC1F7185542BD6993406D7A019
SHA-256:	AC994746CEF8329FA585811DDA36A6C938A2BBA0C3A321472CDC1B0652B769C1
SHA-512:	97F45EC9FACC472DC9A6BD1D10E60109B148C3A9A445FBE966A269D5BD1B08A95E484740E143B9837660421EF66F409BF0CFF0F0F55CA0BE9619F1BEB27CC348
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms64m -Xmx512m....SET SPLASH=./images/splash-vmv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP% -splash:%SPLASH%....SET MAIN_CLASS=jp/co/furuno/vdr/app/MaintenanceViewerApp..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\is-U5RH9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2558
Entropy (8bit):	5.658284950015424
Encrypted:	false
SSDEEP:	48:4lf4alH7BBJ4HJczews7XANIL9+SOICmGAI9KImqwzUgltbo3TGYPZfA:4lf4SYuBsbAw9+3zrGq146TnfA
MD5:	AE9C15353864A1246B36516103365593
SHA1:	AC3524CCC2653F70DAADC7619DA352BE37922C79
SHA-256:	8EC627FB916178D4FA6BCBC3B841AEFA304DDBF552B5C738B106C2AE3EE7759B
SHA-512:	EDFE8B18BC1F096AA242D901F1A6BCD92D4D0EFA3A7796038DE0A67C0FA1CD75613B71EA280D5B2B39AD3378B966B083B26F986E8AC8794B42E4D512DEF5FAD1
Malicious:	false
Preview:	@ECHO OFF....SET APP_DLL=./../dlls....SETLOCAL ENABLEDELAYEDEXPANSION..REM REQUIRE VERSION : 1.7 (supported 32bit version only)..SET VV_JAVA_REQUIRE_VERSION=1.7..SET VV_JAVA_HOME=....REM RECOGNIZE OS ARCHITECTURE (32bit OS / 64bit OS)..IF "%PROCESSOR_ARCHITECTURE%" EQU "x86" (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\AdoptOpenJDK..) ELSE (.. SET REG_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment.. SET ADOPT_KEY=HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AdoptOpenJDK\JRE..)....:MAKE_ADOPT_JAVA_HOME..echo Get Adopt Directory from Registory Key (primary)..for /f "tokens=1" %%A in ('reg query "%ADOPT_KEY%"') do set ADOPT_VER=%%A..if "%ADOPT_VER%" EQU "" goto MAKE_ORACLE_JAVA_HOME..for /f "tokens=1" %%A in ('reg query "%ADOPT_VER%"') do set ADOPT_HOT=%%A..for /f "tokens=1" %%A in ('reg query "%ADOPT_HOT%"') do set ADOPT_MSI=%%A..for /f "TOKENS=1,2,*" %%A IN ('REG QUERY "!ADOPT_MSI!

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\is-UMC1D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.46405281471386
Encrypted:	false
SSDEEP:	3:/qQKGgynib1n1FqSUXVf9MIEDYypLCoaHfelz2dpxB1xLxthKyvWNfAC+pXWBaPA:/kFDb1iSOiCbec77Lr81NIpXWJV
MD5:	8951D263875C81386C4F8AEEBAF3D7E8
SHA1:	A3594EFD9ED810256FA3358F02408104F484F190
SHA-256:	FD2AFFCEE0218DD6F6F825FBC598BC46216B3D592B20321E3F1B2285E121FF67
SHA-512:	790B9045B52A4535F06BAFC62D121836FE9A99A190F3428499F3F93CBD21B2F8385F800C926877E2CD70CA4EAC4DB79207BA163FAE318615DC98CB106385B52D
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms512m -Xmx512m....SET SPLASH=./images/splash-vv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP% -splash:%SPLASH%....SET MAIN_CLASS=jp/co/furuno/vdr/app/VDRViewerApp

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\is-V6QLI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.5294881142662016
Encrypted:	false
SSDEEP:	3:dxMtiTsQmkVITsn:jMtiTsAVITsn
MD5:	935C59B9103671517B7C8C4F032E615A
SHA1:	4D06BB62C51534652A8B8C2E73B9BD935FDB8D9E
SHA-256:	6FE33FAAA98B8F7F3DED8EBE97278AA3208B95DE604F790BBC345C2AE5FB94FE
SHA-512:	97894B70BE89853FA410DE13D070E4B44203C5F3DEFA6A805818AAE308051FC003F52AA7C7F0CB4809A825594742C1ED7CA8BCB9B9760AFF2140CF16C36732E6
Malicious:	false
Preview:	LP:2450104-01.10-60..MV:2450105-01.10-60..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\lib\dooars-t.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	802608
Entropy (8bit):	7.9225120609642845
Encrypted:	false
SSDEEP:	12288:8302bdDItF4hn5TIafzhtMFYUMu7R/7bWZgJXXHBuNnNmRzJyOvEuTvZ:+KtF4jhtMF37R/vagJHhud85U7ud
MD5:	A217E2C4F7BFA712216223DF81B2E680
SHA1:	4D03152622BBA41BE3018392BD42E58F8DC9C6FA
SHA-256:	66DBC4FA34CA3608996BA504DA631B48E3AD42060B28345630CFD4FA1776A510
SHA-512:	A6AFD9A743920FC89BBB24D5E0801DE98A6CE422109BAE3B5C4655CAFA41B61833598A97590F1EF860AB50A169BBA200C5B371640DED5C2683093C7A8304AA01
Malicious:	false
Preview:	PK........T.:I................META-INF/....PK........S.:I...!Z...g.......META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.C.q,HL.HU...%-.x...R.KRSt.A.....Lu....4....sR......K..5y.x..PK........H.:I................dooars/PK........G.:I................dooars/app/PK........G.:I................dooars/applet/PK........G.:I................dooars/applet/infobus/PK........J.:I................dooars/beans/PK........H.:I................dooars/beans/ctrl/PK........J.:I................dooars/beans/furuno/PK........H.:I................dooars/beans/trend/PK........H.:I................dooars/beans/ts/PK........H.:I................dooars/bridge/PK........H.:I................dooars/development/PK........H.:I................dooars/event/PK........H.:I................dooars/event/app/PK........H.:I................dooars/factory/PK........H.:I................dooars/foundation/PK........H.:I................dooars/graphics/PK........G.:I................dooars/net/PK........H.:I................dooars/net/cli

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\lib\is-8LKUJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3123101
Entropy (8bit):	7.904963208019537
Encrypted:	false
SSDEEP:	49152:AsICHSSv6KBg8s8VXvVBPppBgbuiEzza8liJYxYMDcm53BeJFL6jk:dSSvlK8s8VXDpK9EzzaQFxe236F4k
MD5:	E2B73C2D35166C7B6E4CEB971C73BE41
SHA1:	44C41E6F8F184A799DD485DC5086892373466678
SHA-256:	D261B93BE17A819C6427C0ED95091CE15EEBE0B474226753B7679C39BA5F6AC5
SHA-512:	DBDEC5F5CCFB7C87625A263F160B85155A99B235EB4A1A6A2DD4A12BDEE90457397E54022498462605B7A18579683BE5A817DD0E78598D7CD24D3C17A09B5EF2
Malicious:	false
Preview:	PK........T.:I................META-INF/....PK........S.:I..'i............META-INF/MANIFEST.MFu.1..0...@....tHH..G..*..J.]%..$)1"".w..x.o=..8......X..j..@rAIn......!f....%..x`...p.KR....V^w...\|....Q2..K`ET2.<.M....%mQ......V2N..c&$..G...h....4.E[......]....7.s...A"d..m.]U0[.TS/.../..SB..PK........G.:I................jp/PK........J.:I................jp/co/PK........J.:I................jp/co/furuno/PK........S.:I................jp/co/furuno/vdr/PK........L.:I................jp/co/furuno/vdr/app/PK........L.:I................jp/co/furuno/vdr/conf/PK........L.:I............ ...jp/co/furuno/vdr/conf/component/PK........L.:I................jp/co/furuno/vdr/controller/PK........K.:I............$...jp/co/furuno/vdr/controller/extract/PK........L.:I............(...jp/co/furuno/vdr/controller/maintenance/PK........L.:I................jp/co/furuno/vdr/dataview/PK........M.:I................jp/co/furuno/vdr/debug/PK........M.:I................jp/co/furuno/vdr/decoder/PK........M.:I.............

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\lib\is-H9KK9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	802608
Entropy (8bit):	7.9225120609642845
Encrypted:	false
SSDEEP:	12288:8302bdDItF4hn5TIafzhtMFYUMu7R/7bWZgJXXHBuNnNmRzJyOvEuTvZ:+KtF4jhtMF37R/vagJHhud85U7ud
MD5:	A217E2C4F7BFA712216223DF81B2E680
SHA1:	4D03152622BBA41BE3018392BD42E58F8DC9C6FA
SHA-256:	66DBC4FA34CA3608996BA504DA631B48E3AD42060B28345630CFD4FA1776A510
SHA-512:	A6AFD9A743920FC89BBB24D5E0801DE98A6CE422109BAE3B5C4655CAFA41B61833598A97590F1EF860AB50A169BBA200C5B371640DED5C2683093C7A8304AA01
Malicious:	false
Preview:	PK........T.:I................META-INF/....PK........S.:I...!Z...g.......META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r.C.q,HL.HU...%-.x...R.KRSt.A.....Lu....4....sR......K..5y.x..PK........H.:I................dooars/PK........G.:I................dooars/app/PK........G.:I................dooars/applet/PK........G.:I................dooars/applet/infobus/PK........J.:I................dooars/beans/PK........H.:I................dooars/beans/ctrl/PK........J.:I................dooars/beans/furuno/PK........H.:I................dooars/beans/trend/PK........H.:I................dooars/beans/ts/PK........H.:I................dooars/bridge/PK........H.:I................dooars/development/PK........H.:I................dooars/event/PK........H.:I................dooars/event/app/PK........H.:I................dooars/factory/PK........H.:I................dooars/foundation/PK........H.:I................dooars/graphics/PK........G.:I................dooars/net/PK........H.:I................dooars/net/cli

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\lib\vdr-client.jar (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	3123101
Entropy (8bit):	7.904963208019537
Encrypted:	false
SSDEEP:	49152:AsICHSSv6KBg8s8VXvVBPppBgbuiEzza8liJYxYMDcm53BeJFL6jk:dSSvlK8s8VXDpK9EzzaQFxe236F4k
MD5:	E2B73C2D35166C7B6E4CEB971C73BE41
SHA1:	44C41E6F8F184A799DD485DC5086892373466678
SHA-256:	D261B93BE17A819C6427C0ED95091CE15EEBE0B474226753B7679C39BA5F6AC5
SHA-512:	DBDEC5F5CCFB7C87625A263F160B85155A99B235EB4A1A6A2DD4A12BDEE90457397E54022498462605B7A18579683BE5A817DD0E78598D7CD24D3C17A09B5EF2
Malicious:	false
Preview:	PK........T.:I................META-INF/....PK........S.:I..'i............META-INF/MANIFEST.MFu.1..0...@....tHH..G..*..J.]%..$)1"".w..x.o=..8......X..j..@rAIn......!f....%..x`...p.KR....V^w...\|....Q2..K`ET2.<.M....%mQ......V2N..c&$..G...h....4.E[......]....7.s...A"d..m.]U0[.TS/.../..SB..PK........G.:I................jp/PK........J.:I................jp/co/PK........J.:I................jp/co/furuno/PK........S.:I................jp/co/furuno/vdr/PK........L.:I................jp/co/furuno/vdr/app/PK........L.:I................jp/co/furuno/vdr/conf/PK........L.:I............ ...jp/co/furuno/vdr/conf/component/PK........L.:I................jp/co/furuno/vdr/controller/PK........K.:I............$...jp/co/furuno/vdr/controller/extract/PK........L.:I............(...jp/co/furuno/vdr/controller/maintenance/PK........L.:I................jp/co/furuno/vdr/dataview/PK........M.:I................jp/co/furuno/vdr/debug/PK........M.:I................jp/co/furuno/vdr/decoder/PK........M.:I.............

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\maintenance.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3730
Entropy (8bit):	4.889614411755457
Encrypted:	false
SSDEEP:	48:ysoAxUPoAk4rjwRQsag1i1kd7lMiRjM+dykGYz5JSa7e4gWyuJsDbjJr4+gTTWw8:inPoQMRQWwmlMGXP37e4uuJ4bjJ79
MD5:	EF3F917109AB48FE95B423C8261B823A
SHA1:	A081481E8C6BBE76108A74026E3440414B697A05
SHA-256:	979565AB78B93A5FE7D15A8EE01417B679BAF9273B07F733488AD7DC629000A1
SHA-512:	B0D31C7DA5B59A5C70BA8108D2ED928A5E44977974D13FE334F92468A2CFE6DD4E605331CEA350007557A10FA12FFAA466EBF4CF9EE37DF4605C254BDB773A21
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="VDR Maintenance Viewer V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)..endlocal....CALL vmv-env.bat....REM ############################################################..REM Checking installed JRE, or not...REM ##########################################

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\vdrviewer.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4502
Entropy (8bit):	5.153810388662076
Encrypted:	false
SSDEEP:	96:iJPoQMRQxwmlMGXP37e4iqZ/P1qVqC8KqyqRtPuJqbDx70:0MxU/3a4ia3k8RtuIvxA
MD5:	E5E7FD82A500BD50A2AEF6FA401877ED
SHA1:	D43AC5937FE4E39FBFEA0D11ABDCCCA6B2054974
SHA-256:	B9FABCDEDEAFD9FDA0763BF35EC4A836D1B29F58A6BAEDB7F04AE2026DE39575
SHA-512:	7148D32A486CCE27B4375600F25C6C7B7F206F6ACA01D5BC04E5EAAE545E7487FE616914D5E0BC1E9D5725812F9AF007029898DDAC33574AC3C1930369DBA636
Malicious:	false
Preview:	@ECHO OFF..REM ############################################################..REM Check : another version is running ?..REM ############################################################..setlocal ENABLEDELAYEDEXPANSION..set RESULT_TASKLIST=..set TASKNAME="Live Player V5"....REM TASKLIST..for /F "usebackq tokens=1" %%i in (`tasklist`) do (.. set RESULT_TASKLIST=!RESULT_TASKLIST!;%%i..)....REM find_task..if "%RESULT_TASKLIST%" NEQ "" (.. REM LivePlayer V4 is running ?.. call :find_task "liveplayerv4.exe" %TASKNAME% "Live Player V4".. if errorlevel 1 (.. endlocal.. goto EOF.. ).. .. REM MaintenanceViewer V4 is running ?.. call :find_task "maintenancev4.exe" %TASKNAME% "VDR Maintenance Viewer V4".. if errorlevel 1 (.. endlocal.. goto EOF.. )..)..endlocal....CALL vv-env.bat....REM ############################################################..REM Checking installed JRE, or not...REM ######################################################

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\version.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.5294881142662016
Encrypted:	false
SSDEEP:	3:dxMtiTsQmkVITsn:jMtiTsAVITsn
MD5:	935C59B9103671517B7C8C4F032E615A
SHA1:	4D06BB62C51534652A8B8C2E73B9BD935FDB8D9E
SHA-256:	6FE33FAAA98B8F7F3DED8EBE97278AA3208B95DE604F790BBC345C2AE5FB94FE
SHA-512:	97894B70BE89853FA410DE13D070E4B44203C5F3DEFA6A805818AAE308051FC003F52AA7C7F0CB4809A825594742C1ED7CA8BCB9B9760AFF2140CF16C36732E6
Malicious:	false
Preview:	LP:2450104-01.10-60..MV:2450105-01.10-60..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\vmv-env.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	215
Entropy (8bit):	5.45187981568043
Encrypted:	false
SSDEEP:	3:/qQKGgynib1nxFnUXVf9MIEDYy6L4Hfelz2dpxB1xLxthKyvWNfAC+pXWBadKOA/:/kFDb1jOx0ec77Lr81NIpXWOtWBQCvn
MD5:	4DB13C9E68F954038F1894482D35C7FF
SHA1:	57FF69D81501F8EC1F7185542BD6993406D7A019
SHA-256:	AC994746CEF8329FA585811DDA36A6C938A2BBA0C3A321472CDC1B0652B769C1
SHA-512:	97F45EC9FACC472DC9A6BD1D10E60109B148C3A9A445FBE966A269D5BD1B08A95E484740E143B9837660421EF66F409BF0CFF0F0F55CA0BE9619F1BEB27CC348
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms64m -Xmx512m....SET SPLASH=./images/splash-vmv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP% -splash:%SPLASH%....SET MAIN_CLASS=jp/co/furuno/vdr/app/MaintenanceViewerApp..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\Viewer\vv-env.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.46405281471386
Encrypted:	false
SSDEEP:	3:/qQKGgynib1n1FqSUXVf9MIEDYypLCoaHfelz2dpxB1xLxthKyvWNfAC+pXWBaPA:/kFDb1iSOiCbec77Lr81NIpXWJV
MD5:	8951D263875C81386C4F8AEEBAF3D7E8
SHA1:	A3594EFD9ED810256FA3358F02408104F484F190
SHA-256:	FD2AFFCEE0218DD6F6F825FBC598BC46216B3D592B20321E3F1B2285E121FF67
SHA-512:	790B9045B52A4535F06BAFC62D121836FE9A99A190F3428499F3F93CBD21B2F8385F800C926877E2CD70CA4EAC4DB79207BA163FAE318615DC98CB106385B52D
Malicious:	false
Preview:	@ECHO OFF..call env.bat....SET HEAP=-Xms512m -Xmx512m....SET SPLASH=./images/splash-vv.png....SET JVM_OPTION=%JVM_DEFAULT_OPTION% %HEAP% -splash:%SPLASH%....SET MAIN_CLASS=jp/co/furuno/vdr/app/VDRViewerApp

C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRAVCtrlJNI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	409600
Entropy (8bit):	5.801713181991892
Encrypted:	false
SSDEEP:	3072:1TFyQkn5bNLi/E+cUwEmxMcKGSumBzFBD7iYDkBTRFndQPugnIft6A4hjW:1xwbX1UwDneZBDWckBtvgId8a
MD5:	42069D18F1BA168943EBDCEC036CC048
SHA1:	6786D8B1E2A80C7D9AA96F864E284F2FFD752CC6
SHA-256:	BF92CDA3AA7580533C556FE24FD92AC583660C03F6CF8B9C28A7C17B7514CC50
SHA-512:	88A64039F4F9AD4706E1D5671112582B13F4ABCC278A081552B9478EA8469A65EB5BADDA780053ABBA70C88EDD5C848845CFE0BAECE912E320E820F2596BE50D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0..0..0.....0..{...0..[...0..b?..0.....0...../0...FS.0..0...0......0.....0.....0.....0..Rich.0..................PE..L......W...........!.....p...........G.......................................p.......................................o..........,.... .......................0.../......................................@............................................text....i.......p.................. ..`.rdata..............................@..@.data....x.......P..................@....idata..D........ ..................@....rsrc........ ......................@..@.reloc..Q6...0...@..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\VDRTransRtp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.501689591810636
Encrypted:	false
SSDEEP:	768:wuWX6ZY7Dsl0lKVnUxHuQuIIsYHJ2TlixPXVth:w7XMY7DzlKVnUDIsYcMxNt
MD5:	E03F1FF95E5F5E470B60B98CF8DABA7E
SHA1:	5FF6B61CB323F6F2EC9F1BAEF64B4574CF0955A3
SHA-256:	B18D1CAD6EC5E7FC416CE61BB0C2D8F5ADB7645C5C378FD9D66EBB77057A9429
SHA-512:	0B8D2F24896032C8DD9C52F521A5555DF7A18516C0E6F464C41E4776238269C6F67F9E09FEABE82276B306F175E830BA0722156C16D1D031343939456D1652FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..H...H...H...3...H...5...H...&...H...I...H.U.....H...%...H...2...H...0...H.Rich..H.........................PE..L......W...........!.........`.......#..............................................VQ..............................P..........d...............................P......................................@...............4............................text....p.......................... ..`.rdata...!.......0..................@..@.data...d...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-M5B6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	409600
Entropy (8bit):	5.801713181991892
Encrypted:	false
SSDEEP:	3072:1TFyQkn5bNLi/E+cUwEmxMcKGSumBzFBD7iYDkBTRFndQPugnIft6A4hjW:1xwbX1UwDneZBDWckBtvgId8a
MD5:	42069D18F1BA168943EBDCEC036CC048
SHA1:	6786D8B1E2A80C7D9AA96F864E284F2FFD752CC6
SHA-256:	BF92CDA3AA7580533C556FE24FD92AC583660C03F6CF8B9C28A7C17B7514CC50
SHA-512:	88A64039F4F9AD4706E1D5671112582B13F4ABCC278A081552B9478EA8469A65EB5BADDA780053ABBA70C88EDD5C848845CFE0BAECE912E320E820F2596BE50D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0..0..0.....0..{...0..[...0..b?..0.....0...../0...FS.0..0...0......0.....0.....0.....0..Rich.0..................PE..L......W...........!.....p...........G.......................................p.......................................o..........,.... .......................0.../......................................@............................................text....i.......p.................. ..`.rdata..............................@..@.data....x.......P..................@....idata..D........ ..................@....rsrc........ ......................@..@.reloc..Q6...0...@..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\dlls\is-N0LRV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.501689591810636
Encrypted:	false
SSDEEP:	768:wuWX6ZY7Dsl0lKVnUxHuQuIIsYHJ2TlixPXVth:w7XMY7DzlKVnUDIsYcMxNt
MD5:	E03F1FF95E5F5E470B60B98CF8DABA7E
SHA1:	5FF6B61CB323F6F2EC9F1BAEF64B4574CF0955A3
SHA-256:	B18D1CAD6EC5E7FC416CE61BB0C2D8F5ADB7645C5C378FD9D66EBB77057A9429
SHA-512:	0B8D2F24896032C8DD9C52F521A5555DF7A18516C0E6F464C41E4776238269C6F67F9E09FEABE82276B306F175E830BA0722156C16D1D031343939456D1652FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..H...H...H...3...H...5...H...&...H...I...H.U.....H...%...H...2...H...0...H.Rich..H.........................PE..L......W...........!.........`.......#..............................................VQ..............................P..........d...............................P......................................@...............4............................text....p.......................... ..`.rdata...!.......0..................@..@.data...d...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\clientrecorder.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1015808
Entropy (8bit):	6.542088089476902
Encrypted:	false
SSDEEP:	24576:/uZfNaOvT/8d/N1ZW288dB6rO+ckntq7BuiDW18q:mZl7/8ZZX88qvntq7U18q
MD5:	694FABF3B683D8B48946A9010903BF4F
SHA1:	70431D1952CAD3A4810C69F283B6D784934A26B6
SHA-256:	EF1E34D0A3C21A4F3C73DE5BB54A191A8D59F7E79BF1A8BDDA24FC69C3E59462
SHA-512:	5883F19D57F83818FD053D53C328475FB59CA27391C1DF17DA055545A85EC650A0D879244B5C337F4BCB0DD3F89C9B61D796E2DD71A3352DA2891C8521AA131E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3...]..]..].1.#..].. ..].e....]..\.7.]..0.F.]..3.).]..%..].Rich..].........PE..L...~..W.................P... .......?.......`....@.......................... ......F.......................................T...P...................................................................._..@............`..8............................text....J.......P.................. ..`.rdata.......`.......`..............@..@.data...............................@....rsrc................p..............@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\extclient.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1994752
Entropy (8bit):	6.5767709678262625
Encrypted:	false
SSDEEP:	49152:O64ScMTAtw5VznPH1mv5o+nEdlj4dY4Bnxv2T8vt:t4T05BnPwClj4L
MD5:	58748E8DF83A2C846B8F464B01CC0118
SHA1:	BEB296D4B64390835AF88C424B105BF80BB1F53A
SHA-256:	E3FF6D40FE1F54289D14D0E1294032C96E6BE5623C2563AB2DC0E5227A58D5D7
SHA-512:	D0AFD02A38CA0BA5934751337510823430C12DA9F958AA7DAF8646D271F1EAB83F63B35B03BBEF0B87524D511677B72ACF2C182DB94C9BADBECF2F5685F459A7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K.Wg..94..94..94.wG4..94(uD44.94.Y4..94(uB4..94.d4..94..84.94(uT4..94(uW4.94(uC4..94(uA4..94Rich..94........PE..L...I..W..........................................@........................... ......\..............................`.../............. ................................................................@............................................text............................... ..`.rdata..............................@..@.data....&..........................@....rsrc......... ......`..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-0RDV0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.412353247213706
Encrypted:	false
SSDEEP:	3:Lj8eMddg/VKOEY5FXG4cYrKOEYT5gCVKOEY+MAgX2o9RAtuKPQ1WeXOWCMA2weU:xqOFECtFrEw5tFErMAT8RAE1T/A2weU
MD5:	AEB505A807428E687161DB5CD96AC83B
SHA1:	E07531E8D436D54EA21EFC8673648A3F6A025B1F
SHA-256:	DD7E7D78AD421467002BFC621A329FEAF77232F645B812B8B772DDA83483E3A8
SHA-512:	9F3AED43E9470852E355E436EE271EF87DBE3D98507891CC2617AABB0D86DEA34F1C7300A9F07124414FE8A7252F9FFDF1A3F95C1B814508868E2E25CABEAE2F
Malicious:	false
Preview:	start "extclient" extclient.exe -cons -debug -v..start "rcplayer" rcplayer.exe -cons -debug -v..start "rserv" rserv.exe -cons -debug -v..start "clientRecorder" clientrecorder.exe -cons -ftpuser furuno -ftppass furuno -debug 0x10000

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-8706V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1994752
Entropy (8bit):	6.5767709678262625
Encrypted:	false
SSDEEP:	49152:O64ScMTAtw5VznPH1mv5o+nEdlj4dY4Bnxv2T8vt:t4T05BnPwClj4L
MD5:	58748E8DF83A2C846B8F464B01CC0118
SHA1:	BEB296D4B64390835AF88C424B105BF80BB1F53A
SHA-256:	E3FF6D40FE1F54289D14D0E1294032C96E6BE5623C2563AB2DC0E5227A58D5D7
SHA-512:	D0AFD02A38CA0BA5934751337510823430C12DA9F958AA7DAF8646D271F1EAB83F63B35B03BBEF0B87524D511677B72ACF2C182DB94C9BADBECF2F5685F459A7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K.Wg..94..94..94.wG4..94(uD44.94.Y4..94(uB4..94.d4..94..84.94(uT4..94(uW4.94(uC4..94(uA4..94Rich..94........PE..L...I..W..........................................@........................... ......\..............................`.../............. ................................................................@............................................text............................... ..`.rdata..............................@..@.data....&..........................@....rsrc......... ......`..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-895CV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376256
Entropy (8bit):	6.541448938044473
Encrypted:	false
SSDEEP:	24576:gDPltY1cK4WVGbTN0cGNPDeDFRcTHbgm1du4mbQbrD3lfkWJSzp8M73OG/A7w:qg4WVaN0De4Hbgm1du4mMbfRY8yO2
MD5:	47A4639E254BA052F7973598BEACBB15
SHA1:	CFD85CC4FF9C9A195CC1BAF6F29A7F38A27E95E4
SHA-256:	BA0DC61505E41CE5844911C287F22DD391AF6502001A0D68FBD9D5B153FCD2FD
SHA-512:	C11203E9C055405E26BD16F85319A082229D0532FA0A2E4D2CD70EDE42E0C18888E76763119041FB694596CC7326ED9FE53D0DCA50B737BD6DF3AB8574AD5E2E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......iwQZ-.?.-.?.-.?...A. .?...B...?...D.%.?...b.*.?.-.>...?...R...?...Q...?...G.,.?.Rich-.?.........PE..L......W..........................................@.................................,.......................................@@......................................@...............................Xy..@............................................text............................... ..`.rdata...=.......@..................@..@.data...<....P.......P..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-OUSS8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	626688
Entropy (8bit):	6.4899024529004095
Encrypted:	false
SSDEEP:	12288:vtKx5rGeD5xjBtWWQjNLn561AsnfYX40bauCWXlVJ9hEyaBRXMqBNFddvDNu6wUk:VKx5KixjBtW7aBhJu6wEz+wC
MD5:	FC11049AA47FE838672FB367BAD0D795
SHA1:	BF953775C98B99D882CFEEE9E07FB2C3E583B718
SHA-256:	616D9E377C723EB03681B118A5F76AF3D99B69FDAAD72EAF3FEC3F9421E48908
SHA-512:	DD35836261449361D57FBB46505EFCAC4DD3FFFC5251D153E0B1AC2B4657629413F7FB91389477F5CD245DAF1D5883348FC78A22358B10F76FC4AF4766CF054F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.@._.@._.@..U>.S.@.xW=.~.@.....X.@._.A..@.xW-...@.xW..%.@.xW8.^.@.Rich_.@.................PE..L......W................. ...`......r,.......0....@..........................0.......i..........................................P.... ..............................................................x...@............0...............................text............ .................. ..`.rdata.......0.......0..............@..@.data...............................@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\is-VDN2J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1015808
Entropy (8bit):	6.542088089476902
Encrypted:	false
SSDEEP:	24576:/uZfNaOvT/8d/N1ZW288dB6rO+ckntq7BuiDW18q:mZl7/8ZZX88qvntq7U18q
MD5:	694FABF3B683D8B48946A9010903BF4F
SHA1:	70431D1952CAD3A4810C69F283B6D784934A26B6
SHA-256:	EF1E34D0A3C21A4F3C73DE5BB54A191A8D59F7E79BF1A8BDDA24FC69C3E59462
SHA-512:	5883F19D57F83818FD053D53C328475FB59CA27391C1DF17DA055545A85EC650A0D879244B5C337F4BCB0DD3F89C9B61D796E2DD71A3352DA2891C8521AA131E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3...]..]..].1.#..].. ..].e....]..\.7.]..0.F.]..3.).]..%..].Rich..].........PE..L...~..W.................P... .......?.......`....@.......................... ......F.......................................T...P...................................................................._..@............`..8............................text....J.......P.................. ..`.rdata.......`.......`..............@..@.data...............................@....rsrc................p..............@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\rcplayer.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376256
Entropy (8bit):	6.541448938044473
Encrypted:	false
SSDEEP:	24576:gDPltY1cK4WVGbTN0cGNPDeDFRcTHbgm1du4mbQbrD3lfkWJSzp8M73OG/A7w:qg4WVaN0De4Hbgm1du4mMbfRY8yO2
MD5:	47A4639E254BA052F7973598BEACBB15
SHA1:	CFD85CC4FF9C9A195CC1BAF6F29A7F38A27E95E4
SHA-256:	BA0DC61505E41CE5844911C287F22DD391AF6502001A0D68FBD9D5B153FCD2FD
SHA-512:	C11203E9C055405E26BD16F85319A082229D0532FA0A2E4D2CD70EDE42E0C18888E76763119041FB694596CC7326ED9FE53D0DCA50B737BD6DF3AB8574AD5E2E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......iwQZ-.?.-.?.-.?...A. .?...B...?...D.%.?...b.*.?.-.>...?...R...?...Q...?...G.,.?.Rich-.?.........PE..L......W..........................................@.................................,.......................................@@......................................@...............................Xy..@............................................text............................... ..`.rdata...=.......@..................@..@.data...<....P.......P..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\rserv.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	626688
Entropy (8bit):	6.4899024529004095
Encrypted:	false
SSDEEP:	12288:vtKx5rGeD5xjBtWWQjNLn561AsnfYX40bauCWXlVJ9hEyaBRXMqBNFddvDNu6wUk:VKx5KixjBtW7aBhJu6wEz+wC
MD5:	FC11049AA47FE838672FB367BAD0D795
SHA1:	BF953775C98B99D882CFEEE9E07FB2C3E583B718
SHA-256:	616D9E377C723EB03681B118A5F76AF3D99B69FDAAD72EAF3FEC3F9421E48908
SHA-512:	DD35836261449361D57FBB46505EFCAC4DD3FFFC5251D153E0B1AC2B4657629413F7FB91389477F5CD245DAF1D5883348FC78A22358B10F76FC4AF4766CF054F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.@._.@._.@..U>.S.@.xW=.~.@.....X.@._.A..@.xW-...@.xW..%.@.xW8.^.@.Rich_.@.................PE..L......W................. ...`......r,.......0....@..........................0.......i..........................................P.... ..............................................................x...@............0...............................text............ .................. ..`.rdata.......0.......0..............@..@.data...............................@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\bin\server.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.412353247213706
Encrypted:	false
SSDEEP:	3:Lj8eMddg/VKOEY5FXG4cYrKOEYT5gCVKOEY+MAgX2o9RAtuKPQ1WeXOWCMA2weU:xqOFECtFrEw5tFErMAT8RAE1T/A2weU
MD5:	AEB505A807428E687161DB5CD96AC83B
SHA1:	E07531E8D436D54EA21EFC8673648A3F6A025B1F
SHA-256:	DD7E7D78AD421467002BFC621A329FEAF77232F645B812B8B772DDA83483E3A8
SHA-512:	9F3AED43E9470852E355E436EE271EF87DBE3D98507891CC2617AABB0D86DEA34F1C7300A9F07124414FE8A7252F9FFDF1A3F95C1B814508868E2E25CABEAE2F
Malicious:	false
Preview:	start "extclient" extclient.exe -cons -debug -v..start "rcplayer" rcplayer.exe -cons -debug -v..start "rserv" rserv.exe -cons -debug -v..start "clientRecorder" clientrecorder.exe -cons -ftpuser furuno -ftppass furuno -debug 0x10000

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\class.def (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8284
Entropy (8bit):	4.729859635270701
Encrypted:	false
SSDEEP:	96:VbktJ5HxbUT5vWut15TcfPZArafJPpqy61Olp7ApNPCj0FI+1+Xy0/+xgYq8CPnu:VylxbUT/t1VcfbfZpBZp8xFI+OrU5hH
MD5:	F8C16F29C1E96B7FD1E62AE3B1E4135A
SHA1:	CD269FC31600DD2427EF845AE880029444D238D6
SHA-256:	1A656186A9CDD883D275BA9230B6C76CDE49E546E5B64B90EB325E1E2F23976D
SHA-512:	26CE20B8788348F0467E45A61BB63A7666B653D9FC2A8197BB4D0F7EFE3C70F320A52DB3E3275A419A97A044AC1F0574EC65BE0D6262C81BE4949C2CA1FF245F
Malicious:	false
Preview:	# generated date: Mon Nov 25 10:39:31 2013..e openclose_t 1..v 0 \|open..v 1 \|close..e onoff_t 2..v 0 \|off..v 1 \|on..e power_status_t 3..v 0 \|green..v 1 \|yellow..v 2 \|red..e save_button_t 4..v 0 \|lighting..v 1 \|lights-out..v 2 \|blinking..e normal_button_t 5..v 0 \|lighting..v 1 \|lights-out..e error_button_t 6..v 0 \|green..v 1 \|blinking-in-red..v 2 \|red..e power_type_t 7..v 1 \|AC..v 2 \|DC..v 3 \|BATT..e land_mark_type_t 8..v 0 \|unknown..v 1 \|Input Device..v 2 \|Terminal Board Ether..v 3 \|Junction Box..v 4 \|Audio Board..v 5 \|MIC..v 6 \|Video LAN Converter..v 7 \|Radar..v 8 \|Terminal Board..v 9 \|Serial Input..v 10 \|Analog..v 11 \|Digital..v 12 \|Alarm..v 13 \|Power Status..v 14 \|System Status..v 15 \|VHF..v 16 \|Sentence..v 17 \|Process..v 18 \|Config Status..v 19 \|Sensor(LAN) Input..v 20 \|AMS Input..e internal_value_type_t 9..v 0 \|unknown..v 1 \|Power Trigger..v 2 \|Current Value..v 3 \|Test Value..v 4 \|Test Result..v 5 \|Capture Resolution (H)..v 6 \|Capture Resolution (V)..v 7 \|Capture Size..v 8 \|Diag R

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\class.desc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13583
Entropy (8bit):	5.054705498950709
Encrypted:	false
SSDEEP:	96:WxPp6HuGAnQmO3JmyJpmPZcOuKTHymp32ml5Kdt4BleMkhkNu171FtAi8lr2U35A:unOoyUOAHyUG05KzgleFhP1bJ+Zs
MD5:	E172D06A1ED7FDCE7EA3E1AC7E39E3DC
SHA1:	494A1A1A69E351DCC1AAC2DF3760169D7A294FC5
SHA-256:	4C6D681D865592B77CD25CBC83D2AF2235425C0EC14B66A0BD44B262511514CD
SHA-512:	15FBBEF5933FEE3E8AABA3B73EF5E7F55BA88089630E9EAF79CF538F3A70CC2DCFDE07345F94A27E55E875364EC420B27A0CB3DE1A25A0D06A3D8110A446C1C0
Malicious:	false
Preview:	# 1 "class.cpp"..# 1 "<built-in>"..# 1 "<command-line>"..# 1 "class.cpp"..# 10 "class.cpp"..enum openclose_t {.. {0,"open"},.. {1,"close"},..};..enum onoff_t {.. {0,"off"},.. {1,"on"},..};..enum power_status_t {.. {0,"green"},.. {1,"yellow"},.. {2,"red"},..};..enum save_button_t {.. {0,"lighting"},.. {1,"lights-out"},.. {2,"blinking"},..};..enum normal_button_t {.. {0,"lighting"},.. {1,"lights-out"},..};..enum error_button_t {.. {0,"green"},.. {1,"blinking-in-red"},.. {2,"red"},..};..enum power_type_t {.. {1,"AC"},.. {2,"DC"},.. {3,"BATT"},..};....enum land_mark_type_t..{.. {0, "unknown"},.. {1, "Input Device"},.. {2, "Terminal Board Ether"},.. {3, "Junction Box"},.. {4, "Audio Board"},.. {5, "MIC"},.. {6, "Video LAN Converter"},.. {7, "Radar"},.. {8, "Terminal Board"},.. {9, "Serial Input"},.. {10,"Analog"},.. {11,"Digital"},.. {12,"Alarm"},.. {13,"Power Status"},.. {14,"System Status"

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\is-4NLRS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8284
Entropy (8bit):	4.729859635270701
Encrypted:	false
SSDEEP:	96:VbktJ5HxbUT5vWut15TcfPZArafJPpqy61Olp7ApNPCj0FI+1+Xy0/+xgYq8CPnu:VylxbUT/t1VcfbfZpBZp8xFI+OrU5hH
MD5:	F8C16F29C1E96B7FD1E62AE3B1E4135A
SHA1:	CD269FC31600DD2427EF845AE880029444D238D6
SHA-256:	1A656186A9CDD883D275BA9230B6C76CDE49E546E5B64B90EB325E1E2F23976D
SHA-512:	26CE20B8788348F0467E45A61BB63A7666B653D9FC2A8197BB4D0F7EFE3C70F320A52DB3E3275A419A97A044AC1F0574EC65BE0D6262C81BE4949C2CA1FF245F
Malicious:	false
Preview:	# generated date: Mon Nov 25 10:39:31 2013..e openclose_t 1..v 0 \|open..v 1 \|close..e onoff_t 2..v 0 \|off..v 1 \|on..e power_status_t 3..v 0 \|green..v 1 \|yellow..v 2 \|red..e save_button_t 4..v 0 \|lighting..v 1 \|lights-out..v 2 \|blinking..e normal_button_t 5..v 0 \|lighting..v 1 \|lights-out..e error_button_t 6..v 0 \|green..v 1 \|blinking-in-red..v 2 \|red..e power_type_t 7..v 1 \|AC..v 2 \|DC..v 3 \|BATT..e land_mark_type_t 8..v 0 \|unknown..v 1 \|Input Device..v 2 \|Terminal Board Ether..v 3 \|Junction Box..v 4 \|Audio Board..v 5 \|MIC..v 6 \|Video LAN Converter..v 7 \|Radar..v 8 \|Terminal Board..v 9 \|Serial Input..v 10 \|Analog..v 11 \|Digital..v 12 \|Alarm..v 13 \|Power Status..v 14 \|System Status..v 15 \|VHF..v 16 \|Sentence..v 17 \|Process..v 18 \|Config Status..v 19 \|Sensor(LAN) Input..v 20 \|AMS Input..e internal_value_type_t 9..v 0 \|unknown..v 1 \|Power Trigger..v 2 \|Current Value..v 3 \|Test Value..v 4 \|Test Result..v 5 \|Capture Resolution (H)..v 6 \|Capture Resolution (V)..v 7 \|Capture Size..v 8 \|Diag R

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\is-H8243.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	3.983068315890039
Encrypted:	false
SSDEEP:	3:TR29QKB3JU25xecgXsGXR1fCaAOgqJEF/FFJcVM9YdRT64MbvyZuFcqkwOKDeNFR:o9fBqG/gcifNJENhklTBmVc1dVEUn
MD5:	D5BE99A24E4FA518C483C54427DCB976
SHA1:	F8DD2C1A9646CAB3F67813049C74114A06802F6B
SHA-256:	779717057FF3FB7D74E07B6C1A5A72B91923AB9660486299B24AE22716A04E88
SHA-512:	F0AFD27F8925AE2240EB3D5AEAD36B75D1B6E20F9E4AFCAC22239BAADB70E87A5BBD26CC3D457E04086A18D7DE33C7F8F641F7B9F8DF99129214D3B00B2F2EF5
Malicious:	false
Preview:	#.name.type.port..modelserv.1.24001..crntserv 3 15000..logger..4.10020..ioserv..5.12001....rcplayer 1005 10105..extclient 1007 10107..extserv 1006 10106....sysinfo 9 0..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\is-O5R50.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.373072583790819
Encrypted:	false
SSDEEP:	6:n/MW//Did+V6jMHeBLNmAIQ1dGJeMei1AxRADyT/A2weE:n0G4+V67B51Bi18RHdweE
MD5:	7EE712690E3411FBF100507CEC19B98A
SHA1:	676B5597FF93C5A6842D4C516172F4E14BF65B06
SHA-256:	E62A38B9E3A29CF5B2B6B9F1358AF18C5CBB576B43E11608CD17A7F9F9C99045
SHA-512:	B5AC2F42FCF7E5137D0818B9C58D3BB744D99CCAF422FF3D8CE0628F69B1F01F72B86EB7712528763BCD4FE0E22609F8E2F8EFC3F226F51962155BBFEC4B9E8F
Malicious:	false
Preview:	#..# type procname command & args..#..respawn rserv rserv -debug 0x10000..respawn rcplayer rcplayer -debug 0x10000 -timeStamp 112:0x100001:10..respawn extclient extclient -debug 0x10000..respawn clientrecorder clientrecorder -ftpuser furuno -ftppass furuno -debug 0x10000 -v..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\is-RJNLK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	680
Entropy (8bit):	4.162406236493623
Encrypted:	false
SSDEEP:	12:i+bTVheO/OI9WD33V0+PO7I4vjh+SQic0+n:i+bTD9+i1Qm+n
MD5:	DB551FA8DC64E8B58619D7D0E142F638
SHA1:	46FC47809B3AF871928E69C0CA14981EA90BB2A6
SHA-256:	4790F553AFA3E6AEF151A7C3C36EDD700A33D2C02311261CFF5D459AB258C8EA
SHA-512:	010AD9B84E78A1950A430BE45AEF3876F99B787568949D6139DCD586ADF6F65FF1834809061AE311531F85A8CAC0C28029F0DB85107C0CE090E8A2D2378079AB
Malicious:	false
Preview:	# id.type.priority [systemid].ip:port.or file..ip:port.or file..1.modelserv.0.1.localhost..2.logger..0.1.localhost:10020..1.crntserv.0.1.localhost:15000..51.ioserv .0.1.localhost:12001....15 rcplayer 0 1 localhost:10105..16 extserv 0 1 10.0.0.100:10106..17 extclient 0 1 localhost:10107......#1.modelserv.0.1.localhost..#2.logger..0.1.localhost:10020..#1.crntserv.0.1.localhost:15000..#51.ioserv .0.1.localhost:12001....#15 rcplayer 0 1 localhost:10105..#16 extserv 0 1 10.160.155.164:10106..#17 extclient 0 1 localhost:10107......

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\is-S01OG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13583
Entropy (8bit):	5.054705498950709
Encrypted:	false
SSDEEP:	96:WxPp6HuGAnQmO3JmyJpmPZcOuKTHymp32ml5Kdt4BleMkhkNu171FtAi8lr2U35A:unOoyUOAHyUG05KzgleFhP1bJ+Zs
MD5:	E172D06A1ED7FDCE7EA3E1AC7E39E3DC
SHA1:	494A1A1A69E351DCC1AAC2DF3760169D7A294FC5
SHA-256:	4C6D681D865592B77CD25CBC83D2AF2235425C0EC14B66A0BD44B262511514CD
SHA-512:	15FBBEF5933FEE3E8AABA3B73EF5E7F55BA88089630E9EAF79CF538F3A70CC2DCFDE07345F94A27E55E875364EC420B27A0CB3DE1A25A0D06A3D8110A446C1C0
Malicious:	false
Preview:	# 1 "class.cpp"..# 1 "<built-in>"..# 1 "<command-line>"..# 1 "class.cpp"..# 10 "class.cpp"..enum openclose_t {.. {0,"open"},.. {1,"close"},..};..enum onoff_t {.. {0,"off"},.. {1,"on"},..};..enum power_status_t {.. {0,"green"},.. {1,"yellow"},.. {2,"red"},..};..enum save_button_t {.. {0,"lighting"},.. {1,"lights-out"},.. {2,"blinking"},..};..enum normal_button_t {.. {0,"lighting"},.. {1,"lights-out"},..};..enum error_button_t {.. {0,"green"},.. {1,"blinking-in-red"},.. {2,"red"},..};..enum power_type_t {.. {1,"AC"},.. {2,"DC"},.. {3,"BATT"},..};....enum land_mark_type_t..{.. {0, "unknown"},.. {1, "Input Device"},.. {2, "Terminal Board Ether"},.. {3, "Junction Box"},.. {4, "Audio Board"},.. {5, "MIC"},.. {6, "Video LAN Converter"},.. {7, "Radar"},.. {8, "Terminal Board"},.. {9, "Serial Input"},.. {10,"Analog"},.. {11,"Digital"},.. {12,"Alarm"},.. {13,"Power Status"},.. {14,"System Status"

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\minit.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.373072583790819
Encrypted:	false
SSDEEP:	6:n/MW//Did+V6jMHeBLNmAIQ1dGJeMei1AxRADyT/A2weE:n0G4+V67B51Bi18RHdweE
MD5:	7EE712690E3411FBF100507CEC19B98A
SHA1:	676B5597FF93C5A6842D4C516172F4E14BF65B06
SHA-256:	E62A38B9E3A29CF5B2B6B9F1358AF18C5CBB576B43E11608CD17A7F9F9C99045
SHA-512:	B5AC2F42FCF7E5137D0818B9C58D3BB744D99CCAF422FF3D8CE0628F69B1F01F72B86EB7712528763BCD4FE0E22609F8E2F8EFC3F226F51962155BBFEC4B9E8F
Malicious:	false
Preview:	#..# type procname command & args..#..respawn rserv rserv -debug 0x10000..respawn rcplayer rcplayer -debug 0x10000 -timeStamp 112:0x100001:10..respawn extclient extclient -debug 0x10000..respawn clientrecorder clientrecorder -ftpuser furuno -ftppass furuno -debug 0x10000 -v..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\serv.def (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	680
Entropy (8bit):	4.162406236493623
Encrypted:	false
SSDEEP:	12:i+bTVheO/OI9WD33V0+PO7I4vjh+SQic0+n:i+bTD9+i1Qm+n
MD5:	DB551FA8DC64E8B58619D7D0E142F638
SHA1:	46FC47809B3AF871928E69C0CA14981EA90BB2A6
SHA-256:	4790F553AFA3E6AEF151A7C3C36EDD700A33D2C02311261CFF5D459AB258C8EA
SHA-512:	010AD9B84E78A1950A430BE45AEF3876F99B787568949D6139DCD586ADF6F65FF1834809061AE311531F85A8CAC0C28029F0DB85107C0CE090E8A2D2378079AB
Malicious:	false
Preview:	# id.type.priority [systemid].ip:port.or file..ip:port.or file..1.modelserv.0.1.localhost..2.logger..0.1.localhost:10020..1.crntserv.0.1.localhost:15000..51.ioserv .0.1.localhost:12001....15 rcplayer 0 1 localhost:10105..16 extserv 0 1 10.0.0.100:10106..17 extclient 0 1 localhost:10107......#1.modelserv.0.1.localhost..#2.logger..0.1.localhost:10020..#1.crntserv.0.1.localhost:15000..#51.ioserv .0.1.localhost:12001....#15 rcplayer 0 1 localhost:10105..#16 extserv 0 1 10.160.155.164:10106..#17 extclient 0 1 localhost:10107......

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\etc\services.def (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	3.983068315890039
Encrypted:	false
SSDEEP:	3:TR29QKB3JU25xecgXsGXR1fCaAOgqJEF/FFJcVM9YdRT64MbvyZuFcqkwOKDeNFR:o9fBqG/gcifNJENhklTBmVc1dVEUn
MD5:	D5BE99A24E4FA518C483C54427DCB976
SHA1:	F8DD2C1A9646CAB3F67813049C74114A06802F6B
SHA-256:	779717057FF3FB7D74E07B6C1A5A72B91923AB9660486299B24AE22716A04E88
SHA-512:	F0AFD27F8925AE2240EB3D5AEAD36B75D1B6E20F9E4AFCAC22239BAADB70E87A5BBD26CC3D457E04086A18D7DE33C7F8F641F7B9F8DF99129214D3B00B2F2EF5
Malicious:	false
Preview:	#.name.type.port..modelserv.1.24001..crntserv 3 15000..logger..4.10020..ioserv..5.12001....rcplayer 1005 10105..extclient 1007 10107..extserv 1006 10106....sysinfo 9 0..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\onlndb\Config.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Generic INItialization configuration [extract]
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.80778433711678
Encrypted:	false
SSDEEP:	6:NyyYcpR3SzEhyM+3fTysQCEQDRepk/eov:NyyH9yM+bysLmiv
MD5:	D6BC4F1AC2504B94C3E0F7F18288DB8E
SHA1:	286E500342A29FCFAC1AA03D1A289626DC56D740
SHA-256:	C6D088D6ACA44724184C10A9CF21E6CF1FE1B864AB72FB925895F8413F9261AD
SHA-512:	05A2C8FC9369B65A0BBAEA5E742FF9049B88DBBAEECAF1B83A4B1437C46598262BDE7FFC5B8070E6A09718E6AA7F571BAAA920F58011B2B853FA9CF139BCBB06
Malicious:	false
Preview:	[ftp]..user = 38da5b219dd4e064;..pass = 38da5b219dd4e064;....[extract]..restore = /opt/vr/data/restore;....[drucapa]..capacity = 30000;....[audio]..startOffset = 4600..deliveryCount = 1;..;startOffset = 7488..;startOffset = 9504..; -4896..;startOffset = 4608..;..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\onlndb\equipment.db (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	data
Category:	dropped
Size (bytes):	59552
Entropy (8bit):	4.816391877928976
Encrypted:	false
SSDEEP:	768:0mHS0+rz2TejyzzIpeFc7aTrHUav4RrvUkIjXxCKTByE:0mHN+3uzIpc2FUkIjhCYyE
MD5:	E85C37F0C35F9E5CB79F34B4C89F8230
SHA1:	B05491E3550D16D82C7FFCB392A19C84C516B26F
SHA-256:	21C15C60379DDBCE2F8F34CEC708333B0DA1C5252D68D778B2DDFDAC0FEFC6ED
SHA-512:	ED8DA62FE74F603B1DA1649990B296A2C716FAE5E76C5B045D9BA371F75ED4965D4572E61039AB2F2E1AB47EC25681799C5F88742DAB11C1659410271D98E0A2
Malicious:	false
Preview:	.VC./2.W....(...(...........8\..........K...........n...................n...................n...................n...........!.......n...........).......n...........1.......n...........9.......n...........A.......n...........I.......n...........Q.......n...........Y.......n...........a.......n...........i.......n...........q.......n...........y.......n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n... ...............n...!...............n..."...............n...#...............n...$.......!.......n...%.......).......n...&.......1.......n...'.......9.......n...(.......A.......n...).......I.......n...*.......Q.......n...+.......Y.......n...,.......a.......n...-.......i.......n...........q.......n.../.......y.......n...0...

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\onlndb\is-5CEC9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	259711
Entropy (8bit):	4.807591821628971
Encrypted:	false
SSDEEP:	6144:P05EdHv11NzvZpLxxLXzVL8qXRCdVijVz3hxJrj9lgWD9njTBbNvHOz6H4URnrKU:Apk
MD5:	8909E6E59564D5AE4195409041BF1024
SHA1:	5BFB002E750E6F3BB04A2092DB061A591AF53DE7
SHA-256:	7BB5DC973415394A4E11D4DD8B7F6B7EED8B35305B9E4E18134D74EA345EE9A6
SHA-512:	CF8F0BE00E240432BAE56C98AA34769FE1C3CEE7BAE1D913A6F7CBDB119CFBFD38EB94EAC686CEC94C56E5C99944ECDDEB938506A87041EBE5BB56967CE85E67
Malicious:	false
Preview:	@i 0 5 0 0 0 276 840 0 0 476 1294 1002 33 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100001 13 4\|\|\|0\|\|\|DRU:Device Num:Fixed DRU.5 3 202 0x100001 14 4\|\|\|0\|\|\|DRU:Round Trip:Fixed DRU.5 4 202 0x100001 15 4\|\|\|0\|\|\|DRU:Index:Fixed DRU.5 5 202 0x100001 16 4\|\|\|0\|\|\|DRU:Restart Counter:Fixed DRU.5 6 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 7 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 8 202 0x100002 13 4\|\|\|0\|\|\|DRU:Device Num:Float DRU.5 9 202 0x100002 14 4\|\|\|0\|\|\|DRU:Round Trip:Float DRU.5 10 202 0x100002 15 4\|\|\|0\|\|\|DRU:Index:Float DRU.5 11 202 0x100002 16 4\|\|\|0\|\|\|DRU:Restart Counter:Float DRU.5 12 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Lon

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\onlndb\is-9FNGT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	data
Category:	dropped
Size (bytes):	59552
Entropy (8bit):	4.816391877928976
Encrypted:	false
SSDEEP:	768:0mHS0+rz2TejyzzIpeFc7aTrHUav4RrvUkIjXxCKTByE:0mHN+3uzIpc2FUkIjhCYyE
MD5:	E85C37F0C35F9E5CB79F34B4C89F8230
SHA1:	B05491E3550D16D82C7FFCB392A19C84C516B26F
SHA-256:	21C15C60379DDBCE2F8F34CEC708333B0DA1C5252D68D778B2DDFDAC0FEFC6ED
SHA-512:	ED8DA62FE74F603B1DA1649990B296A2C716FAE5E76C5B045D9BA371F75ED4965D4572E61039AB2F2E1AB47EC25681799C5F88742DAB11C1659410271D98E0A2
Malicious:	false
Preview:	.VC./2.W....(...(...........8\..........K...........n...................n...................n...................n...........!.......n...........).......n...........1.......n...........9.......n...........A.......n...........I.......n...........Q.......n...........Y.......n...........a.......n...........i.......n...........q.......n...........y.......n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n... ...............n...!...............n..."...............n...#...............n...$.......!.......n...%.......).......n...&.......1.......n...'.......9.......n...(.......A.......n...).......I.......n...*.......Q.......n...+.......Y.......n...,.......a.......n...-.......i.......n...........q.......n.../.......y.......n...0...

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\onlndb\is-M2VSD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	60020
Entropy (8bit):	4.676548497004412
Encrypted:	false
SSDEEP:	1536:DwdHuAW61Np1wn0ZyGLOSxLlxzVL8qX7Muee:sdHv11Nzw0ZpLOSxLlxzVL8qXQuee
MD5:	80C955F3552F5E99085A6FB215893A1F
SHA1:	F8360E7AC1739AC98FFF06CBF9CEB9A75860397D
SHA-256:	A7A3AA964D1677182E304569C95E3D8153B29A840C04343A632203AC139C4A57
SHA-512:	3674C323177CDADEB15A787C4AC5138D35768BB7083A2EF52F18972B1B2F991ADAD0B23FD8D6BB9EFF0A178F116B6080F2D2B6F5DC41667682AC63C0AEFD8292
Malicious:	false
Preview:	@i 0 5 0 0 0 6 778 0 0 0 0 182 2 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 3 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 4 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Long Term Device.5 5 203 0x100001 12 4\|\|\|0\|\|\|HDD:SIZE:Long Term Device.6 0 110 0x100001 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH001.6 1 110 0x100002 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH002.6 2 110 0x100003 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH003.6 3 110 0x100004 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH004.6 4 110 0x100005 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH005.6 5 110 0x100006 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH006.6 6 110 0x100007 1 4\|\|\|0\|\|

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\onlndb\is-UR9KM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Generic INItialization configuration [extract]
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.80778433711678
Encrypted:	false
SSDEEP:	6:NyyYcpR3SzEhyM+3fTysQCEQDRepk/eov:NyyH9yM+bysLmiv
MD5:	D6BC4F1AC2504B94C3E0F7F18288DB8E
SHA1:	286E500342A29FCFAC1AA03D1A289626DC56D740
SHA-256:	C6D088D6ACA44724184C10A9CF21E6CF1FE1B864AB72FB925895F8413F9261AD
SHA-512:	05A2C8FC9369B65A0BBAEA5E742FF9049B88DBBAEECAF1B83A4B1437C46598262BDE7FFC5B8070E6A09718E6AA7F571BAAA920F58011B2B853FA9CF139BCBB06
Malicious:	false
Preview:	[ftp]..user = 38da5b219dd4e064;..pass = 38da5b219dd4e064;....[extract]..restore = /opt/vr/data/restore;....[drucapa]..capacity = 30000;....[audio]..startOffset = 4600..deliveryCount = 1;..;startOffset = 7488..;startOffset = 9504..; -4896..;startOffset = 4608..;..

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\onlndb\monattr.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	259711
Entropy (8bit):	4.807591821628971
Encrypted:	false
SSDEEP:	6144:P05EdHv11NzvZpLxxLXzVL8qXRCdVijVz3hxJrj9lgWD9njTBbNvHOz6H4URnrKU:Apk
MD5:	8909E6E59564D5AE4195409041BF1024
SHA1:	5BFB002E750E6F3BB04A2092DB061A591AF53DE7
SHA-256:	7BB5DC973415394A4E11D4DD8B7F6B7EED8B35305B9E4E18134D74EA345EE9A6
SHA-512:	CF8F0BE00E240432BAE56C98AA34769FE1C3CEE7BAE1D913A6F7CBDB119CFBFD38EB94EAC686CEC94C56E5C99944ECDDEB938506A87041EBE5BB56967CE85E67
Malicious:	false
Preview:	@i 0 5 0 0 0 276 840 0 0 476 1294 1002 33 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100001 13 4\|\|\|0\|\|\|DRU:Device Num:Fixed DRU.5 3 202 0x100001 14 4\|\|\|0\|\|\|DRU:Round Trip:Fixed DRU.5 4 202 0x100001 15 4\|\|\|0\|\|\|DRU:Index:Fixed DRU.5 5 202 0x100001 16 4\|\|\|0\|\|\|DRU:Restart Counter:Fixed DRU.5 6 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 7 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 8 202 0x100002 13 4\|\|\|0\|\|\|DRU:Device Num:Float DRU.5 9 202 0x100002 14 4\|\|\|0\|\|\|DRU:Round Trip:Float DRU.5 10 202 0x100002 15 4\|\|\|0\|\|\|DRU:Index:Float DRU.5 11 202 0x100002 16 4\|\|\|0\|\|\|DRU:Restart Counter:Float DRU.5 12 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Lon

C:\Program Files (x86)\FURUNO\VR-7000\_previous\server\data\onlndb\sporadic.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	60020
Entropy (8bit):	4.676548497004412
Encrypted:	false
SSDEEP:	1536:DwdHuAW61Np1wn0ZyGLOSxLlxzVL8qX7Muee:sdHv11Nzw0ZpLOSxLlxzVL8qXQuee
MD5:	80C955F3552F5E99085A6FB215893A1F
SHA1:	F8360E7AC1739AC98FFF06CBF9CEB9A75860397D
SHA-256:	A7A3AA964D1677182E304569C95E3D8153B29A840C04343A632203AC139C4A57
SHA-512:	3674C323177CDADEB15A787C4AC5138D35768BB7083A2EF52F18972B1B2F991ADAD0B23FD8D6BB9EFF0A178F116B6080F2D2B6F5DC41667682AC63C0AEFD8292
Malicious:	false
Preview:	@i 0 5 0 0 0 6 778 0 0 0 0 182 2 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 3 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 4 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Long Term Device.5 5 203 0x100001 12 4\|\|\|0\|\|\|HDD:SIZE:Long Term Device.6 0 110 0x100001 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH001.6 1 110 0x100002 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH002.6 2 110 0x100003 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH003.6 3 110 0x100004 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH004.6 4 110 0x100005 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH005.6 5 110 0x100006 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH006.6 6 110 0x100007 1 4\|\|\|0\|\|

C:\Program Files (x86)\FURUNO\VR-7000\common\data\audio_header.ogg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Ogg data, Vorbis audio, stereo, 16000 Hz, ~49000 bps
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	6.452558893988802
Encrypted:	false
SSDEEP:	24:O4i6xqlWeLva6v41DTxnTUWM3/4KSCdv9v4IEdNwlFACjXcZ:O471DeWM3/4PIEDwlVsZ
MD5:	AF56A60EB782D1AEB2DCA370D99EB1CA
SHA1:	7351D598846F1A4BF301DE3FF5598967A35BCE02
SHA-256:	B84693BF333AE83F26D496404EFDE8AFD63F90FA1920385E9C498D7650145FB0
SHA-512:	7F28C73DBD70DDD7E4F05DC2EF00AE72321875B20B7A2EBDCC019EB05BBAF09D511581FEF4E5EBC4FF4DAD53EE535291EFF0FD5644058F78C5E8CF9196FA2030
Malicious:	false
Preview:	OggS..........xV4.....Y..d...vorbis......>......h.........OggS..........xV4.....)..;.8.vorbis....VLSI Solution Oy........ENCODER=VS1053 v1.70.OggS..........xV4.......;j.......vorbis.BCV..@..&I.$I.$I.$I.,.,.,.,.4M.4M.4M.4M.4M.4M.4M.4M..U.....EQ..q.I.$.,M.4..<Q.E.4MUUU.u]Y.e.m].u..}a..a.. 4d.....`Q..q.G.$.,K.4..<O.E.4MSUU.u]W.e.m[.u..}_..a..!..Y.....X.Eq..$I.,..4M.<..EQ4M.TUUu].eY.m..u].}...a..a.BCV..@...EQ..q$I.,.4M.<..DQ.M.4UUU].ueY.m.u].}...a..a.....@.....<..<.<.<..<.<..<...<....,..<..<..<..<..<..,..<..<..<O..@...@..Rh.J. ...f9.f9..I..H..H..Y.'..`... ...Qh.J. ...fY.ei.eI..Y..H.eI..H.eI.dY.eY..i.eY.&..p... .........x...i..(..8..i...........2Tv....4d.....`....u.e.UU..E..4.$.Q.Eq.I.,M.<Q4MUu]Y.m].}_..........V.@...8.DY..y.H....L....P...<.T]..}.X....\...........p..i..i..i..i..i..i..i..i..)..i..i..i..(..i..i..i..%..i..i..(Z.%..i..i..eY.(..i..(..%X.(..i..(..e..h..i..(..(..i..i..(..h..i..i..(..i..i..i..h..i..i..i..i..i..i..i..i..i..N.p..~..!Ce....BCV.....^.UUUUUUU].

C:\Program Files (x86)\FURUNO\VR-7000\common\data\audio_header_dcu.ogg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Ogg data, Vorbis audio, stereo, 16000 Hz, ~88000 bps, created by: Xiph.Org libVorbis I (1.3.3)
Category:	dropped
Size (bytes):	3452
Entropy (8bit):	6.96239029258027
Encrypted:	false
SSDEEP:	96:uYLvSatuKPak5RuUPpspcqHPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPCxchMIIat:jrtoKPdvpOAGXIi
MD5:	3FAC012E171C4635C32B8F1B57E0369D
SHA1:	B951E466318D413614A3AC8CDA342F890DF0E2E4
SHA-256:	4CD997A8AD4A9013723CFA897E3CB75BBD35278C2B7789435A8F01449956A4AA
SHA-512:	A442D4E0D81D3A35C04F5320962FA31D2E5A80D418C67307A4B22FB3A5518E70D3FA3D24F423B45ED4A5DEBBADD0B80F09C3C86D326B45BC1EB4B403B55E3475
Malicious:	false
Preview:	OggS...........z7M..........vorbis......>.......W........OggS...........z7M....Ly...h.vorbis+...Xiph.Org libVorbis I 20120203 (Omnipresent)....)...ENCODER=VDRAudioStreamConverter(libMedia).OggS...........z7M....^.I................vorbis$BCV..@...B...c.:..!....B.)..B.!.$C.:.5..cG.d.B..U..@....WPrI-.s..W.q. .s. g.q.%.s.9.r.1.s..W.r)-.s..G.q...s..G.q...sm1..r.9.s. .Rr.5.s..g.r.%.s. g.q. .s.5..r.9.s.9.s.9.s.1.s.9.sn1..s.9.s.9..s.9.s 4d.......(..(..........@q.G..K....$...Y.........H..H..X.fi.&z.(....i.,........H..PQ..p....Y..d...`(..8..X..Y.............P.G..M.$..<..<..<..<..<..<..<...Y.. ....(d..BCV..@...!..C.R.\..B..C.B.C....).%c.S.A.!\|.=..{..U.....a.8...$.!.b.'Dq. .!..$X.y.$...B..{...{ 4d...... ..B.!..B.)..RH)..b.)..s.1. ..2.N:..N:.$..Rk)..SL...c...s.A)c.1..c.1..c.1..#..Y........d.A.!..RH)..r.1...BCV..........ER$Gr$G.$.,I.<.<.<M.DM.U.Um..m_.m..e..e..e].e.m].]].u].u].u].u].u]..U.......8..8..H..H.............8..H..X.%Y.&i.gy..y....................(..

C:\Program Files (x86)\FURUNO\VR-7000\common\data\is-TPI3C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Ogg data, Vorbis audio, stereo, 16000 Hz, ~49000 bps
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	6.452558893988802
Encrypted:	false
SSDEEP:	24:O4i6xqlWeLva6v41DTxnTUWM3/4KSCdv9v4IEdNwlFACjXcZ:O471DeWM3/4PIEDwlVsZ
MD5:	AF56A60EB782D1AEB2DCA370D99EB1CA
SHA1:	7351D598846F1A4BF301DE3FF5598967A35BCE02
SHA-256:	B84693BF333AE83F26D496404EFDE8AFD63F90FA1920385E9C498D7650145FB0
SHA-512:	7F28C73DBD70DDD7E4F05DC2EF00AE72321875B20B7A2EBDCC019EB05BBAF09D511581FEF4E5EBC4FF4DAD53EE535291EFF0FD5644058F78C5E8CF9196FA2030
Malicious:	false
Preview:	OggS..........xV4.....Y..d...vorbis......>......h.........OggS..........xV4.....)..;.8.vorbis....VLSI Solution Oy........ENCODER=VS1053 v1.70.OggS..........xV4.......;j.......vorbis.BCV..@..&I.$I.$I.$I.,.,.,.,.4M.4M.4M.4M.4M.4M.4M.4M..U.....EQ..q.I.$.,M.4..<Q.E.4MUUU.u]Y.e.m].u..}a..a.. 4d.....`Q..q.G.$.,K.4..<O.E.4MSUU.u]W.e.m[.u..}_..a..!..Y.....X.Eq..$I.,..4M.<..EQ4M.TUUu].eY.m..u].}...a..a.BCV..@...EQ..q$I.,.4M.<..DQ.M.4UUU].ueY.m.u].}...a..a.....@.....<..<.<.<..<.<..<...<....,..<..<..<..<..<..,..<..<..<O..@...@..Rh.J. ...f9.f9..I..H..H..Y.'..`... ...Qh.J. ...fY.ei.eI..Y..H.eI..H.eI.dY.eY..i.eY.&..p... .........x...i..(..8..i...........2Tv....4d.....`....u.e.UU..E..4.$.Q.Eq.I.,M.<Q4MUu]Y.m].}_..........V.@...8.DY..y.H....L....P...<.T]..}.X....\...........p..i..i..i..i..i..i..i..i..)..i..i..i..(..i..i..i..%..i..i..(Z.%..i..i..eY.(..i..(..%X.(..i..(..e..h..i..(..(..i..i..(..h..i..i..(..i..i..i..h..i..i..i..i..i..i..i..i..i..N.p..~..!Ce....BCV.....^.UUUUUUU].

C:\Program Files (x86)\FURUNO\VR-7000\common\data\is-UALOB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Ogg data, Vorbis audio, stereo, 16000 Hz, ~88000 bps, created by: Xiph.Org libVorbis I (1.3.3)
Category:	dropped
Size (bytes):	3452
Entropy (8bit):	6.96239029258027
Encrypted:	false
SSDEEP:	96:uYLvSatuKPak5RuUPpspcqHPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPCxchMIIat:jrtoKPdvpOAGXIi
MD5:	3FAC012E171C4635C32B8F1B57E0369D
SHA1:	B951E466318D413614A3AC8CDA342F890DF0E2E4
SHA-256:	4CD997A8AD4A9013723CFA897E3CB75BBD35278C2B7789435A8F01449956A4AA
SHA-512:	A442D4E0D81D3A35C04F5320962FA31D2E5A80D418C67307A4B22FB3A5518E70D3FA3D24F423B45ED4A5DEBBADD0B80F09C3C86D326B45BC1EB4B403B55E3475
Malicious:	false
Preview:	OggS...........z7M..........vorbis......>.......W........OggS...........z7M....Ly...h.vorbis+...Xiph.Org libVorbis I 20120203 (Omnipresent)....)...ENCODER=VDRAudioStreamConverter(libMedia).OggS...........z7M....^.I................vorbis$BCV..@...B...c.:..!....B.)..B.!.$C.:.5..cG.d.B..U..@....WPrI-.s..W.q. .s. g.q.%.s.9.r.1.s..W.r)-.s..G.q...s..G.q...sm1..r.9.s. .Rr.5.s..g.r.%.s. g.q. .s.5..r.9.s.9.s.9.s.1.s.9.sn1..s.9.s.9..s.9.s 4d.......(..(..........@q.G..K....$...Y.........H..H..X.fi.&z.(....i.,........H..PQ..p....Y..d...`(..8..X..Y.............P.G..M.$..<..<..<..<..<..<..<...Y.. ....(d..BCV..@...!..C.R.\..B..C.B.C....).%c.S.A.!\|.=..{..U.....a.8...$.!.b.'Dq. .!..$X.y.$...B..{...{ 4d...... ..B.!..B.)..RH)..b.)..s.1. ..2.N:..N:.$..Rk)..SL...c...s.A)c.1..c.1..c.1..#..Y........d.A.!..RH)..r.1...BCV..........ER$Gr$G.$.,I.<.<.<M.DM.U.Um..m_.m..e..e..e].e.m].]].u].u].u].u].u]..U.......8..8..H..H.............8..H..X.%Y.&i.gy..y....................(..

C:\Program Files (x86)\FURUNO\VR-7000\dlls\AisLibraryJNI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	593920
Entropy (8bit):	6.219272600977045
Encrypted:	false
SSDEEP:	12288:JXiLIjfMfkrmJ0EPZP72BkxSq8KfJrAXLyQSGY:piL6mJ0EPd75S6r
MD5:	E8D9F7F3100CC1617CC4C0D2A192CC65
SHA1:	CA5B510749F0D046A1769A73DE7B785A53087AA0
SHA-256:	F221F3F7F3097653CB6122422723DEF7DF1FB3E35E1C55880944405D5FC4DB68
SHA-512:	F62FA17108D0CC915A435D3B004EF3F54F4CC8731830D7139AC427B7F082A23E8A616B04FED70985487ACCFC2A1282D3F182F1A0EECFFD6F5CFA1DC105B200BA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.q....I...I...I.&aI...I2$bI#..I...I...I..BI...I2$rI...I2$qI...I2$eI...I2$gI...IRich...I........PE..L......b...........!.........P.......1....................................... ..........................................r.......(....p..........................xI.................................. ...@...............t............................text............................... ..`.rdata..RN.......P..................@..@.data....].......P..................@....rsrc........p.......`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\NmeaDecodeJNI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	573440
Entropy (8bit):	6.233175890219993
Encrypted:	false
SSDEEP:	12288:mshe8YKefkefSPD9fY7zVPHkDq8KfJrAXLyQSGF:mMe8gfSb9wPC6r
MD5:	A55645F58E32DD30D21D28AD0D4BCDB8
SHA1:	68245D0ED0D950A78B5EEC04D54029E895AE2590
SHA-256:	0F6A0FBB9A4B80F7465DB8F9133883F37E1E4767B889F2A89FB87F1956087EAC
SHA-512:	25D649E8034A3481DB67295F19759E923D8B64137EC00963412B3A54899936447D3F7C041E315E643E96443EFBCCECFAAE7D08976CC15F72C191F80089511D5D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........' ..Is..Is..IsjZ7s.Is.X4s.Is..Hso.Is>..s..Is.X$s%.Is.X'sn.Is.X3s..Is.X1s..IsRich..Is........PE..L......b...........!......... .......1..............................................)...................................=.......(............................ ...@..................................h...@...............t............................text...V........................... ..`.rdata..-=.......@..................@..@.data...X(.......@..................@....rsrc................ ..............@..@.reloc....... .......0..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\TVRSocket.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.234515699739443
Encrypted:	false
SSDEEP:	1536:+KwF/uZnd+l07TjdghAQ4dYMqLcBrtXt:bd++qYepcBrtXt
MD5:	DDB8AB034F46DD12361E0BAF09F58E9C
SHA1:	8470B31D10299B367D3C1DB225153FACEE41E2EF
SHA-256:	52451F4DB95E02463F27A5B93C213D13776EAF6856E36BE4595CBF38F7AFECAB
SHA-512:	B40A24E5D226035B0AF8F36DAE9D6F21F6E811136BAC5F00B0B6818A7568988103D7C782983DFEF7137419519EEA674F84EDF106D7FD925BE49BB7DE0EF01D4C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.k.k...k.k.k...k.k.k..k..k...k&..k..k.k.k...k.k.k..k.k.k..k.k.k..kRich..k................PE..L......J...........!.........p.......6....................................... .......;......................................T...d...................................................................`...@...............x............................text...d........................... ..`.rdata..X".......0..................@..@.data...............................@....rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\TVRThread.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.486829962298087
Encrypted:	false
SSDEEP:	768:cGX3DM7IcGTHT3SB2cND8M5rh1RbLVYfxN//+BQ/2:cMQ7bEHTzh4vbLu/+BQu
MD5:	423E1D328703F43E25A869B740C075EC
SHA1:	72A2CB247432F92B7D69DA858C892199EB29FD66
SHA-256:	74076D82326DE8A5E8C3A9445C3840B5D93DFE689960C17B72AD568FD0979710
SHA-512:	81A0FE3D6C73BECC8244BC9C900A3E6E869E5C02A5AB62B16F15A92A5E48BA1CCFE15466E552BB043D8262D6D87F9D0D1DC0240976643A9ECFF6FCE46F814F5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7-W{sL9(sL9(sL9(T.D(bL9(T.W(jL9(.Cd(vL9(sL8($L9(T.T(9L9(T.C(rL9(T.E(rL9(T.A(rL9(RichsL9(................PE..L...7..J...........!.........P.......$....................................... ......U-..............................P...Z.......<.......:.......................`.......................................@...............,............................text....u.......................... ..`.rdata........... ..................@..@.data....L..........................@....rsrc...:...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\TVRTrace.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.224612666656956
Encrypted:	false
SSDEEP:	768:Msa6BbqLbf8gOCJfzVbvYhC1ZiBuJHM5VtyZWU:M6BMTRtvMCSmHMt+WU
MD5:	34EE2255C994924E192466BC4FE409E9
SHA1:	61CB7F6A6E5850F7FCAD26910F5C1015CE9041CF
SHA-256:	1717EEC862F0AC755BA9604A92537331CB3CDD4879CEA7F48B91ACB5BA66ECA5
SHA-512:	8661FCAE057635E8029247B54770FFC75DF3CC93568A5F3FE69BAD41BA506D0C465CDEE5749E7A2029376F9CE9EF90153BB3BDFF6CA1AC7A27E7E1B7BBF151E9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U..W.it..it..it.6....it.6....it.6....it..vg..it..f)..it..iu.qit.6...Zit.6....it.6....it.6....it.Rich.it.........PE..L......J...........!.........`......9$..............................................^I......................................$...x.......n.......................\...................................8...@...............X............................text....t.......................... ..`.rdata... .......0..................@..@.data...............................@....rsrc...n...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\UTSecureLayer.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.193484192480897
Encrypted:	false
SSDEEP:	1536:ds1LrnH0yUHjq+8aKKtnIMfA8HYfDBgO6KxR/ybqiTfpNk1telXIPx:0r3ujq+8aKQn1GueCputwXW
MD5:	B921E0D4C6B7E4F117B8C499DCB69135
SHA1:	BD84F51E7BF7DFAFB4206053430A2BB84FA5E34A
SHA-256:	16A4700694D0AFE763708598F91B2751550832152935681A94284A61A6F6F769
SHA-512:	1A58D9A27E6BD446232B78EEF311B834BF65C3FA4EB3D13DE96D36AD079AC9A380A549D2381DC4362FB16A4B545D7BF8ECE1D0960C8581F754618F7E6DE15738
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8.r/\|..\|\|..\|\|..\|.Lb\|}..\|[Na\|j..\|[Nq\|...\|..C\|}..\|..A\|q..\|\|..\|...\|[Nr\|7..\|[Nf\|}..\|[Nd\|}..\|Rich\|..\|........PE..L......b...........!.....@..........6........P...............................0......................................p.......$...........................................................................@............P...............................text...\|9.......@.................. ..`.rdata..U`...P...p...P..............@..@.data...`1....... ..................@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\VDRAVCtrlJNI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	405504
Entropy (8bit):	5.780562511553602
Encrypted:	false
SSDEEP:	3072:j2UJUIPtaqPHX/mh0GVLLiabBQSOrtKZ52+TT1ZyAHgx0baEIVv1eSTnxHs3tStc:jLXmLVVbBQSSE9AEICegl2v
MD5:	F0BA0BAEAFE8D485FCF8F23C60745DD0
SHA1:	A365B8231D98088EA7B2F807CA1AA2FB8C0D5A2A
SHA-256:	E32C740D1ADD0D9556BE1E37E9B23BB34E1CACECAE7C537189843F2A17FF4675
SHA-512:	2EB4A1917DD503A40F07D2A01B5C50CAB328A8E6908B8D4820DAFE2A7DB2B9C35A087950887DF976E1429C37B29DEA6223C01EB2BBC04919947829AA9D4CEE6C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rNO.6/!.6/!.6/!...Z.:/!.YY..7/!.?W..4/!.. \|.</!...\.(/!...L../!.....3/!.6/ ../!...O.g/!...[.7/!...].7/!...Y.7/!.Rich6/!.........................PE..L......b...........!.....p..........&J.......................................`.......................................b..j.......,............................ .../......................................@............................................text....h.......p.................. ..`.rdata..............................@..@.data...4z...p...P...p..............@....idata..D........ ..................@....rsrc...............................@..@.reloc..W6... ...@..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\VDRTransRtp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.737327475219662
Encrypted:	false
SSDEEP:	768:Zk45EBOzZiCBbnHIZR+/VYuou0fPr9vBYZe+VtuYu:Zr5+OsvAarJgHtuYu
MD5:	54232CC07D353267275B3A536557970A
SHA1:	292FDE8EBADC83CF056B4987487EF202354C51B8
SHA-256:	C939943F693110C4737FA251CADA6A801651E5A4DEA8E4A841EECE6053B5B9E8
SHA-512:	65FD70EEBF2795DDE2BB65C33270FAC18C85F65FA26F0B9707ED12D917DB06C380391F56F202E5E8F0D178B1961A83F0F8E9BC1CF00280E2341B512C5215E520
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..H...H...H...3...H...5...H...&...H...I...H.U.....H...%...H...2...H...0...H.Rich..H.........................PE..L...k..b...........!.....p...`.......#.............................................................................. ...........d...............................<.......................................@...............0............................text....o.......p.................. ..`.rdata... .......0..................@..@.data...D...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\confirmDialog.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.234368795782389
Encrypted:	false
SSDEEP:	6144:INEPA98Jl2mbYTUQb8aou/7Gj04cyBkuEg1u:h3bYYQb8aouTl4n3g
MD5:	916C8F533D67DA5E590C5B3818643683
SHA1:	86E30CFA2AD14448B863C758E41304C663E61B9C
SHA-256:	FE14610F67B451502A1E716BFF3BBAC6C493D5DE0ECAE4148C749B080DEEBC9C
SHA-512:	EAE6A8577C2A7FF058CE3465E0E34A02822461241C0A5A7CB6195C30B429066033BE88D11AD02781BEE3336572BB64881BE580E8056DE704C83D23C87DFEE02B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\..B..................................?Q......?Q......?Q......?Q......?Q......Rich....................PE..L...H..b................. ...P...............0....@.................................*....................................................=..............................................................@............0..8.......@....................text...t........ .................. ..`.rdata..4....0.......0..............@..@.data...\|d.......0..................@....rsrc....=.......@...@..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-2397E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	593920
Entropy (8bit):	6.219272600977045
Encrypted:	false
SSDEEP:	12288:JXiLIjfMfkrmJ0EPZP72BkxSq8KfJrAXLyQSGY:piL6mJ0EPd75S6r
MD5:	E8D9F7F3100CC1617CC4C0D2A192CC65
SHA1:	CA5B510749F0D046A1769A73DE7B785A53087AA0
SHA-256:	F221F3F7F3097653CB6122422723DEF7DF1FB3E35E1C55880944405D5FC4DB68
SHA-512:	F62FA17108D0CC915A435D3B004EF3F54F4CC8731830D7139AC427B7F082A23E8A616B04FED70985487ACCFC2A1282D3F182F1A0EECFFD6F5CFA1DC105B200BA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.q....I...I...I.&aI...I2$bI#..I...I...I..BI...I2$rI...I2$qI...I2$eI...I2$gI...IRich...I........PE..L......b...........!.........P.......1....................................... ..........................................r.......(....p..........................xI.................................. ...@...............t............................text............................... ..`.rdata..RN.......P..................@..@.data....].......P..................@....rsrc........p.......`..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-3H48C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.401050257504742
Encrypted:	false
SSDEEP:	6144:6xYeTPHmTueSd40p8U3zjhG53A41svaez6D7yNbeebjrUoJ5fWIwvDXMTBo5OWV:6xYeTPH28d40p8U3zjE53A4MfzGUbeKu
MD5:	DFBFB1D1C3ED06713E56E55E7CADAEE7
SHA1:	5FF05A6A404D9558BD85EB52ADFC8B7D5E63A59A
SHA-256:	0C7ECE4AB807996A5D52E5008E0C1E1B1BDEBF33B9C2288739F7241945D0710F
SHA-512:	E67624E55DB70AA5264B0A0C93E8FBA713C9A6A6B09C056DBA454FBB7BE9600408422BB7B4366E802D13A0E9AE598C64F9DF81C478567BAD16DCD5044BB414D5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..Oa...a...a.......g.....\|.......m.......g...g...k.......f.......d...a.....W.....W...v.......`.......`...Richa...........PE..L....Q.a...........!................a$...................................................................................... ...<....@..p....................P..t0...................................................................................text............................... ..`.rdata..............................@..@.data....z.......p..................@....rsrc...p....@.......0..............@..@.reloc...8...P...@...@..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-5HDDL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	405504
Entropy (8bit):	5.780562511553602
Encrypted:	false
SSDEEP:	3072:j2UJUIPtaqPHX/mh0GVLLiabBQSOrtKZ52+TT1ZyAHgx0baEIVv1eSTnxHs3tStc:jLXmLVVbBQSSE9AEICegl2v
MD5:	F0BA0BAEAFE8D485FCF8F23C60745DD0
SHA1:	A365B8231D98088EA7B2F807CA1AA2FB8C0D5A2A
SHA-256:	E32C740D1ADD0D9556BE1E37E9B23BB34E1CACECAE7C537189843F2A17FF4675
SHA-512:	2EB4A1917DD503A40F07D2A01B5C50CAB328A8E6908B8D4820DAFE2A7DB2B9C35A087950887DF976E1429C37B29DEA6223C01EB2BBC04919947829AA9D4CEE6C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rNO.6/!.6/!.6/!...Z.:/!.YY..7/!.?W..4/!.. \|.</!...\.(/!...L../!.....3/!.6/ ../!...O.g/!...[.7/!...].7/!...Y.7/!.Rich6/!.........................PE..L......b...........!.....p..........&J.......................................`.......................................b..j.......,............................ .../......................................@............................................text....h.......p.................. ..`.rdata..............................@..@.data...4z...p...P...p..............@....idata..D........ ..................@....rsrc...............................@..@.reloc..W6... ...@..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-5ROI4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.234368795782389
Encrypted:	false
SSDEEP:	6144:INEPA98Jl2mbYTUQb8aou/7Gj04cyBkuEg1u:h3bYYQb8aouTl4n3g
MD5:	916C8F533D67DA5E590C5B3818643683
SHA1:	86E30CFA2AD14448B863C758E41304C663E61B9C
SHA-256:	FE14610F67B451502A1E716BFF3BBAC6C493D5DE0ECAE4148C749B080DEEBC9C
SHA-512:	EAE6A8577C2A7FF058CE3465E0E34A02822461241C0A5A7CB6195C30B429066033BE88D11AD02781BEE3336572BB64881BE580E8056DE704C83D23C87DFEE02B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\..B..................................?Q......?Q......?Q......?Q......?Q......Rich....................PE..L...H..b................. ...P...............0....@.................................*....................................................=..............................................................@............0..8.......@....................text...t........ .................. ..`.rdata..4....0.......0..............@..@.data...\|d.......0..................@....rsrc....=.......@...@..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-6L83T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1722880
Entropy (8bit):	2.607191566647403
Encrypted:	false
SSDEEP:	3072:u45PRUFnXYswu5gNCdiVwHHlS0btoCBrbK6ESzIlMR0IAQQhWfPXXbmzAg0Fum1v:ukRWXSPVwnlS6flnR0cWAOm13M
MD5:	A5CE62769B0B85B37805A47D9C40C338
SHA1:	C8F350BCECD05AD0048C59BD9DB1A6017510A52D
SHA-256:	7B36FDAA75540831754C0826D35EFD12B3FC15BDC74F6EC248DA4DCAFAD20709
SHA-512:	3643DFF86096E8D5A7BB1E46015284F822399C91C38B1B84EBFF9AB76D30796AA94980F0574CCF06C2BD447CEA0E4483AF80BF5648CB9A452E7E5AC89E229C2C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V..S7j.S7j.S7j.t...O7j.t...z7j.t...07j.87.Q7j.t...P7j.S7k..7j.t...F7j.t...R7j.t...R7j.RichS7j.........PE..L...a..b...........!.....@...........&.......P..............................................................................t...<....0.......................@.../..................................`...@............P..$............................text...;>.......@.................. ..`.rdata......P.......D..............@..@.data...d#..........................@....rsrc........0......................@..@.reloc...=...@...>..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-96783.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.486829962298087
Encrypted:	false
SSDEEP:	768:cGX3DM7IcGTHT3SB2cND8M5rh1RbLVYfxN//+BQ/2:cMQ7bEHTzh4vbLu/+BQu
MD5:	423E1D328703F43E25A869B740C075EC
SHA1:	72A2CB247432F92B7D69DA858C892199EB29FD66
SHA-256:	74076D82326DE8A5E8C3A9445C3840B5D93DFE689960C17B72AD568FD0979710
SHA-512:	81A0FE3D6C73BECC8244BC9C900A3E6E869E5C02A5AB62B16F15A92A5E48BA1CCFE15466E552BB043D8262D6D87F9D0D1DC0240976643A9ECFF6FCE46F814F5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7-W{sL9(sL9(sL9(T.D(bL9(T.W(jL9(.Cd(vL9(sL8($L9(T.T(9L9(T.C(rL9(T.E(rL9(T.A(rL9(RichsL9(................PE..L...7..J...........!.........P.......$....................................... ......U-..............................P...Z.......<.......:.......................`.......................................@...............,............................text....u.......................... ..`.rdata........... ..................@..@.data....L..........................@....rsrc...:...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-9JE74.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.234515699739443
Encrypted:	false
SSDEEP:	1536:+KwF/uZnd+l07TjdghAQ4dYMqLcBrtXt:bd++qYepcBrtXt
MD5:	DDB8AB034F46DD12361E0BAF09F58E9C
SHA1:	8470B31D10299B367D3C1DB225153FACEE41E2EF
SHA-256:	52451F4DB95E02463F27A5B93C213D13776EAF6856E36BE4595CBF38F7AFECAB
SHA-512:	B40A24E5D226035B0AF8F36DAE9D6F21F6E811136BAC5F00B0B6818A7568988103D7C782983DFEF7137419519EEA674F84EDF106D7FD925BE49BB7DE0EF01D4C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.k.k...k.k.k...k.k.k..k..k...k&..k..k.k.k...k.k.k..k.k.k..k.k.k..kRich..k................PE..L......J...........!.........p.......6....................................... .......;......................................T...d...................................................................`...@...............x............................text...d........................... ..`.rdata..X".......0..................@..@.data...............................@....rsrc...............................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-CJB6D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.8422211712195535
Encrypted:	false
SSDEEP:	768:+ZKeNAteyvtMWEZWZEZBywcfOeAamxzRezBtvJ7B7FRIvCbbzeH7Zt5tQllo:+ZKeathmWg2ELW+xzRettBhFOKO79tQ
MD5:	66DF8002F27D90E5A3EB546FF52B7D63
SHA1:	9B922040FA9ED87C7716EC201B3D9555F1961756
SHA-256:	F1484ED8252EA6A1F6F883975F6ADCCCA44925FDBFA9F34D4AB25A8740439700
SHA-512:	27C9C9CA74B593726E6CEB8DE5F2920687A0680174F5017084FB2299A1B3C6F31E532989989081D237C4CA21225345083BC2FCE97F8EEAB4CD6B7634E987F243
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........EW.\$9^\$9^\$9^{.D^L$9^{.T^.$9^.+d^Y$9^\$8^.$9^{.W^C$9^{.K^^$9^{.C^]$9^{.A^]$9^Rich\$9^................PE..L......b...........!.........`......l........................................ ..........................................j...l...<...................................................................x...@...............D............................text............................... ..`.rdata... .......0..................@..@.data....+..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-E2844.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	573440
Entropy (8bit):	6.233175890219993
Encrypted:	false
SSDEEP:	12288:mshe8YKefkefSPD9fY7zVPHkDq8KfJrAXLyQSGF:mMe8gfSb9wPC6r
MD5:	A55645F58E32DD30D21D28AD0D4BCDB8
SHA1:	68245D0ED0D950A78B5EEC04D54029E895AE2590
SHA-256:	0F6A0FBB9A4B80F7465DB8F9133883F37E1E4767B889F2A89FB87F1956087EAC
SHA-512:	25D649E8034A3481DB67295F19759E923D8B64137EC00963412B3A54899936447D3F7C041E315E643E96443EFBCCECFAAE7D08976CC15F72C191F80089511D5D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........' ..Is..Is..IsjZ7s.Is.X4s.Is..Hso.Is>..s..Is.X$s%.Is.X'sn.Is.X3s..Is.X1s..IsRich..Is........PE..L......b...........!......... .......1..............................................)...................................=.......(............................ ...@..................................h...@...............t............................text...V........................... ..`.rdata..-=.......@..................@..@.data...X(.......@..................@....rsrc................ ..............@..@.reloc....... .......0..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-EGJ3O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151552
Entropy (8bit):	6.320874154978678
Encrypted:	false
SSDEEP:	1536:nRXlWUw6EYSxjL6fSqMTV71nL1b0Ihp1Cjjhwzryc5/z6fTyASZK/t273:RVy6lSqMj1z1CRUX5/z6nSZOt
MD5:	D36AF189F252AF3867FA69A054AE9109
SHA1:	A4A706B97B6389BA504ACC27D859D03045997457
SHA-256:	7784CF4EB4D1A3B587B82F926B8F8D098634BBBDD9676FA53A588F471CB237F0
SHA-512:	847D2857FB252CE20E6BA2397B799E5E9DF7E0E5A285DDC4150ED615CEF6D4FB2711CF7DF65C58889DCA3848D544CC76610CE78F621217568D02B524ED9E5A24
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e1..b..b..b.Nvb...b.Neb..b(.Vb..b..b...b.Nfb...b.Nqb..b.Nsb..bRich..b........................PE..L......b...........!.................].......................................`......E\|..............................p...........(....0.......................@......................................(...@............................................text............................... ..`.rdata...G.......P..................@..@.data...d...........................@....rsrc........0....... ..............@..@.reloc.......@... ...0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-FURKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	3.7552472295006774
Encrypted:	false
SSDEEP:	384:AmCB9ZQb2C+4ASzjqr/9jK0yY/8remoZC:69+bhrue0B/iemo
MD5:	311271336002DAC15544CE988B8A3582
SHA1:	6F179251D068CD59186B6605377ACE33FB61CC68
SHA-256:	DCD4AFF6F70076C6D94F7F26CFD7B1A475DF1D507FF68CF36C7DFFEDEC5C2D7D
SHA-512:	96DDCF13C46970FBFA5B9533B0E418C94CA15D33666DA8199466899FB38178DAC410F525573A000C11E96A33D4BF338F576AAE2CCC7D94D2424F844CBD32F2B1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................................`...............................Rich............PE..L....Q.a.................@...@......?........P....@.........................................................................<T..<....................................................................................P...............................text....6.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-JN5IK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	4.58580130770935
Encrypted:	false
SSDEEP:	384:HndXeN7V6BpQVrDcp5dt1FaFQ1FT7PIXX:HndyR6BpQ2FaFQ1FT
MD5:	2AD8ACAB7EEE003C3A805D9A5F3E702D
SHA1:	FC8F16CC9961864A7C3471DACD721D58B47A57DC
SHA-256:	4614FA8681CBBA8ECAEB932D380D18310ED8CBEB5257C54DDE953BEB8BCDFEEE
SHA-512:	01411054F58EE86BDD614C5088304C538580EE0A33E05BFEC8D0276E1B2AB55BC4E49F7943BC81ED61908F67CAF6E899E7422E9EC4DEF6E99B9B7A4FD7817611
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O..!...!...!...!...!...#...!.Rich..!.................PE..L...nlO6...........!.....4...,......01.......P......................................................................pQ..........P...............................t....P..T...............................................`............................text...s3.......4.................. ..`.rdata..(....P.......8..............@..@.data........p.......J..............@....idata..\............X..............@....reloc..I............`..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-L1595.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.701768629129277
Encrypted:	false
SSDEEP:	768:vexS9CN2+YnAbXejMpfYO/LsQHWhaJ5EMBzTiWOI1oPCtWrn:vzk2+YncXD5oQZJ5EUpJton
MD5:	63C572103D8B85363F29824344421C68
SHA1:	56D4C1DCF464B7BF1DAD1DC36FF2DDA6D187DB52
SHA-256:	76D65AB7FF443AFCA20F4A6B11DDFC1C67CE1410C11F6A94D296027DC938B1A9
SHA-512:	5C56DD61C39A212EA90C04FAD7AB54F1A7A1A7A851F740DADE7DB9E16734B7458CB58354C2524D181279B08C845C32488261DE8D93891DB6EE08AE521D3C6844
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&8..Hk..Hk..Hk./5k..Hk./&k..Hk./%k..Hk7..k..Hk..Ik..Hk./9k..Hk./2k..Hk./0k..HkRich..Hk........PE..L...R..b...........!.........`.......8...............................................0..........................................(...............................0.......................................@............................................text............................... ..`.rdata...%.......0..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-OR35G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	6.193484192480897
Encrypted:	false
SSDEEP:	1536:ds1LrnH0yUHjq+8aKKtnIMfA8HYfDBgO6KxR/ybqiTfpNk1telXIPx:0r3ujq+8aKQn1GueCputwXW
MD5:	B921E0D4C6B7E4F117B8C499DCB69135
SHA1:	BD84F51E7BF7DFAFB4206053430A2BB84FA5E34A
SHA-256:	16A4700694D0AFE763708598F91B2751550832152935681A94284A61A6F6F769
SHA-512:	1A58D9A27E6BD446232B78EEF311B834BF65C3FA4EB3D13DE96D36AD079AC9A380A549D2381DC4362FB16A4B545D7BF8ECE1D0960C8581F754618F7E6DE15738
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8.r/\|..\|\|..\|\|..\|.Lb\|}..\|[Na\|j..\|[Nq\|...\|..C\|}..\|..A\|q..\|\|..\|...\|[Nr\|7..\|[Nf\|}..\|[Nd\|}..\|Rich\|..\|........PE..L......b...........!.....@..........6........P...............................0......................................p.......$...........................................................................@............P...............................text...\|9.......@.................. ..`.rdata..U`...P...p...P..............@..@.data...`1....... ..................@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-PCP74.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.224612666656956
Encrypted:	false
SSDEEP:	768:Msa6BbqLbf8gOCJfzVbvYhC1ZiBuJHM5VtyZWU:M6BMTRtvMCSmHMt+WU
MD5:	34EE2255C994924E192466BC4FE409E9
SHA1:	61CB7F6A6E5850F7FCAD26910F5C1015CE9041CF
SHA-256:	1717EEC862F0AC755BA9604A92537331CB3CDD4879CEA7F48B91ACB5BA66ECA5
SHA-512:	8661FCAE057635E8029247B54770FFC75DF3CC93568A5F3FE69BAD41BA506D0C465CDEE5749E7A2029376F9CE9EF90153BB3BDFF6CA1AC7A27E7E1B7BBF151E9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U..W.it..it..it.6....it.6....it.6....it..vg..it..f)..it..iu.qit.6...Zit.6....it.6....it.6....it.Rich.it.........PE..L......J...........!.........`......9$..............................................^I......................................$...x.......n.......................\...................................8...@...............X............................text....t.......................... ..`.rdata... .......0..................@..@.data...............................@....rsrc...n...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-SKTFO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	6.139690357998456
Encrypted:	false
SSDEEP:	1536:qrvwsHbRtrfs7zx/gkuu9YBilpu3HFu/zvMr3htXg7ycO:qr4sHNm5/i4Y7Aw9tXOyc
MD5:	4553230F7FC1001759D693C5CB0E48C5
SHA1:	274EB35A94201ADB5D654540E49A720239BFDE30
SHA-256:	0BCB7EFEF180DA11B662A62DCE776137DFA3234BFDA3AA1359C04504C834D146
SHA-512:	D0635C0377B20B4A82B06B0E6F9691262E26E32A59A7104A6FBA0CF798AF21C5A65896E7645C4D2A5D9B10AA584BE21A5215DBD8E1992266F26C3D28E7767BD2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=).Z\G.Z\G.Z\G.}.).D\G.}.:.B\G.S..X\G.}.<._\G.Z\F..\G.}.*.&\G.}.=.[\G.}.?.[\G.RichZ\G.........................PE..L...d..b...........!..... ...........f.......0......................................................................0U..p...dJ..P...................................................................HE..@............0...............................text............ .................. ..`.rdata...(...0...0...0..............@..@.data...\|0...`... ...`..............@....rsrc...............................@..@.reloc..:........ ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\is-V337O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	5.737327475219662
Encrypted:	false
SSDEEP:	768:Zk45EBOzZiCBbnHIZR+/VYuou0fPr9vBYZe+VtuYu:Zr5+OsvAarJgHtuYu
MD5:	54232CC07D353267275B3A536557970A
SHA1:	292FDE8EBADC83CF056B4987487EF202354C51B8
SHA-256:	C939943F693110C4737FA251CADA6A801651E5A4DEA8E4A841EECE6053B5B9E8
SHA-512:	65FD70EEBF2795DDE2BB65C33270FAC18C85F65FA26F0B9707ED12D917DB06C380391F56F202E5E8F0D178B1961A83F0F8E9BC1CF00280E2341B512C5215E520
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..H...H...H...3...H...5...H...&...H...I...H.U.....H...%...H...2...H...0...H.Rich..H.........................PE..L...k..b...........!.....p...`.......#.............................................................................. ...........d...............................<.......................................@...............0............................text....o.......p.................. ..`.rdata... .......0..................@..@.data...D...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\libSecurityJNI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.8422211712195535
Encrypted:	false
SSDEEP:	768:+ZKeNAteyvtMWEZWZEZBywcfOeAamxzRezBtvJ7B7FRIvCbbzeH7Zt5tQllo:+ZKeathmWg2ELW+xzRettBhFOKO79tQ
MD5:	66DF8002F27D90E5A3EB546FF52B7D63
SHA1:	9B922040FA9ED87C7716EC201B3D9555F1961756
SHA-256:	F1484ED8252EA6A1F6F883975F6ADCCCA44925FDBFA9F34D4AB25A8740439700
SHA-512:	27C9C9CA74B593726E6CEB8DE5F2920687A0680174F5017084FB2299A1B3C6F31E532989989081D237C4CA21225345083BC2FCE97F8EEAB4CD6B7634E987F243
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........EW.\$9^\$9^\$9^{.D^L$9^{.T^.$9^.+d^Y$9^\$8^.$9^{.W^C$9^{.K^^$9^{.C^]$9^{.A^]$9^Rich\$9^................PE..L......b...........!.........`......l........................................ ..........................................j...l...<...................................................................x...@...............D............................text............................... ..`.rdata... .......0..................@..@.data....+..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\libexpat.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151552
Entropy (8bit):	6.320874154978678
Encrypted:	false
SSDEEP:	1536:nRXlWUw6EYSxjL6fSqMTV71nL1b0Ihp1Cjjhwzryc5/z6fTyASZK/t273:RVy6lSqMj1z1CRUX5/z6nSZOt
MD5:	D36AF189F252AF3867FA69A054AE9109
SHA1:	A4A706B97B6389BA504ACC27D859D03045997457
SHA-256:	7784CF4EB4D1A3B587B82F926B8F8D098634BBBDD9676FA53A588F471CB237F0
SHA-512:	847D2857FB252CE20E6BA2397B799E5E9DF7E0E5A285DDC4150ED615CEF6D4FB2711CF7DF65C58889DCA3848D544CC76610CE78F621217568D02B524ED9E5A24
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e1..b..b..b.Nvb...b.Neb..b(.Vb..b..b...b.Nfb...b.Nqb..b.Nsb..bRich..b........................PE..L......b...........!.................].......................................`......E\|..............................p...........(....0.......................@......................................(...@............................................text............................... ..`.rdata...G.......P..................@..@.data...d...........................@....rsrc........0....... ..............@..@.reloc.......@... ...0..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\libogg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.701768629129277
Encrypted:	false
SSDEEP:	768:vexS9CN2+YnAbXejMpfYO/LsQHWhaJ5EMBzTiWOI1oPCtWrn:vzk2+YncXD5oQZJ5EUpJton
MD5:	63C572103D8B85363F29824344421C68
SHA1:	56D4C1DCF464B7BF1DAD1DC36FF2DDA6D187DB52
SHA-256:	76D65AB7FF443AFCA20F4A6B11DDFC1C67CE1410C11F6A94D296027DC938B1A9
SHA-512:	5C56DD61C39A212EA90C04FAD7AB54F1A7A1A7A851F740DADE7DB9E16734B7458CB58354C2524D181279B08C845C32488261DE8D93891DB6EE08AE521D3C6844
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&8..Hk..Hk..Hk./5k..Hk./&k..Hk./%k..Hk7..k..Hk..Ik..Hk./9k..Hk./2k..Hk./0k..HkRich..Hk........PE..L...R..b...........!.........`.......8...............................................0..........................................(...............................0.......................................@............................................text............................... ..`.rdata...%.......0..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\libvorbis.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1722880
Entropy (8bit):	2.607191566647403
Encrypted:	false
SSDEEP:	3072:u45PRUFnXYswu5gNCdiVwHHlS0btoCBrbK6ESzIlMR0IAQQhWfPXXbmzAg0Fum1v:ukRWXSPVwnlS6flnR0cWAOm13M
MD5:	A5CE62769B0B85B37805A47D9C40C338
SHA1:	C8F350BCECD05AD0048C59BD9DB1A6017510A52D
SHA-256:	7B36FDAA75540831754C0826D35EFD12B3FC15BDC74F6EC248DA4DCAFAD20709
SHA-512:	3643DFF86096E8D5A7BB1E46015284F822399C91C38B1B84EBFF9AB76D30796AA94980F0574CCF06C2BD447CEA0E4483AF80BF5648CB9A452E7E5AC89E229C2C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V..S7j.S7j.S7j.t...O7j.t...z7j.t...07j.87.Q7j.t...P7j.S7k..7j.t...F7j.t...R7j.t...R7j.RichS7j.........PE..L...a..b...........!.....@...........&.......P..............................................................................t...<....0.......................@.../..................................`...@............P..$............................text...;>.......@.................. ..`.rdata......P.......D..............@..@.data...d#..........................@....rsrc........0......................@..@.reloc...=...@...>..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\libvorbisfile.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	6.139690357998456
Encrypted:	false
SSDEEP:	1536:qrvwsHbRtrfs7zx/gkuu9YBilpu3HFu/zvMr3htXg7ycO:qr4sHNm5/i4Y7Aw9tXOyc
MD5:	4553230F7FC1001759D693C5CB0E48C5
SHA1:	274EB35A94201ADB5D654540E49A720239BFDE30
SHA-256:	0BCB7EFEF180DA11B662A62DCE776137DFA3234BFDA3AA1359C04504C834D146
SHA-512:	D0635C0377B20B4A82B06B0E6F9691262E26E32A59A7104A6FBA0CF798AF21C5A65896E7645C4D2A5D9B10AA584BE21A5215DBD8E1992266F26C3D28E7767BD2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=).Z\G.Z\G.Z\G.}.).D\G.}.:.B\G.S..X\G.}.<._\G.Z\F..\G.}.*.&\G.}.=.[\G.}.?.[\G.RichZ\G.........................PE..L...d..b...........!..... ...........f.......0......................................................................0U..p...dJ..P...................................................................HE..@............0...............................text............ .................. ..`.rdata...(...0...0...0..............@..@.data...\|0...`... ...`..............@....rsrc...............................@..@.reloc..:........ ..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\tar32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.401050257504742
Encrypted:	false
SSDEEP:	6144:6xYeTPHmTueSd40p8U3zjhG53A41svaez6D7yNbeebjrUoJ5fWIwvDXMTBo5OWV:6xYeTPH28d40p8U3zjE53A4MfzGUbeKu
MD5:	DFBFB1D1C3ED06713E56E55E7CADAEE7
SHA1:	5FF05A6A404D9558BD85EB52ADFC8B7D5E63A59A
SHA-256:	0C7ECE4AB807996A5D52E5008E0C1E1B1BDEBF33B9C2288739F7241945D0710F
SHA-512:	E67624E55DB70AA5264B0A0C93E8FBA713C9A6A6B09C056DBA454FBB7BE9600408422BB7B4366E802D13A0E9AE598C64F9DF81C478567BAD16DCD5044BB414D5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..Oa...a...a.......g.....\|.......m.......g...g...k.......f.......d...a.....W.....W...v.......`.......`...Richa...........PE..L....Q.a...........!................a$...................................................................................... ...<....@..p....................P..t0...................................................................................text............................... ..`.rdata..............................@..@.data....z.......p..................@....rsrc...p....@.......0..............@..@.reloc...8...P...@...@..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\tarcmd.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	3.7552472295006774
Encrypted:	false
SSDEEP:	384:AmCB9ZQb2C+4ASzjqr/9jK0yY/8remoZC:69+bhrue0B/iemo
MD5:	311271336002DAC15544CE988B8A3582
SHA1:	6F179251D068CD59186B6605377ACE33FB61CC68
SHA-256:	DCD4AFF6F70076C6D94F7F26CFD7B1A475DF1D507FF68CF36C7DFFEDEC5C2D7D
SHA-512:	96DDCF13C46970FBFA5B9533B0E418C94CA15D33666DA8199466899FB38178DAC410F525573A000C11E96A33D4BF338F576AAE2CCC7D94D2424F844CBD32F2B1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................................`...............................Rich............PE..L....Q.a.................@...@......?........P....@.........................................................................<T..<....................................................................................P...............................text....6.......@.................. ..`.rdata.......P.......P..............@..@.data....)...`...0...`..............@...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\dlls\win32com.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	4.58580130770935
Encrypted:	false
SSDEEP:	384:HndXeN7V6BpQVrDcp5dt1FaFQ1FT7PIXX:HndyR6BpQ2FaFQ1FT
MD5:	2AD8ACAB7EEE003C3A805D9A5F3E702D
SHA1:	FC8F16CC9961864A7C3471DACD721D58B47A57DC
SHA-256:	4614FA8681CBBA8ECAEB932D380D18310ED8CBEB5257C54DDE953BEB8BCDFEEE
SHA-512:	01411054F58EE86BDD614C5088304C538580EE0A33E05BFEC8D0276E1B2AB55BC4E49F7943BC81ED61908F67CAF6E899E7422E9EC4DEF6E99B9B7A4FD7817611
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O..!...!...!...!...!...#...!.Rich..!.................PE..L...nlO6...........!.....4...,......01.......P......................................................................pQ..........P...............................t....P..T...............................................`............................text...s3.......4.................. ..`.rdata..(....P.......8..............@..@.data........p.......J..............@....idata..\............X..............@....reloc..I............`..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\is-28PVE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.540363884302869
Encrypted:	false
SSDEEP:	24:Q1NLI/TeZu9YM7/M2v2OAUWwGJtob132zmFdIq8qVsAFdIkjkjAloNzmWNvn:GNc/8u9YF2v2OAmGJab1mzmEP3AEyIAY
MD5:	AF54A8883211A3C956E9F41955125D54
SHA1:	DAACB0AFB3BA703B2B17AC93D5775206BD7A3AFC
SHA-256:	494AF8EE4EDB809B7E04CF42A6FC6E9BBD3781798A07BBA4CA2431A5A339835B
SHA-512:	09FAA6E6A86E29A7488E10B993DB434DCB62E331D7B0053169E9F3208C30429418EA9E664FF0AF9E7AAEF4C8DCB79BE39C28BF9846F05A902D01D55531156268
Malicious:	false
Preview:	@ECHO OFF..SETLOCAL ENABLEEXTENSIONS....REM ------------------------------------------------------------..REM Main Routine..REM ------------------------------------------------------------..SET LOGFILE=nul..REM SET LOGFILE=%TEMP%\VDRServiceRegist.log..ECHO ------------------------------------------------------------ >> %LOGFILE%..ECHO %DATE% %TIME% >> %LOGFILE%....REM see ./scada_win/app/ServiceMinit/ServiceMinit.rc..SET SERVICE_NAME="VDR Servers Service"....REM Stop Service..sc stop %SERVICE_NAME%..ECHO sc stop %SERVICE_NAME% RESULT:%ERRORLEVEL% >> %LOGFILE%....REM Regist Service..SET SERVICE_MINIT=server\bin\ServiceMinit.exe..CALL :REGIST_SERVICE....ECHO DONE. >> %LOGFILE%..EXIT....REM ------------------------------------------------------------..REM Regist Service..REM ------------------------------------------------------------..:REGIST_SERVICE..IF EXIST %SERVICE_MINIT% (.. ECHO Regist Service : %SERVICE_MINIT% >> %LOGFILE%.. %SERVICE_MINIT% /UnregServer.. ECHO %SERVICE_MINIT% /

C:\Program Files (x86)\FURUNO\VR-7000\is-5113G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	717985
Entropy (8bit):	6.514892357658037
Encrypted:	false
SSDEEP:	12288:6TPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5MRxyFj:SPcYn5c/rPx37/zHBA6pFptZ1CEQqMRG
MD5:	7ED0852A51DF0E4AD455F7EA3F39E596
SHA1:	113630652C21A6D5F6498E06475D89AA850A4149
SHA-256:	0BD7976242464961623A701A9744FCAD739702BC2C55FE080165E3DC33F33363
SHA-512:	201689B8BCEAA91967F3A65176756CD98618F0CAFEA7C8BAA3EF5AA06CE8F05AD858B2DD04A7D433530D2D0805E0FE302AF628B46D24A1426350223FB5B1D6E2
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..............................................@...............................%..................................................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................T..............@..P........................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\is-H6H63.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	3.9069050327968804
Encrypted:	false
SSDEEP:	3:cYKLD2ns2en2:3Kn2nXK2
MD5:	60205CC6480608E98E14D4BCECE0C3C0
SHA1:	EABC789A03D9CCE98CB750A760583023F0063FFC
SHA-256:	C7E629CB94B54623B592C64F3B6029B9D21BF24B3188FB69E2C05772541F059A
SHA-512:	BA11BC7B040C5B631B39FF6F33EDA820D66151173749385811175F7B22E2DEBCE99CB9F95EF680FE23BDA478ACF5765984E20CB58F3144E88F0CB46E58567428
Malicious:	false
Preview:	wscript UninstSeverEnvironment.vbs

C:\Program Files (x86)\FURUNO\VR-7000\is-H7TJM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.944548827786958
Encrypted:	false
SSDEEP:	3:cYWLWnTAs2en2:3WYAXK2
MD5:	1E9D5E4E473BB1E85C8E596F8B3026B5
SHA1:	C3E2328311AA8D6E7BB4D5ED0238C803D85AC905
SHA-256:	BF23E7816400F1C208E5A4D397DA03ED0BE087AEBED6845F07BB79E0838D9AEA
SHA-512:	B38BBF8555AC4B86BECA1B35505E38899C561305F198BC3B932AC9C545B9FFCE282DC0C4A52F7857EE9197B4E8AF5F53F49A35CC4BD712185F9FB9E6A72A62D5
Malicious:	false
Preview:	wscript InstSeverEnvironment.vbs

C:\Program Files (x86)\FURUNO\VR-7000\is-OICHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1286
Entropy (8bit):	5.299118839599219
Encrypted:	false
SSDEEP:	24:IN8KW5iQM7lI5yDiseh2PD/eoSVd+sHGLuGub3MJ:y8ITRMyDPD/O8s+X1
MD5:	5618CF19864999A6D4566D60F8525B40
SHA1:	A97188305138C0518E2E43E1F47A0158CE101FC8
SHA-256:	1EB7B63FB3BE1C9E138B94F27D5272434F880DD588789B24336D46D3B631D323
SHA-512:	25A56F01A473B56E163FF702021274057245885A7CDBB7FD0547E41A17DB217EDC9452C7D4D486FD4F8A979D5BED8B92BF3F7090071D8AC4868CCFA40DD5460B
Malicious:	false
Preview:	Option Explicit..Dim WShell..Dim SFileSystem..Dim WEnvironment..Dim Members..Dim i..Dim bFind..Dim SystemRootFolder..Dim CurrentDirectory..Dim SFolderObject..Dim SFolderCollection....Set WShell = CreateObject("WScript.Shell")..Set SFileSystem= CreateObject("Scripting.FileSystemObject")..Set WEnvironment = WShell.Environment("System")....'''''''''''''''''''''''''''''''''''''''''''''''''..' ...W.X.g........s.t.H..._..........SystemRootFolder = "%SERVER_DLLS%"....Members = Split (WEnvironment.Item("PATH"), ";")..bFind = false..For i = LBound(Members) To UBound(Members).. If StrComp (Members(i), SystemRootFolder ) = 0 Then..'.WScript.Echo "...."...bFind = true.. End If..Next....If bFind = false Then.. WEnvironment.Item("PATH") = WEnvironment.Item("PATH") & ";" & SystemRootFolder ..' WScript.Echo "..............................."..End If....''''''''''''''''''''''''''''''''''''''''''''''''''..'' .J.....g.f.B...N.g.....X......'CurrentDirectory = WShell.CurrentDirecto

C:\Program Files (x86)\FURUNO\VR-7000\is-UHC5S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.106505774273587
Encrypted:	false
SSDEEP:	3:6090ERMCAVAMerTA4v:DXYybgi
MD5:	2EA1C7B1F55930C9AEFC37D288AE89A5
SHA1:	ADFC44AE6811D426DD70BC986ADC1FA4635CBF06
SHA-256:	BD855484AE6249F651E082BDC0C83D732F988818C2596C2655FA1AE9108B0B00
SHA-512:	DFD584E2FEC5831F4C110FE309FDBE7ECDC34620A8E5F004D806B08ABDA16DD9F9DAB5F977C7DD661C194C4C19B38A4DE44627ACA199768752D4D286A6C52863
Malicious:	false
Preview:	sc stop "Grass Servers Service"..server\bin\ServiceMinit.exe /UnregServer..

C:\Program Files (x86)\FURUNO\VR-7000\is-UPH2R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1104
Entropy (8bit):	5.469738261088247
Encrypted:	false
SSDEEP:	24:IN8KNg5iQM7lISflvWtsehD5PD/uIyGLi1Y:y8STRDju/RXf
MD5:	EC4723BDFC1B0F8A04C6C483397466C6
SHA1:	5437FF0C03378D6E9BE5B9BA341A60208895B09F
SHA-256:	7402167192B842D30273CFE711E483F4974A92EC8D91E78AAA63269A343FC693
SHA-512:	60ED6560FAC57D76615A96F17FD617B499082213EF5D47377FBFC202404A82DD4498B8663DD63B46B661AA2218B00EC0E23F058587B2167FA4E452D01E95FCAA
Malicious:	false
Preview:	Option Explicit..Dim WShell..Dim SFileSystem..Dim WEnvironment..Dim Members..Dim i..Dim bFind..Dim SystemRootFolder..Dim UnInstallPath....Set WShell = CreateObject("WScript.Shell")..Set SFileSystem= CreateObject("Scripting.FileSystemObject")..Set WEnvironment = WShell.Environment("System")....'''''''''''''''''''''''''''''''''''''''''''''''''..' ...W.X.g......V.X.e.....[.g.t.H..._.........SystemRootFolder = WShell.RegRead("HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\SERVER_DLLS")......Members = Split (WEnvironment.Item("PATH"), ";")..bFind = false..UnInstallPath = vbNull..For i = LBound(Members) To UBound(Members)..'.WScript.Echo Members(i).. If StrComp (Members(i), SystemRootFolder ) = 0 Then..'.WScript.Echo "...."...bFind = true.. Else...If UnInstallPath = vbNull Then... UnInstallPath = Members(i)...Else... UnInstallPath = UnInstallPath & ";" & Members(i)...End If.. End If ..Next....If bFind = true Then..' WScript.Echo "...............

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.380415251741467
Encrypted:	false
SSDEEP:	6144:8r425MUQLzjkAdhY3Twy9/r1hUEtF6wbwfQ+:8r425MUWz9yDworgEtF6w0
MD5:	01C338C4765202CB8D712FD7CCDF9BD1
SHA1:	A9F0A8D8597A223379788FBBBF089F5AF295952A
SHA-256:	B25F15F33842A7A19B2042501E277B7E1633463A6A6B84608AF1931D15B25D4B
SHA-512:	0D1AEB83DC6C7329845564337DB0521CAF5FAAEAF125EF1872B3A8686CDAAEBCB5BD8319D434B26FFF4719CDE8914A767097E49B03EF54C9FCDA7ED976FECA65
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^............\|...................{...(......(..........F...........................Rich............PE..L......b............................C9............@.................................o........................................w..x...................................0...............................0`..@............................................text............................... ..`.rdata..\...........................@..@.data....?....... ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\VdrCheckFileTest.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	401408
Entropy (8bit):	6.581487194029644
Encrypted:	false
SSDEEP:	6144:r2DjfnabpRHiwo8qffutpzMcOpglVhpXHv+Tz:r2Djfnab3HiwoJozdOpi7/8
MD5:	B7F40ECDA7EEA42C8DFE0F01F6291C8E
SHA1:	3D4244A41CB02AC7097AD909EECFF7C772903CAA
SHA-256:	CD59EAD0B2F04AABA206E9DBC21AC0ADFBD23BBF847D437DE88891D88A8F4212
SHA-512:	405E86F41CDBAD07F21844D874FD9613AD74E97FD71E1AC84FFE4940663592F5D95CCE8FCAB0994E169EBC43670F1B1F792214713255912CDF17E0AA94B876E5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B............1.....!3...............m..!3.....!3..U..!3.....Rich...........PE..L...L..b.....................0....................@..................................\..........................................(................................... ................................l..@............................................text............................... ..`.rdata..R...........................@..@.data...\........p..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\clientrecorder.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1490944
Entropy (8bit):	5.918416150691233
Encrypted:	false
SSDEEP:	24576:Uo02dPZXnHI47KOUWujnfZp3hHHLJw01Lxtykgdl4/8:Uo02dPZXh2OUWMJ1Lxty8/8
MD5:	D5738D9829DF5D18855EFB675231CB8B
SHA1:	F6D1067DEA9A11E1916D7CFBCCB00E4262F1471F
SHA-256:	F67FDE05EB130F74C43C2894C7C8154BD773FEC890BAD4769956F216F3DCB9EA
SHA-512:	BD4D021C59145B7CE42B5F31014A3B4B0A46AE8B494EA0C2450D5E5ACE91CAC69EC4FBBEE5377F8E0EA06EB4FD67EFAAE33FB2DFC05E973DD2BB0B286E0874BD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G.d..d..d.Dh...d..j...d..j...d...9..d..e...d..j..6.d..j..p.d..j...d..j...d.Rich.d.........................PE..L...:..b..................... .......3............@........................... ............................................... ....... ............................................................................... ..............................textbss.................................text....... ...................... ..`.rdata...7.......@..................@..@.data...T...........................@....idata..(..... .. ..................@....rsrc......... .....................@..@........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\combine.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	352256
Entropy (8bit):	5.802065785822964
Encrypted:	false
SSDEEP:	6144:K7wMUPVG6p6aH0hgfLt9o8/2Q4/u8EE4evApyT0zQEVIFzhCOvkohG93dBNlHYMr:K75UPVOELSynwGQDf0/L3KpfCFiBV9ZK
MD5:	1669F9908DBDCA5C41F3C3716B69F0F6
SHA1:	65CB7E616D5AF8F7FDD7C42ADFEFD12678A53086
SHA-256:	EAE40AB4DA851C51CA3358A89F5F192F358390C43BD57231D3BE0C53106679ED
SHA-512:	7ECE3BBEECE2B9EB23BA54EAFBEB7014D46C78DA9C811890E9A0C9F7055E8BB44727AD634AB275AC51EF720783C003C0A5CD891FA9347203BE3D804396136488
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|...\|...\|....R.~...[P.k...[P.}...[P.}...Rich\|...........................PE..L....\|.[.................p..........<.............@..........................`.......G....@..................................;..(....@.......................P......p...................................................................H............text....j.......p.................. ..`.rdata..z...........................@..@.rsrc........@.......@..............@..@.reloc.......P.......P..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\confirmDialog.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	5.94709491629093
Encrypted:	false
SSDEEP:	768:W6kUN34JEFWMt40racTPmYpJYwIazJ4bPTni2b4HuwIAhhJHyd4bM0+KNweG/5mj:W6kpJVSVraQJpJYwI2J4bPTni2b4Huwh
MD5:	A63B60E462CC0CE896312B233059626F
SHA1:	94B683F0DD4164DECA764244BD5463DB987A1454
SHA-256:	90B16029499CB678F75A414FCE7DFBE771B8B1DD65F8E114CA18E56DC8E41D1E
SHA-512:	70ED3C4F73089CF949637E835C3D41D6419D6E079756E01C491A63D12C51FEDFD65DD9F79A2A835514D3F09A816765110F4869EF09AE216CD553382E56B7BD9D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........4...g...g...g.\.g...g.\.g...g.\.g...gRich...g........PE..L...v.%G.............................*.......0....@.................................+.......................................x...(...................................`0...............................................0..............\|0..H............text............................... ..`.rdata.......0......."..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\extclient.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2662400
Entropy (8bit):	5.915842537430716
Encrypted:	false
SSDEEP:	49152:S0ied+UyJl7e2zlNdwO7EQla5biyKi14z328:diedw/pwwEQGz1
MD5:	B4809CE2B21C498EF4ECCFB4B506F784
SHA1:	BEFEC7DB7F0A795A2E041B1F0669CF81FAF34539
SHA-256:	47F1F189B99A4074705FBE2FD247ED5B48E2D815D69B514BDD471810F8BE81BC
SHA-512:	CDE74D2751B0FBD87A89A22A709EA1E32326D314E10BCE10A6EBAF871F582E71B73C97CD6C1558872BDB37EE758F31D176854C1C83891E2A4A8A2CA076FD081E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$".wJq.wJq.wJql.4q.wJq.7q.wJq8x*q.wJq.1q.wJq8x.q.wJq.wKq.vJq.'q.vJq.$q.wJq.0q.wJq.6q.wJq.2q.wJqRich.wJq................PE..L...P..b.........................................@...........................:..................................... w6......p:.,.....:............................. ...............................................xx:.L............................textbss.................................text....{... ...................... ..`.rdata..............................@..@.data.........6......p'.............@....idata..((...p:..0...`(.............@....rsrc.........:.......(.............@..@................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-0KHA3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.380415251741467
Encrypted:	false
SSDEEP:	6144:8r425MUQLzjkAdhY3Twy9/r1hUEtF6wbwfQ+:8r425MUWz9yDworgEtF6w0
MD5:	01C338C4765202CB8D712FD7CCDF9BD1
SHA1:	A9F0A8D8597A223379788FBBBF089F5AF295952A
SHA-256:	B25F15F33842A7A19B2042501E277B7E1633463A6A6B84608AF1931D15B25D4B
SHA-512:	0D1AEB83DC6C7329845564337DB0521CAF5FAAEAF125EF1872B3A8686CDAAEBCB5BD8319D434B26FFF4719CDE8914A767097E49B03EF54C9FCDA7ED976FECA65
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........^............\|...................{...(......(..........F...........................Rich............PE..L......b............................C9............@.................................o........................................w..x...................................0...............................0`..@............................................text............................... ..`.rdata..\...........................@..@.data....?....... ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-596LT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	618496
Entropy (8bit):	5.8869532376972336
Encrypted:	false
SSDEEP:	12288:mes2q9BSGZFh2P6AJmVNCI8lAwyisjZ0O:S24BPAJGL8lAwyfjZ0
MD5:	51E76427CA5624D19CECEA9EA1D32DAE
SHA1:	8AD1EDA5F7FFDA245A3DD8A90BB60C69C5160429
SHA-256:	11C9C4AB30D7A599E9B0C9D3D845129044C67391687D835BC0EAAD31C67C3BE6
SHA-512:	94491B2C397E6462EFECE2CF1B2A3A7FEA92352C6657BBB462B2A9636982863D7326FA1739914FF2B1B23304331C118120533B902606DE3B354E3A0061037F69
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lt.............<.d.......g.....h.G...............w.d.....t.......f.......b.....Rich............................PE..L......b.....................p......T.............@.............................................................................(....................................P..............................................t...L............................textbss.................................text...,........................... ..`.rdata.......@... ..................@..@.data....(...`......................@....idata...............P..............@....rsrc................`..............@..@................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-7UQKD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	401408
Entropy (8bit):	6.581487194029644
Encrypted:	false
SSDEEP:	6144:r2DjfnabpRHiwo8qffutpzMcOpglVhpXHv+Tz:r2Djfnab3HiwoJozdOpi7/8
MD5:	B7F40ECDA7EEA42C8DFE0F01F6291C8E
SHA1:	3D4244A41CB02AC7097AD909EECFF7C772903CAA
SHA-256:	CD59EAD0B2F04AABA206E9DBC21AC0ADFBD23BBF847D437DE88891D88A8F4212
SHA-512:	405E86F41CDBAD07F21844D874FD9613AD74E97FD71E1AC84FFE4940663592F5D95CCE8FCAB0994E169EBC43670F1B1F792214713255912CDF17E0AA94B876E5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B............1.....!3...............m..!3.....!3..U..!3.....Rich...........PE..L...L..b.....................0....................@..................................\..........................................(................................... ................................l..@............................................text............................... ..`.rdata..R...........................@..@.data...\........p..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-84GGN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299008
Entropy (8bit):	6.439258445164575
Encrypted:	false
SSDEEP:	6144:HQKSun5VB/jBFPklPp/wa2EyAgYsRipd7Zuo6wZQXK31:wKSun5VBlFPuR4bnYsg7Zuo6wZQXKl
MD5:	28A37DE2CB159371787002488A0BE5FB
SHA1:	018424B4D27A6A92C7A00F9B701F18296C74B0B1
SHA-256:	5AF6D2A9EA6E1B0099EA882562ADDD9D03966936E672DB8E00218A1C084EDC7B
SHA-512:	1D5797BB3D330E0BDC7622A045B79552617E33C2173999C9C500B911283084E27F2F8626998F192541A1EE79DBD1734B30290345F946E5F40D681CBD07858CD3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y............a]......._.....5..........t...._..S...._......._......Rich............PE..L...R..b.............................D............@..........................................................................T..P...................................................................P;..@............................................text.............................. ..`.rdata..............................@..@.data...8....`... ...`..............@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-8V50C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1490944
Entropy (8bit):	5.918416150691233
Encrypted:	false
SSDEEP:	24576:Uo02dPZXnHI47KOUWujnfZp3hHHLJw01Lxtykgdl4/8:Uo02dPZXh2OUWMJ1Lxty8/8
MD5:	D5738D9829DF5D18855EFB675231CB8B
SHA1:	F6D1067DEA9A11E1916D7CFBCCB00E4262F1471F
SHA-256:	F67FDE05EB130F74C43C2894C7C8154BD773FEC890BAD4769956F216F3DCB9EA
SHA-512:	BD4D021C59145B7CE42B5F31014A3B4B0A46AE8B494EA0C2450D5E5ACE91CAC69EC4FBBEE5377F8E0EA06EB4FD67EFAAE33FB2DFC05E973DD2BB0B286E0874BD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G.d..d..d.Dh...d..j...d..j...d...9..d..e...d..j..6.d..j..p.d..j...d..j...d.Rich.d.........................PE..L...:..b..................... .......3............@........................... ............................................... ....... ............................................................................... ..............................textbss.................................text....... ...................... ..`.rdata...7.......@..................@..@.data...T...........................@....idata..(..... .. ..................@....rsrc......... .....................@..@........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-AP3B5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	843776
Entropy (8bit):	5.81708561086406
Encrypted:	false
SSDEEP:	12288:PmUgzUMeLUJStkldwoule4uAjlZIIR0bS2SublVJ9P529JsLEJJAvHa6+P:PmUgzUMeLyStkldiM529SAJJQHa6+
MD5:	110A0794DFBC02AC3690DBD0B428DD12
SHA1:	D24192122915108870FA114B078AA35FCEEE4B4C
SHA-256:	13096074A5A3CB3DE623826C2FF1F14AC5B58CA1957EC7C151978B5927CF0C25
SHA-512:	94F67626EA27C6ABE708F0A741EB03760A55B5A18CD6604E84A614521369390A10804B74905CAE059E2BE369CECB20414E0FDB8BEC1F2ADEBCFBD71C64F5F2E2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.\|.../.../.../.V./.../,T./*../,T./.../../.../.../.../,T./../,T./z../,T./.../,T./.../Rich.../................PE..L......b.................P...@......9.............@..........................0..................................................d.... ..................................................................................P............................textbss................................text....A.......P.................. ..`.rdata..e............`..............@..@.data...PD........... ..............@....idata.._........ ..................@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-CKFTJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	634880
Entropy (8bit):	5.830287591283141
Encrypted:	false
SSDEEP:	6144:JsSrVaADBmG9ksHN7IAuqfDD5UB/mcSD/bea+J04T9Tc6YL2GymlBKzdFv+zQ:JsHADvkkN7IXqvi/YbbeauBZcX8kWdZ
MD5:	935AB82B8DD966A4CA9ABB62DE6CF869
SHA1:	1807B34685A2886DFA02868F02C6F5EEBA2BD7E0
SHA-256:	A31D98CA993D7F41B2A0609DF5F941B05B1F443E7D596ED317EC16383FD910DC
SHA-512:	0879DDB17A3A3AFAA265F6961A1B03D6BB3FDDC8B4B8B1C7A924E00C55C6842D87B86246105AE8448C71E884208729374CB60E9C63858F64621ACA15F882B9FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.n;g..hg..hg..h.S~hn..h@Q}hF..h..]hn..h@Q{he..hg..h...h@Qmh...h@Qnh...h@Q\|hf..h@Qxhf..hRichg..h........PE..L......b.....................`......c.............@.............................................................................x.......................................................................................x............................textbss.................................text...5........................... ..`.rdata..............................@..@.data...0,..........................@....idata..W........ ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-KLCB3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	5.94709491629093
Encrypted:	false
SSDEEP:	768:W6kUN34JEFWMt40racTPmYpJYwIazJ4bPTni2b4HuwIAhhJHyd4bM0+KNweG/5mj:W6kpJVSVraQJpJYwI2J4bPTni2b4Huwh
MD5:	A63B60E462CC0CE896312B233059626F
SHA1:	94B683F0DD4164DECA764244BD5463DB987A1454
SHA-256:	90B16029499CB678F75A414FCE7DFBE771B8B1DD65F8E114CA18E56DC8E41D1E
SHA-512:	70ED3C4F73089CF949637E835C3D41D6419D6E079756E01C491A63D12C51FEDFD65DD9F79A2A835514D3F09A816765110F4869EF09AE216CD553382E56B7BD9D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........4...g...g...g.\.g...g.\.g...g.\.g...gRich...g........PE..L...v.%G.............................*.......0....@.................................+.......................................x...(...................................`0...............................................0..............\|0..H............text............................... ..`.rdata.......0......."..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-KVTDD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1396736
Entropy (8bit):	6.530224476491686
Encrypted:	false
SSDEEP:	24576:xm1oPnzDyv8kCv8p30Ed0DxKlTxRor2nmyylX1Tq/PIh99dlkkPbW3/VSAk90/Td:IOPzWkkCvMxsxjjyya/PIh9zHYsz9+
MD5:	44E3F6CCE9AB5A045165330DB87205AE
SHA1:	87456956E251AC0FCFD5874C5AF8375433550103
SHA-256:	245160BAC02DA98439B6D243486B6FE23F3A75310C685412E2AD50D60A4604F1
SHA-512:	39DAABB6CD644FC6EB67FA23D008C26E9F0E74A36934DAEA84634E12981F69C0C8C18BE480C0145EAEA2E4C9944C7BAB5EF2D5C64FB2F4E69E4C3474EEF7910E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>%..zD..zD..zD....wD..]...MD..]...rD..K..}D..zD...D..]...D..]....D..]...{D..RichzD..........................PE..L......b.................@..........`........P....@.................................T...............................................................................@T..................................@............P...............................text....:.......@.................. ..`.rdata...B...P...P...P..............@..@.data...............................@....rsrc................@..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-MKFDE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.4127659163167
Encrypted:	false
SSDEEP:	6:xqOFECtFrEw5tFErMAT8RAE1T/A2we4iX+3y7FQ:xvECfrEw5LEtT8RBdwe4044Q
MD5:	DD38EB05852B8BC83871AABAE9935465
SHA1:	5400A62AE69C5FFE62C99CF707D4A31F029EC04A
SHA-256:	7EF19D070E82D00DB30974C6E32B7BF0DCF0116E96B4F6C81188985D855D6CBD
SHA-512:	35EAC0444CFB65DEDA9CECDADF7CAFC23A5B3507CC3AA8AEA946F5E39B4CFDF478EA37108CC4306C4FC549D3693F2A216F802CF8588CDEA56FEF6E21546265AD
Malicious:	false
Preview:	start "extclient" extclient.exe -cons -debug -v..start "rcplayer" rcplayer.exe -cons -debug -v..start "rserv" rserv.exe -cons -debug -v..start "clientRecorder" clientrecorder.exe -cons -ftpuser furuno -ftppass furuno -debug 0x10000..start "remoteclient" remoteclient.exe -cons -debug -v

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-PPA9R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2662400
Entropy (8bit):	5.915842537430716
Encrypted:	false
SSDEEP:	49152:S0ied+UyJl7e2zlNdwO7EQla5biyKi14z328:diedw/pwwEQGz1
MD5:	B4809CE2B21C498EF4ECCFB4B506F784
SHA1:	BEFEC7DB7F0A795A2E041B1F0669CF81FAF34539
SHA-256:	47F1F189B99A4074705FBE2FD247ED5B48E2D815D69B514BDD471810F8BE81BC
SHA-512:	CDE74D2751B0FBD87A89A22A709EA1E32326D314E10BCE10A6EBAF871F582E71B73C97CD6C1558872BDB37EE758F31D176854C1C83891E2A4A8A2CA076FD081E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$".wJq.wJq.wJql.4q.wJq.7q.wJq8x*q.wJq.1q.wJq8x.q.wJq.wKq.vJq.'q.vJq.$q.wJq.0q.wJq.6q.wJq.2q.wJqRich.wJq................PE..L...P..b.........................................@...........................:..................................... w6......p:.,.....:............................. ...............................................xx:.L............................textbss.................................text....{... ...................... ..`.rdata..............................@..@.data.........6......p'.............@....idata..((...p:..0...`(.............@....rsrc.........:.......(.............@..@................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-RRTAP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	352256
Entropy (8bit):	5.802065785822964
Encrypted:	false
SSDEEP:	6144:K7wMUPVG6p6aH0hgfLt9o8/2Q4/u8EE4evApyT0zQEVIFzhCOvkohG93dBNlHYMr:K75UPVOELSynwGQDf0/L3KpfCFiBV9ZK
MD5:	1669F9908DBDCA5C41F3C3716B69F0F6
SHA1:	65CB7E616D5AF8F7FDD7C42ADFEFD12678A53086
SHA-256:	EAE40AB4DA851C51CA3358A89F5F192F358390C43BD57231D3BE0C53106679ED
SHA-512:	7ECE3BBEECE2B9EB23BA54EAFBEB7014D46C78DA9C811890E9A0C9F7055E8BB44727AD634AB275AC51EF720783C003C0A5CD891FA9347203BE3D804396136488
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|...\|...\|....R.~...[P.k...[P.}...[P.}...Rich\|...........................PE..L....\|.[.................p..........<.............@..........................`.......G....@..................................;..(....@.......................P......p...................................................................H............text....j.......p.................. ..`.rdata..z...........................@..@.rsrc........@.......@..............@..@.reloc.......P.......P..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\is-SDE95.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	552960
Entropy (8bit):	6.502032146686435
Encrypted:	false
SSDEEP:	12288:vQfdbvXmARDcl5RAam2hv8YXJGapNLED++ANt5kP+yciW9sllVJ9gr8izBAop7xT:0vXDRDY5Xl8YXJAizBAedCs
MD5:	0D6B3D038E635907A8296EB3BF137F20
SHA1:	530701890DD67AB505CBF4EADFDC2DF7A8E2EBFA
SHA-256:	C409D7F5F5158669C5D7F1593A116876326F7E5D18434BCB941CEE527CF73B39
SHA-512:	CE08EADC561A1287DDAE3641C84F89441614BC462FF7FDF67FD005C0DCA2B86130F16FA654F2494FFE7E2ADD40C97EEDCF817B490A3E78F023DF2FEF56608CDB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.@._.@._.@..U>.S.@.xW=.~.@.....X.@._.A..@.xW-...@.xW..%.@.xW8.^.@.Rich_.@.................PE..L...%..b.................0...0.......k.......@....@.......................... ......dd..........................................P...................................................................H...@............@...............................text..../.......0.................. ..`.rdata......@.......@..............@..@.data............p..................@....rsrc................`..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\liveremoteconverter.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	618496
Entropy (8bit):	5.8869532376972336
Encrypted:	false
SSDEEP:	12288:mes2q9BSGZFh2P6AJmVNCI8lAwyisjZ0O:S24BPAJGL8lAwyfjZ0
MD5:	51E76427CA5624D19CECEA9EA1D32DAE
SHA1:	8AD1EDA5F7FFDA245A3DD8A90BB60C69C5160429
SHA-256:	11C9C4AB30D7A599E9B0C9D3D845129044C67391687D835BC0EAAD31C67C3BE6
SHA-512:	94491B2C397E6462EFECE2CF1B2A3A7FEA92352C6657BBB462B2A9636982863D7326FA1739914FF2B1B23304331C118120533B902606DE3B354E3A0061037F69
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........lt.............<.d.......g.....h.G...............w.d.....t.......f.......b.....Rich............................PE..L......b.....................p......T.............@.............................................................................(....................................P..............................................t...L............................textbss.................................text...,........................... ..`.rdata.......@... ..................@..@.data....(...`......................@....idata...............P..............@....rsrc................`..............@..@................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\rcplayer.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1396736
Entropy (8bit):	6.530224476491686
Encrypted:	false
SSDEEP:	24576:xm1oPnzDyv8kCv8p30Ed0DxKlTxRor2nmyylX1Tq/PIh99dlkkPbW3/VSAk90/Td:IOPzWkkCvMxsxjjyya/PIh9zHYsz9+
MD5:	44E3F6CCE9AB5A045165330DB87205AE
SHA1:	87456956E251AC0FCFD5874C5AF8375433550103
SHA-256:	245160BAC02DA98439B6D243486B6FE23F3A75310C685412E2AD50D60A4604F1
SHA-512:	39DAABB6CD644FC6EB67FA23D008C26E9F0E74A36934DAEA84634E12981F69C0C8C18BE480C0145EAEA2E4C9944C7BAB5EF2D5C64FB2F4E69E4C3474EEF7910E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>%..zD..zD..zD....wD..]...MD..]...rD..K..}D..zD...D..]...D..]....D..]...{D..RichzD..........................PE..L......b.................@..........`........P....@.................................T...............................................................................@T..................................@............P...............................text....:.......@.................. ..`.rdata...B...P...P...P..............@..@.data...............................@....rsrc................@..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\remoteclient.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	843776
Entropy (8bit):	5.81708561086406
Encrypted:	false
SSDEEP:	12288:PmUgzUMeLUJStkldwoule4uAjlZIIR0bS2SublVJ9P529JsLEJJAvHa6+P:PmUgzUMeLyStkldiM529SAJJQHa6+
MD5:	110A0794DFBC02AC3690DBD0B428DD12
SHA1:	D24192122915108870FA114B078AA35FCEEE4B4C
SHA-256:	13096074A5A3CB3DE623826C2FF1F14AC5B58CA1957EC7C151978B5927CF0C25
SHA-512:	94F67626EA27C6ABE708F0A741EB03760A55B5A18CD6604E84A614521369390A10804B74905CAE059E2BE369CECB20414E0FDB8BEC1F2ADEBCFBD71C64F5F2E2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.\|.../.../.../.V./.../,T./*../,T./.../../.../.../.../,T./../,T./z../,T./.../,T./.../Rich.../................PE..L......b.................P...@......9.............@..........................0..................................................d.... ..................................................................................P............................textbss................................text....A.......P.................. ..`.rdata..e............`..............@..@.data...PD........... ..............@....idata.._........ ..................@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\rserv.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	552960
Entropy (8bit):	6.502032146686435
Encrypted:	false
SSDEEP:	12288:vQfdbvXmARDcl5RAam2hv8YXJGapNLED++ANt5kP+yciW9sllVJ9gr8izBAop7xT:0vXDRDY5Xl8YXJAizBAedCs
MD5:	0D6B3D038E635907A8296EB3BF137F20
SHA1:	530701890DD67AB505CBF4EADFDC2DF7A8E2EBFA
SHA-256:	C409D7F5F5158669C5D7F1593A116876326F7E5D18434BCB941CEE527CF73B39
SHA-512:	CE08EADC561A1287DDAE3641C84F89441614BC462FF7FDF67FD005C0DCA2B86130F16FA654F2494FFE7E2ADD40C97EEDCF817B490A3E78F023DF2FEF56608CDB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.@._.@._.@..U>.S.@.xW=.~.@.....X.@._.A..@.xW-...@.xW..%.@.xW8.^.@.Rich_.@.................PE..L...%..b.................0...0.......k.......@....@.......................... ......dd..........................................P...................................................................H...@............@...............................text..../.......0.................. ..`.rdata......@.......@..............@..@.data............p..................@....rsrc................`..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\server.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	4.4127659163167
Encrypted:	false
SSDEEP:	6:xqOFECtFrEw5tFErMAT8RAE1T/A2we4iX+3y7FQ:xvECfrEw5LEtT8RBdwe4044Q
MD5:	DD38EB05852B8BC83871AABAE9935465
SHA1:	5400A62AE69C5FFE62C99CF707D4A31F029EC04A
SHA-256:	7EF19D070E82D00DB30974C6E32B7BF0DCF0116E96B4F6C81188985D855D6CBD
SHA-512:	35EAC0444CFB65DEDA9CECDADF7CAFC23A5B3507CC3AA8AEA946F5E39B4CFDF478EA37108CC4306C4FC549D3693F2A216F802CF8588CDEA56FEF6E21546265AD
Malicious:	false
Preview:	start "extclient" extclient.exe -cons -debug -v..start "rcplayer" rcplayer.exe -cons -debug -v..start "rserv" rserv.exe -cons -debug -v..start "clientRecorder" clientrecorder.exe -cons -ftpuser furuno -ftppass furuno -debug 0x10000..start "remoteclient" remoteclient.exe -cons -debug -v

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\speedtest.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	634880
Entropy (8bit):	5.830287591283141
Encrypted:	false
SSDEEP:	6144:JsSrVaADBmG9ksHN7IAuqfDD5UB/mcSD/bea+J04T9Tc6YL2GymlBKzdFv+zQ:JsHADvkkN7IXqvi/YbbeauBZcX8kWdZ
MD5:	935AB82B8DD966A4CA9ABB62DE6CF869
SHA1:	1807B34685A2886DFA02868F02C6F5EEBA2BD7E0
SHA-256:	A31D98CA993D7F41B2A0609DF5F941B05B1F443E7D596ED317EC16383FD910DC
SHA-512:	0879DDB17A3A3AFAA265F6961A1B03D6BB3FDDC8B4B8B1C7A924E00C55C6842D87B86246105AE8448C71E884208729374CB60E9C63858F64621ACA15F882B9FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.n;g..hg..hg..h.S~hn..h@Q}hF..h..]hn..h@Q{he..hg..h...h@Qmh...h@Qnh...h@Q\|hf..h@Qxhf..hRichg..h........PE..L......b.....................`......c.............@.............................................................................x.......................................................................................x............................textbss.................................text...5........................... ..`.rdata..............................@..@.data...0,..........................@....idata..W........ ..................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\bin\vsend.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299008
Entropy (8bit):	6.439258445164575
Encrypted:	false
SSDEEP:	6144:HQKSun5VB/jBFPklPp/wa2EyAgYsRipd7Zuo6wZQXK31:wKSun5VBlFPuR4bnYsg7Zuo6wZQXKl
MD5:	28A37DE2CB159371787002488A0BE5FB
SHA1:	018424B4D27A6A92C7A00F9B701F18296C74B0B1
SHA-256:	5AF6D2A9EA6E1B0099EA882562ADDD9D03966936E672DB8E00218A1C084EDC7B
SHA-512:	1D5797BB3D330E0BDC7622A045B79552617E33C2173999C9C500B911283084E27F2F8626998F192541A1EE79DBD1734B30290345F946E5F40D681CBD07858CD3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y............a]......._.....5..........t...._..S...._......._......Rich............PE..L...R..b.............................D............@..........................................................................T..P...................................................................P;..@............................................text.............................. ..`.rdata..............................@..@.data...8....`... ...`..............@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\class.def (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8406
Entropy (8bit):	4.7248589356062975
Encrypted:	false
SSDEEP:	192:sUylxbUT/t1VcfbfZpBZp8xFI+OrU5h2P:Glh8/3obJuewuP
MD5:	499EC3F872B9F8E910D79AC5B0A613DC
SHA1:	1496A8261E2123EDD21644E702899AE7E962271C
SHA-256:	0E16CE7D50F83E415C48B0FADD9B0C0A63B56FF74820E5A3715F113CCDFDD2C5
SHA-512:	8C09C6E395C011902AA89B46256CAE5C147A4C6D39CB2826292242686B3C8B0DDE1DCEA9F268A028D5CB9D260EED2B146E7FF7CE89FD52B5872B6DA12BA5C886
Malicious:	false
Preview:	# generated date: Fri Aug 30 16:30:00 2019..e openclose_t 1..v 0 \|open..v 1 \|close..e onoff_t 2..v 0 \|off..v 1 \|on..e power_status_t 3..v 0 \|green..v 1 \|yellow..v 2 \|red..e save_button_t 4..v 0 \|lighting..v 1 \|lights-out..v 2 \|blinking..e normal_button_t 5..v 0 \|lighting..v 1 \|lights-out..e error_button_t 6..v 0 \|green..v 1 \|blinking-in-red..v 2 \|red..e power_type_t 7..v 1 \|AC..v 2 \|DC..v 3 \|BATT..e land_mark_type_t 8..v 0 \|unknown..v 1 \|Input Device..v 2 \|Terminal Board Ether..v 3 \|Junction Box..v 4 \|Audio Board..v 5 \|MIC..v 6 \|Video LAN Converter..v 7 \|Radar..v 8 \|Terminal Board..v 9 \|Serial Input..v 10 \|Analog..v 11 \|Digital..v 12 \|Alarm..v 13 \|Power Status..v 14 \|System Status..v 15 \|VHF..v 16 \|Sentence..v 17 \|Process..v 18 \|Config Status..v 19 \|Sensor(LAN) Input..v 20 \|AMS Input..e internal_value_type_t 9..v 0 \|unknown..v 1 \|Power Trigger..v 2 \|Current Value..v 3 \|Test Value..v 4 \|Test Result..v 5 \|Capture Resolution (H)..v 6 \|Capture Resolution (V)..v 7 \|Capture Size..v 8 \|Diag R

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\class.desc (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13789
Entropy (8bit):	5.051328041173336
Encrypted:	false
SSDEEP:	96:WxPp6HuGAnQmO3JmyJpmPZcOuKTHymp32ml5Kdt4BleMkhkNu171FtAi8lr2U35P:unOoyUOAHyUG05KzgleFhP1bJpHZs
MD5:	3306236F69013E5C3AEF09D36294B655
SHA1:	BFFEED6C74F4F85508AF31925FA0E81A54824A79
SHA-256:	C3D6878FF5B457C9DE85FCD77551E6E4448100038639B489DDCF5A831E5D1E0E
SHA-512:	E4B795003C183F5465C29A1913617D9083E6B9869C177E520436D11FC8819626BE620F01759BCC99B4021F9D33593E030D0055239A04F9F97B6C90DF44775FEB
Malicious:	false
Preview:	# 1 "class.cpp"..# 1 "<built-in>"..# 1 "<command-line>"..# 1 "class.cpp"..# 10 "class.cpp"..enum openclose_t {.. {0,"open"},.. {1,"close"},..};..enum onoff_t {.. {0,"off"},.. {1,"on"},..};..enum power_status_t {.. {0,"green"},.. {1,"yellow"},.. {2,"red"},..};..enum save_button_t {.. {0,"lighting"},.. {1,"lights-out"},.. {2,"blinking"},..};..enum normal_button_t {.. {0,"lighting"},.. {1,"lights-out"},..};..enum error_button_t {.. {0,"green"},.. {1,"blinking-in-red"},.. {2,"red"},..};..enum power_type_t {.. {1,"AC"},.. {2,"DC"},.. {3,"BATT"},..};....enum land_mark_type_t..{.. {0, "unknown"},.. {1, "Input Device"},.. {2, "Terminal Board Ether"},.. {3, "Junction Box"},.. {4, "Audio Board"},.. {5, "MIC"},.. {6, "Video LAN Converter"},.. {7, "Radar"},.. {8, "Terminal Board"},.. {9, "Serial Input"},.. {10,"Analog"},.. {11,"Digital"},.. {12,"Alarm"},.. {13,"Power Status"},.. {14,"System Status"

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\is-DD7HJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8406
Entropy (8bit):	4.7248589356062975
Encrypted:	false
SSDEEP:	192:sUylxbUT/t1VcfbfZpBZp8xFI+OrU5h2P:Glh8/3obJuewuP
MD5:	499EC3F872B9F8E910D79AC5B0A613DC
SHA1:	1496A8261E2123EDD21644E702899AE7E962271C
SHA-256:	0E16CE7D50F83E415C48B0FADD9B0C0A63B56FF74820E5A3715F113CCDFDD2C5
SHA-512:	8C09C6E395C011902AA89B46256CAE5C147A4C6D39CB2826292242686B3C8B0DDE1DCEA9F268A028D5CB9D260EED2B146E7FF7CE89FD52B5872B6DA12BA5C886
Malicious:	false
Preview:	# generated date: Fri Aug 30 16:30:00 2019..e openclose_t 1..v 0 \|open..v 1 \|close..e onoff_t 2..v 0 \|off..v 1 \|on..e power_status_t 3..v 0 \|green..v 1 \|yellow..v 2 \|red..e save_button_t 4..v 0 \|lighting..v 1 \|lights-out..v 2 \|blinking..e normal_button_t 5..v 0 \|lighting..v 1 \|lights-out..e error_button_t 6..v 0 \|green..v 1 \|blinking-in-red..v 2 \|red..e power_type_t 7..v 1 \|AC..v 2 \|DC..v 3 \|BATT..e land_mark_type_t 8..v 0 \|unknown..v 1 \|Input Device..v 2 \|Terminal Board Ether..v 3 \|Junction Box..v 4 \|Audio Board..v 5 \|MIC..v 6 \|Video LAN Converter..v 7 \|Radar..v 8 \|Terminal Board..v 9 \|Serial Input..v 10 \|Analog..v 11 \|Digital..v 12 \|Alarm..v 13 \|Power Status..v 14 \|System Status..v 15 \|VHF..v 16 \|Sentence..v 17 \|Process..v 18 \|Config Status..v 19 \|Sensor(LAN) Input..v 20 \|AMS Input..e internal_value_type_t 9..v 0 \|unknown..v 1 \|Power Trigger..v 2 \|Current Value..v 3 \|Test Value..v 4 \|Test Result..v 5 \|Capture Resolution (H)..v 6 \|Capture Resolution (V)..v 7 \|Capture Size..v 8 \|Diag R

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\is-EHIM6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13789
Entropy (8bit):	5.051328041173336
Encrypted:	false
SSDEEP:	96:WxPp6HuGAnQmO3JmyJpmPZcOuKTHymp32ml5Kdt4BleMkhkNu171FtAi8lr2U35P:unOoyUOAHyUG05KzgleFhP1bJpHZs
MD5:	3306236F69013E5C3AEF09D36294B655
SHA1:	BFFEED6C74F4F85508AF31925FA0E81A54824A79
SHA-256:	C3D6878FF5B457C9DE85FCD77551E6E4448100038639B489DDCF5A831E5D1E0E
SHA-512:	E4B795003C183F5465C29A1913617D9083E6B9869C177E520436D11FC8819626BE620F01759BCC99B4021F9D33593E030D0055239A04F9F97B6C90DF44775FEB
Malicious:	false
Preview:	# 1 "class.cpp"..# 1 "<built-in>"..# 1 "<command-line>"..# 1 "class.cpp"..# 10 "class.cpp"..enum openclose_t {.. {0,"open"},.. {1,"close"},..};..enum onoff_t {.. {0,"off"},.. {1,"on"},..};..enum power_status_t {.. {0,"green"},.. {1,"yellow"},.. {2,"red"},..};..enum save_button_t {.. {0,"lighting"},.. {1,"lights-out"},.. {2,"blinking"},..};..enum normal_button_t {.. {0,"lighting"},.. {1,"lights-out"},..};..enum error_button_t {.. {0,"green"},.. {1,"blinking-in-red"},.. {2,"red"},..};..enum power_type_t {.. {1,"AC"},.. {2,"DC"},.. {3,"BATT"},..};....enum land_mark_type_t..{.. {0, "unknown"},.. {1, "Input Device"},.. {2, "Terminal Board Ether"},.. {3, "Junction Box"},.. {4, "Audio Board"},.. {5, "MIC"},.. {6, "Video LAN Converter"},.. {7, "Radar"},.. {8, "Terminal Board"},.. {9, "Serial Input"},.. {10,"Analog"},.. {11,"Digital"},.. {12,"Alarm"},.. {13,"Power Status"},.. {14,"System Status"

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\is-H99DI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	680
Entropy (8bit):	4.162406236493623
Encrypted:	false
SSDEEP:	12:i+bTVheO/OI9WD33V0+PO7I4vjh+SQic0+n:i+bTD9+i1Qm+n
MD5:	DB551FA8DC64E8B58619D7D0E142F638
SHA1:	46FC47809B3AF871928E69C0CA14981EA90BB2A6
SHA-256:	4790F553AFA3E6AEF151A7C3C36EDD700A33D2C02311261CFF5D459AB258C8EA
SHA-512:	010AD9B84E78A1950A430BE45AEF3876F99B787568949D6139DCD586ADF6F65FF1834809061AE311531F85A8CAC0C28029F0DB85107C0CE090E8A2D2378079AB
Malicious:	false
Preview:	# id.type.priority [systemid].ip:port.or file..ip:port.or file..1.modelserv.0.1.localhost..2.logger..0.1.localhost:10020..1.crntserv.0.1.localhost:15000..51.ioserv .0.1.localhost:12001....15 rcplayer 0 1 localhost:10105..16 extserv 0 1 10.0.0.100:10106..17 extclient 0 1 localhost:10107......#1.modelserv.0.1.localhost..#2.logger..0.1.localhost:10020..#1.crntserv.0.1.localhost:15000..#51.ioserv .0.1.localhost:12001....#15 rcplayer 0 1 localhost:10105..#16 extserv 0 1 10.160.155.164:10106..#17 extclient 0 1 localhost:10107......

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\is-IBAEC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	362
Entropy (8bit):	4.3744796318157215
Encrypted:	false
SSDEEP:	6:n/MW//Did+V6jMHeBLNmAIQ1dGJeMei1AxRADyT/A2weyyCp+ep:n0G4+V67B51Bi18RHdweyXNp
MD5:	066BD77D49DB45FA283042AB2F1BC8AE
SHA1:	FE2AFB82C819936ABB896FEEC897897120B95E91
SHA-256:	9C3B9AF44DBB2E4A147F69A33BD966E8AC61D3FEBF0A5B772BA97036E403436F
SHA-512:	26652A6ED8A0719028F1B8CE44919357DCE06707F3616B393E18B3C83447D7D76CEB7E65BD0836999897413BC592AD79786F410BA7553BBF1B31482622C6DC78
Malicious:	false
Preview:	#..# type procname command & args..#..respawn rserv rserv -debug 0x10000..respawn rcplayer rcplayer -debug 0x10000 -timeStamp 112:0x100001:10..respawn extclient extclient -debug 0x10000..respawn clientrecorder clientrecorder -ftpuser furuno -ftppass furuno -debug 0x10000 -v..respawn remoteclient remoteclient -debug 0x10000..

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\is-PVL8M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	3.983068315890039
Encrypted:	false
SSDEEP:	3:TR29QKB3JU25xecgXsGXR1fCaAOgqJEF/FFJcVM9YdRT64MbvyZuFcqkwOKDeNFR:o9fBqG/gcifNJENhklTBmVc1dVEUn
MD5:	D5BE99A24E4FA518C483C54427DCB976
SHA1:	F8DD2C1A9646CAB3F67813049C74114A06802F6B
SHA-256:	779717057FF3FB7D74E07B6C1A5A72B91923AB9660486299B24AE22716A04E88
SHA-512:	F0AFD27F8925AE2240EB3D5AEAD36B75D1B6E20F9E4AFCAC22239BAADB70E87A5BBD26CC3D457E04086A18D7DE33C7F8F641F7B9F8DF99129214D3B00B2F2EF5
Malicious:	false
Preview:	#.name.type.port..modelserv.1.24001..crntserv 3 15000..logger..4.10020..ioserv..5.12001....rcplayer 1005 10105..extclient 1007 10107..extserv 1006 10106....sysinfo 9 0..

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\minit.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	362
Entropy (8bit):	4.3744796318157215
Encrypted:	false
SSDEEP:	6:n/MW//Did+V6jMHeBLNmAIQ1dGJeMei1AxRADyT/A2weyyCp+ep:n0G4+V67B51Bi18RHdweyXNp
MD5:	066BD77D49DB45FA283042AB2F1BC8AE
SHA1:	FE2AFB82C819936ABB896FEEC897897120B95E91
SHA-256:	9C3B9AF44DBB2E4A147F69A33BD966E8AC61D3FEBF0A5B772BA97036E403436F
SHA-512:	26652A6ED8A0719028F1B8CE44919357DCE06707F3616B393E18B3C83447D7D76CEB7E65BD0836999897413BC592AD79786F410BA7553BBF1B31482622C6DC78
Malicious:	false
Preview:	#..# type procname command & args..#..respawn rserv rserv -debug 0x10000..respawn rcplayer rcplayer -debug 0x10000 -timeStamp 112:0x100001:10..respawn extclient extclient -debug 0x10000..respawn clientrecorder clientrecorder -ftpuser furuno -ftppass furuno -debug 0x10000 -v..respawn remoteclient remoteclient -debug 0x10000..

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\serv.def (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	680
Entropy (8bit):	4.162406236493623
Encrypted:	false
SSDEEP:	12:i+bTVheO/OI9WD33V0+PO7I4vjh+SQic0+n:i+bTD9+i1Qm+n
MD5:	DB551FA8DC64E8B58619D7D0E142F638
SHA1:	46FC47809B3AF871928E69C0CA14981EA90BB2A6
SHA-256:	4790F553AFA3E6AEF151A7C3C36EDD700A33D2C02311261CFF5D459AB258C8EA
SHA-512:	010AD9B84E78A1950A430BE45AEF3876F99B787568949D6139DCD586ADF6F65FF1834809061AE311531F85A8CAC0C28029F0DB85107C0CE090E8A2D2378079AB
Malicious:	false
Preview:	# id.type.priority [systemid].ip:port.or file..ip:port.or file..1.modelserv.0.1.localhost..2.logger..0.1.localhost:10020..1.crntserv.0.1.localhost:15000..51.ioserv .0.1.localhost:12001....15 rcplayer 0 1 localhost:10105..16 extserv 0 1 10.0.0.100:10106..17 extclient 0 1 localhost:10107......#1.modelserv.0.1.localhost..#2.logger..0.1.localhost:10020..#1.crntserv.0.1.localhost:15000..#51.ioserv .0.1.localhost:12001....#15 rcplayer 0 1 localhost:10105..#16 extserv 0 1 10.160.155.164:10106..#17 extclient 0 1 localhost:10107......

C:\Program Files (x86)\FURUNO\VR-7000\server\data\etc\services.def (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	3.983068315890039
Encrypted:	false
SSDEEP:	3:TR29QKB3JU25xecgXsGXR1fCaAOgqJEF/FFJcVM9YdRT64MbvyZuFcqkwOKDeNFR:o9fBqG/gcifNJENhklTBmVc1dVEUn
MD5:	D5BE99A24E4FA518C483C54427DCB976
SHA1:	F8DD2C1A9646CAB3F67813049C74114A06802F6B
SHA-256:	779717057FF3FB7D74E07B6C1A5A72B91923AB9660486299B24AE22716A04E88
SHA-512:	F0AFD27F8925AE2240EB3D5AEAD36B75D1B6E20F9E4AFCAC22239BAADB70E87A5BBD26CC3D457E04086A18D7DE33C7F8F641F7B9F8DF99129214D3B00B2F2EF5
Malicious:	false
Preview:	#.name.type.port..modelserv.1.24001..crntserv 3 15000..logger..4.10020..ioserv..5.12001....rcplayer 1005 10105..extclient 1007 10107..extserv 1006 10106....sysinfo 9 0..

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\Config.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Generic INItialization configuration [drucapa]
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.696032879598639
Encrypted:	false
SSDEEP:	3:7F8zRIXKyJHSKVJ+3fsfWcYFHyeWiXAsLvsXAsNYRekGW0AsfUeov:7SzEhyM+3fTysQCEQDRepk/eov
MD5:	22C30E24367DBB6D49595D5FDD86CC43
SHA1:	19FF654DFFAB542693655C4309FB46DC442A1A56
SHA-256:	3D2633567D669EF6DD0893974361204F643A898CA70EF2181A99EEAD3F6F78CC
SHA-512:	EE63A543A85F5FCE18B87AFEEABB55444702F1D9B46B52CFF35C7982CB40BB67E9DE37C711E74A76138FB9C918E39169F2D614AC9A35F087E61A5DC5DCF8B2FE
Malicious:	false
Preview:	[extract]..restore = /opt/vr/data/restore;....[drucapa]..capacity = 30000;....[audio]..startOffset = 4600..deliveryCount = 1;..;startOffset = 7488..;startOffset = 9504..; -4896..;startOffset = 4608..;..

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\OggMUON_1sec.ogg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Ogg data
Category:	dropped
Size (bytes):	7484
Entropy (8bit):	7.847051564767458
Encrypted:	false
SSDEEP:	192:dMppwzwLLn1aMppwzwLLn1aMppwzwLLn1aMppwzwLLn1C:0Wan1FWan1FWan1FWan1C
MD5:	0977791EA51A3899F746E0AEB92D2E0F
SHA1:	65D5398F96BE48B6D77CF094D3F7C92C0F490150
SHA-256:	90F502A851317FBA03352586A3A576EE5F517665685FFBAFD6062CECF2203627
SHA-512:	20434578F31C81B1C669DA1E22504726073268418AA86B61CC4A5C6B8AA66621E0B51225A7B8C76BE481D0FF5147A3415EEFB2FFB52485A8EE54EB66588D28B4
Malicious:	false
Preview:	OggS..........xV4.&...AE.............x.l0..T&.!u.Cf.R.....i[.K.SB.g......wy....KzO..$...r.Q9D.f8..z8,4...R.3F..u......B.`v,.{....=.`s.......G{W....l=}W........$..Y....=O..2........(2.><.4.......7.........)...;~...../.....w..p...\.u.:..i.......^.pF...N.M8.....x6.'.wWD...5W.y...;1FO1..d.V...G..LJ.t.y&~f.?T...V.._CC\|6(.e..2..............){.,.GhmG.r.........o.W..O../.j./.U5.\|.H......ZL2\......$..O<...._.e.....~.....e..>.^N}.kw.=.Z.O.>....8.&....-;."................+Jg.........?x...^..<...v.d.......>.{...to.7.......K.`.L}$........d..._..I'..;....;...G.v..].i..........TZ..2...6C.o.Q....qQ.M....7.7............B...pe.k.z%....~.x.%.B+.SY...&....S..=....2....LUq.fC..5\...\z.`}...`\\iKy#...U.x....W.?..27..E{tF.'~.Ga...?>/...@..e.....4..k..yb....]3..>&.....>?...;..b.3X.u.......t.:.m...Rw..m....7d..VJC...(."Jy+...^.....a.a. N..A....*g.W..?........?...zL..w{..K&..O. ......._+.z.^..'.F..Q.....`nj^8L<0x.X...P[..G)....!Y..>..;E.....Rhr..T..

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\RapAlartList.csv (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15231
Entropy (8bit):	4.925537997543363
Encrypted:	false
SSDEEP:	96:5zDyIcDoDJ/KjcvzZBweiQOmVyVW82wqVEOg0exv4Vtvrko77ewTsDT0MdeK9Gp+:5MoDJCjc9Bw7tmkYgUpRXOwaSkkZo
MD5:	E124442EA562DF4F5A0161C90F7260B9
SHA1:	8F094E53D28AEC72A142FE6006B5FB09D57D102B
SHA-256:	AA3D53E75081C9983C038DCA5454AABA581048B35AC28F8E152108133770E13C
SHA-512:	7281D01BEA7CDBC8D19042898E02F577CCB8C656DF8EDF71B0CE7247BA7EDCDE792ECB6478330673C64059DBC49C35557C175E3A1BF614D1F279A87F16B485A4
Malicious:	false
Preview:	412951\|3003\|0\|-\|Lost Connection\|B\|C\|0\|0\|0\|-..412082\|3003\|1\|-\|Lost RAP\|B\|C\|0\|0\|0\|Restart VDR...412301\|3003\|2\|-\|Lost Serial Ch01\|B\|C\|0\|0\|0\|Check Ch01 connected sensor...412302\|3003\|3\|-\|Lost Serial Ch02\|B\|C\|0\|0\|0\|Check Ch02 connected sensor...412303\|3003\|4\|-\|Lost Serial Ch03\|B\|C\|0\|0\|0\|Check Ch03 connected sensor...412304\|3003\|5\|-\|Lost Serial Ch04\|B\|C\|0\|0\|0\|Check Ch04 connected sensor...412305\|3003\|6\|-\|Lost Serial Ch05\|B\|C\|0\|0\|0\|Check Ch05 connected sensor...412306\|3003\|7\|-\|Lost Serial Ch06\|B\|C\|0\|0\|0\|Check Ch06 connected sensor...412307\|3003\|8\|-\|Lost Serial Ch07\|B\|C\|0\|0\|0\|Check Ch07 connected sensor...412308\|3003\|9\|-\|Lost Serial Ch08\|B\|C\|0\|0\|0\|Check Ch08 connected sensor...412309\|3003\|10\|-\|Lost Serial Ch09\|B\|C\|0\|0\|0\|Check Ch09 connected sensor...412310\|3003\|11\|-\|Lost Serial Ch10\|B\|C\|0\|0\|0\|Check Ch10 connected sensor...412311\|3003\|12\|-\|Lost Serial Ch11\|B\|C\|0\|0\|0\|Check Ch11 connected sensor...412312\|3003\|13\|-\|Lost Serial Ch12\|B\|C\|0\|0\|0\|Check Ch12 connected sensor...412313\|3003\|14\|-\|Lost Seri

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\equipment.db (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	data
Category:	dropped
Size (bytes):	68960
Entropy (8bit):	4.889017390182576
Encrypted:	false
SSDEEP:	768:pmHS0+rz2TejydHTbOFVqFUCfnO5LTwnKTvUkIjXxCbv1ByUQVULap4/ukl2HI5J:pmHN+3IHTbUqFi1UkIjhCbXyU/D
MD5:	9EC77F47DC53838FC3CC7079D180E34F
SHA1:	ECB48D106FF6878A49B3F717CB12D94BFC86EAC9
SHA-256:	7AB11DEA44E4C5FF38C2A33D7C3D222E29955D1D47388B8F071F6E6F5DCB8A10
SHA-512:	1571C81EEA2F9BF07703FD79360C16CA893D6FDBBE6EFA0420FA163B7809D55D3938F7E0CB4A2A9ACA01F15315B1A48D2C1D0DACD7B000923F9657B8EF5CEDA8
Malicious:	false
Preview:	.VC.U.o`....(...(...........q..........K...........n...................n...................n...................n...........!.......n...........).......n...........1.......n...........9.......n...........A.......n...........I.......n...........Q.......n...........Y.......n...........a.......n...........i.......n...........q.......n...........y.......n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n... ...............n...!...............n..."...............n...#...............n...$.......!.......n...%.......).......n...&.......1.......n...'.......9.......n...(.......A.......n...).......I.......n...*.......Q.......n...+.......Y.......n...,.......a.......n...-.......i.......n...........q.......n.../.......y.......n...0...

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\is-0KS84.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Ogg data
Category:	dropped
Size (bytes):	7484
Entropy (8bit):	7.847051564767458
Encrypted:	false
SSDEEP:	192:dMppwzwLLn1aMppwzwLLn1aMppwzwLLn1aMppwzwLLn1C:0Wan1FWan1FWan1FWan1C
MD5:	0977791EA51A3899F746E0AEB92D2E0F
SHA1:	65D5398F96BE48B6D77CF094D3F7C92C0F490150
SHA-256:	90F502A851317FBA03352586A3A576EE5F517665685FFBAFD6062CECF2203627
SHA-512:	20434578F31C81B1C669DA1E22504726073268418AA86B61CC4A5C6B8AA66621E0B51225A7B8C76BE481D0FF5147A3415EEFB2FFB52485A8EE54EB66588D28B4
Malicious:	false
Preview:	OggS..........xV4.&...AE.............x.l0..T&.!u.Cf.R.....i[.K.SB.g......wy....KzO..$...r.Q9D.f8..z8,4...R.3F..u......B.`v,.{....=.`s.......G{W....l=}W........$..Y....=O..2........(2.><.4.......7.........)...;~...../.....w..p...\.u.:..i.......^.pF...N.M8.....x6.'.wWD...5W.y...;1FO1..d.V...G..LJ.t.y&~f.?T...V.._CC\|6(.e..2..............){.,.GhmG.r.........o.W..O../.j./.U5.\|.H......ZL2\......$..O<...._.e.....~.....e..>.^N}.kw.=.Z.O.>....8.&....-;."................+Jg.........?x...^..<...v.d.......>.{...to.7.......K.`.L}$........d..._..I'..;....;...G.v..].i..........TZ..2...6C.o.Q....qQ.M....7.7............B...pe.k.z%....~.x.%.B+.SY...&....S..=....2....LUq.fC..5\...\z.`}...`\\iKy#...U.x....W.?..27..E{tF.'~.Ga...?>/...@..e.....4..k..yb....]3..>&.....>?...;..b.3X.u.......t.:.m...Rw..m....7d..VJC...(."Jy+...^.....a.a. N..A....*g.W..?........?...zL..w{..K&..O. ......._+.z.^..'.F..Q.....`nj^8L<0x.X...P[..G)....!Y..>..;E.....Rhr..T..

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\is-3MITD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	66614
Entropy (8bit):	4.712231082284398
Encrypted:	false
SSDEEP:	1536:MwdHuAW61Np1wn0ZyGLOSxLlxzVL8qX7MueZrql:1dHv11Nzw0ZpLOSxLlxzVL8qXQuehql
MD5:	E566BB30590682C468E9F9AF0B4F514B
SHA1:	CFE919552115B95CAB2FB11ABAA112814BFA2014
SHA-256:	221D72A03B4C2B164D455D763484EA27712B20CF383C2B3E272F0DC9429775A4
SHA-512:	ECB0DB14DEC33640A0F59EFAADE432F1DFC4F41999C5DCDD79EA9032446976B5C9B19EF72E60CD5F23100CB18C05BC7A8DE05020AEB656A7BC309E55DC228299
Malicious:	false
Preview:	@i 0 5 0 0 0 6 778 0 0 0 0 268 2 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 3 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 4 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Long Term Device.5 5 203 0x100001 12 4\|\|\|0\|\|\|HDD:SIZE:Long Term Device.6 0 110 0x100001 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH001.6 1 110 0x100002 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH002.6 2 110 0x100003 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH003.6 3 110 0x100004 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH004.6 4 110 0x100005 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH005.6 5 110 0x100006 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH006.6 6 110 0x100007 1 4\|\|\|0\|\|

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\is-DFUDP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	data
Category:	dropped
Size (bytes):	68960
Entropy (8bit):	4.889017390182576
Encrypted:	false
SSDEEP:	768:pmHS0+rz2TejydHTbOFVqFUCfnO5LTwnKTvUkIjXxCbv1ByUQVULap4/ukl2HI5J:pmHN+3IHTbUqFi1UkIjhCbXyU/D
MD5:	9EC77F47DC53838FC3CC7079D180E34F
SHA1:	ECB48D106FF6878A49B3F717CB12D94BFC86EAC9
SHA-256:	7AB11DEA44E4C5FF38C2A33D7C3D222E29955D1D47388B8F071F6E6F5DCB8A10
SHA-512:	1571C81EEA2F9BF07703FD79360C16CA893D6FDBBE6EFA0420FA163B7809D55D3938F7E0CB4A2A9ACA01F15315B1A48D2C1D0DACD7B000923F9657B8EF5CEDA8
Malicious:	false
Preview:	.VC.U.o`....(...(...........q..........K...........n...................n...................n...................n...........!.......n...........).......n...........1.......n...........9.......n...........A.......n...........I.......n...........Q.......n...........Y.......n...........a.......n...........i.......n...........q.......n...........y.......n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n...................n... ...............n...!...............n..."...............n...#...............n...$.......!.......n...%.......).......n...&.......1.......n...'.......9.......n...(.......A.......n...).......I.......n...*.......Q.......n...+.......Y.......n...,.......a.......n...-.......i.......n...........q.......n.../.......y.......n...0...

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\is-F2LLK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	280471
Entropy (8bit):	4.825966410766605
Encrypted:	false
SSDEEP:	6144:c05idHv11NzvZpLxxLXzVL8qXRCdVijVz3hxJrj9lgWD9njTBbNv/UMJH4URnrKy:xreX
MD5:	A602B91DDC542E56F4D2A44E6D25D638
SHA1:	EC4A4C9EBDFFC358E7EA640CC39DB3532145FA88
SHA-256:	8F10D42FF5383DA8FAEEAD0C4F0B9C91AD4B1278CB8EF42884CB99300B46B1B1
SHA-512:	2D27636FB8572617B526C376CAF51B2A21C208DD29E7AEF5AB91019624C59E580E85D2AED3E2DB4DB6C9650638AABF2DA4207D7E2263804C489DCDA9D3959F32
Malicious:	false
Preview:	@i 0 5 0 0 0 278 840 0 0 476 1376 1174 35 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100001 13 4\|\|\|0\|\|\|DRU:Device Num:Fixed DRU.5 3 202 0x100001 14 4\|\|\|0\|\|\|DRU:Round Trip:Fixed DRU.5 4 202 0x100001 15 4\|\|\|0\|\|\|DRU:Index:Fixed DRU.5 5 202 0x100001 16 4\|\|\|0\|\|\|DRU:Restart Counter:Fixed DRU.5 6 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 7 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 8 202 0x100002 13 4\|\|\|0\|\|\|DRU:Device Num:Float DRU.5 9 202 0x100002 14 4\|\|\|0\|\|\|DRU:Round Trip:Float DRU.5 10 202 0x100002 15 4\|\|\|0\|\|\|DRU:Index:Float DRU.5 11 202 0x100002 16 4\|\|\|0\|\|\|DRU:Restart Counter:Float DRU.5 12 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Lon

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\is-FPDCL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	Generic INItialization configuration [drucapa]
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.696032879598639
Encrypted:	false
SSDEEP:	3:7F8zRIXKyJHSKVJ+3fsfWcYFHyeWiXAsLvsXAsNYRekGW0AsfUeov:7SzEhyM+3fTysQCEQDRepk/eov
MD5:	22C30E24367DBB6D49595D5FDD86CC43
SHA1:	19FF654DFFAB542693655C4309FB46DC442A1A56
SHA-256:	3D2633567D669EF6DD0893974361204F643A898CA70EF2181A99EEAD3F6F78CC
SHA-512:	EE63A543A85F5FCE18B87AFEEABB55444702F1D9B46B52CFF35C7982CB40BB67E9DE37C711E74A76138FB9C918E39169F2D614AC9A35F087E61A5DC5DCF8B2FE
Malicious:	false
Preview:	[extract]..restore = /opt/vr/data/restore;....[drucapa]..capacity = 30000;....[audio]..startOffset = 4600..deliveryCount = 1;..;startOffset = 7488..;startOffset = 9504..; -4896..;startOffset = 4608..;..

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\is-QA0SP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15231
Entropy (8bit):	4.925537997543363
Encrypted:	false
SSDEEP:	96:5zDyIcDoDJ/KjcvzZBweiQOmVyVW82wqVEOg0exv4Vtvrko77ewTsDT0MdeK9Gp+:5MoDJCjc9Bw7tmkYgUpRXOwaSkkZo
MD5:	E124442EA562DF4F5A0161C90F7260B9
SHA1:	8F094E53D28AEC72A142FE6006B5FB09D57D102B
SHA-256:	AA3D53E75081C9983C038DCA5454AABA581048B35AC28F8E152108133770E13C
SHA-512:	7281D01BEA7CDBC8D19042898E02F577CCB8C656DF8EDF71B0CE7247BA7EDCDE792ECB6478330673C64059DBC49C35557C175E3A1BF614D1F279A87F16B485A4
Malicious:	false
Preview:	412951\|3003\|0\|-\|Lost Connection\|B\|C\|0\|0\|0\|-..412082\|3003\|1\|-\|Lost RAP\|B\|C\|0\|0\|0\|Restart VDR...412301\|3003\|2\|-\|Lost Serial Ch01\|B\|C\|0\|0\|0\|Check Ch01 connected sensor...412302\|3003\|3\|-\|Lost Serial Ch02\|B\|C\|0\|0\|0\|Check Ch02 connected sensor...412303\|3003\|4\|-\|Lost Serial Ch03\|B\|C\|0\|0\|0\|Check Ch03 connected sensor...412304\|3003\|5\|-\|Lost Serial Ch04\|B\|C\|0\|0\|0\|Check Ch04 connected sensor...412305\|3003\|6\|-\|Lost Serial Ch05\|B\|C\|0\|0\|0\|Check Ch05 connected sensor...412306\|3003\|7\|-\|Lost Serial Ch06\|B\|C\|0\|0\|0\|Check Ch06 connected sensor...412307\|3003\|8\|-\|Lost Serial Ch07\|B\|C\|0\|0\|0\|Check Ch07 connected sensor...412308\|3003\|9\|-\|Lost Serial Ch08\|B\|C\|0\|0\|0\|Check Ch08 connected sensor...412309\|3003\|10\|-\|Lost Serial Ch09\|B\|C\|0\|0\|0\|Check Ch09 connected sensor...412310\|3003\|11\|-\|Lost Serial Ch10\|B\|C\|0\|0\|0\|Check Ch10 connected sensor...412311\|3003\|12\|-\|Lost Serial Ch11\|B\|C\|0\|0\|0\|Check Ch11 connected sensor...412312\|3003\|13\|-\|Lost Serial Ch12\|B\|C\|0\|0\|0\|Check Ch12 connected sensor...412313\|3003\|14\|-\|Lost Seri

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\monattr.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	280471
Entropy (8bit):	4.825966410766605
Encrypted:	false
SSDEEP:	6144:c05idHv11NzvZpLxxLXzVL8qXRCdVijVz3hxJrj9lgWD9njTBbNv/UMJH4URnrKy:xreX
MD5:	A602B91DDC542E56F4D2A44E6D25D638
SHA1:	EC4A4C9EBDFFC358E7EA640CC39DB3532145FA88
SHA-256:	8F10D42FF5383DA8FAEEAD0C4F0B9C91AD4B1278CB8EF42884CB99300B46B1B1
SHA-512:	2D27636FB8572617B526C376CAF51B2A21C208DD29E7AEF5AB91019624C59E580E85D2AED3E2DB4DB6C9650638AABF2DA4207D7E2263804C489DCDA9D3959F32
Malicious:	false
Preview:	@i 0 5 0 0 0 278 840 0 0 476 1376 1174 35 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100001 13 4\|\|\|0\|\|\|DRU:Device Num:Fixed DRU.5 3 202 0x100001 14 4\|\|\|0\|\|\|DRU:Round Trip:Fixed DRU.5 4 202 0x100001 15 4\|\|\|0\|\|\|DRU:Index:Fixed DRU.5 5 202 0x100001 16 4\|\|\|0\|\|\|DRU:Restart Counter:Fixed DRU.5 6 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 7 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 8 202 0x100002 13 4\|\|\|0\|\|\|DRU:Device Num:Float DRU.5 9 202 0x100002 14 4\|\|\|0\|\|\|DRU:Round Trip:Float DRU.5 10 202 0x100002 15 4\|\|\|0\|\|\|DRU:Index:Float DRU.5 11 202 0x100002 16 4\|\|\|0\|\|\|DRU:Restart Counter:Float DRU.5 12 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Lon

C:\Program Files (x86)\FURUNO\VR-7000\server\data\onlndb\sporadic.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	66614
Entropy (8bit):	4.712231082284398
Encrypted:	false
SSDEEP:	1536:MwdHuAW61Np1wn0ZyGLOSxLlxzVL8qX7MueZrql:1dHv11Nzw0ZpLOSxLlxzVL8qXQuehql
MD5:	E566BB30590682C468E9F9AF0B4F514B
SHA1:	CFE919552115B95CAB2FB11ABAA112814BFA2014
SHA-256:	221D72A03B4C2B164D455D763484EA27712B20CF383C2B3E272F0DC9429775A4
SHA-512:	ECB0DB14DEC33640A0F59EFAADE432F1DFC4F41999C5DCDD79EA9032446976B5C9B19EF72E60CD5F23100CB18C05BC7A8DE05020AEB656A7BC309E55DC228299
Malicious:	false
Preview:	@i 0 5 0 0 0 6 778 0 0 0 0 268 2 0 0 0 0.1 0 502 0x100001 10 4\|\|\|0\|\|\|PowerSupply:status:AC Status.1 1 502 0x100002 10 4\|\|\|0\|\|\|PowerSupply:status:DC Status.1 2 502 0x100003 10 4\|\|\|0\|\|\|PowerSupply:status:Battery Status.1 3 503 0x100001 10 4\|\|\|1\|\|\|VdrButtons:save:Vdr Buttons.1 4 503 0x100001 12 4\|\|\|0\|\|\|VdrButtons:error:Vdr Buttons.5 0 202 0x100001 10 4\|\|\|0\|\|\|DRU:areaNo:Fixed DRU.5 1 202 0x100001 12 4\|\|\|0\|\|\|DRU:SIZE:Fixed DRU.5 2 202 0x100002 10 4\|\|\|0\|\|\|DRU:areaNo:Float DRU.5 3 202 0x100002 12 4\|\|\|0\|\|\|DRU:SIZE:Float DRU.5 4 203 0x100001 10 4\|\|\|0\|\|\|HDD:areaNo:Long Term Device.5 5 203 0x100001 12 4\|\|\|0\|\|\|HDD:SIZE:Long Term Device.6 0 110 0x100001 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH001.6 1 110 0x100002 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH002.6 2 110 0x100003 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH003.6 3 110 0x100004 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH004.6 4 110 0x100005 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH005.6 5 110 0x100006 1 4\|\|\|0\|\|\|analog value:Raw Data:AICH006.6 6 110 0x100007 1 4\|\|\|0\|\|

C:\Program Files (x86)\FURUNO\VR-7000\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	InnoSetup Log 64-bit VR-7000, version 0x30, 47187 bytes, 367706\user, "C:\Program Files (x86)\FURUNO"
Category:	dropped
Size (bytes):	47187
Entropy (8bit):	5.268681994115016
Encrypted:	false
SSDEEP:	384:rTmyYwTVQZ2wVPsxdfb7I45ahkbqrczJTYAzuu4pQcC2eRJuF3lb8MsmzMKKVOpX:BY+E2Rlb7I45ahkicDZzk
MD5:	E3ABB886BEB485F62673802958B9F5AA
SHA1:	3EE9569E25C4037E40468DD9B4619B41C0ADA5BB
SHA-256:	ED31504CF8BF8D034BA4BE429A845B43D7168B457E6FA9913C2919138B359C77
SHA-512:	2906D00EE9A3096516DFFC90B93D918322C64911BDED03650AF9FF58A19FA1E680FDC9D1771B8376FC643705111D9B5E9D65C94B89E6D5D9E9B64A150516D20D
Malicious:	false
Preview:	Inno Setup Uninstall Log (b) 64-bit.............................VR-7000.........................................................................................................................VR-7000.........................................................................................................................0.......S...%...............................................................................................................=...........4......=....367706.user.C:\Program Files (x86)\FURUNO...........,.(.P.. .......... .................................C:\Program Files (x86)\FURUNO<C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000.VR-7000.default...."........C:\Program Files (x86)\FURUNO..."...'...%C:\Program Files (x86)\FURUNO\VR-7000..."...+...)C:\Program Files (x86)\FURUNO\VR-7000\jre...".../...-C:\Program Files (x86)\FURUNO\VR-7000\jre\lib..."...6...4C:\Program Files (x86)\FURUNO\VR-7000\jre\lib\applet...".......,C:\Program Files (x86)\FURUNO\VR-7000\ser

C:\Program Files (x86)\FURUNO\VR-7000\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	717985
Entropy (8bit):	6.514892357658037
Encrypted:	false
SSDEEP:	12288:6TPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5MRxyFj:SPcYn5c/rPx37/zHBA6pFptZ1CEQqMRG
MD5:	7ED0852A51DF0E4AD455F7EA3F39E596
SHA1:	113630652C21A6D5F6498E06475D89AA850A4149
SHA-256:	0BD7976242464961623A701A9744FCAD739702BC2C55FE080165E3DC33F33363
SHA-512:	201689B8BCEAA91967F3A65176756CD98618F0CAFEA7C8BAA3EF5AA06CE8F05AD858B2DD04A7D433530D2D0805E0FE302AF628B46D24A1426350223FB5B1D6E2
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..............................................@...............................%..................................................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................T..............@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000 Previous Version\Live Player V5 OLD (01.10).lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Thu Apr 25 01:44:45 2024, mtime=Thu Apr 25 01:44:47 2024, atime=Fri Feb 18 08:16:32 2022, length=35328, window=hide
Category:	dropped
Size (bytes):	1355
Entropy (8bit):	4.593907215258834
Encrypted:	false
SSDEEP:	24:8BJREjdOExePxB+RLA+aJUdyDdyAUU1vqyFm:87OjdO/BW8+aJUdYdaryF
MD5:	13CE1ADECD4649E17AE9923C1CCDE0B9
SHA1:	502D19FA8752842E371CD8D3CE301E5B4F12D6DF
SHA-256:	3C8896A85F387CFA7F995C1E527CCACC1D65F29419DB44F04A24E902E34D26F9
SHA-512:	0A17925B68FA988AFEB56652D5A0BBDF40B4CE28CE431F4B7779291E4265B1C7F990CDC19913F6D40BE297D0387578AD9D6F72318DF0E8CB8A8C3BE126550A8C
Malicious:	false
Preview:	L..................F.... .....B................7.$........................../....P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V.....l...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1......X....FURUNO..>......X...X............................l...F.U.R.U.N.O.....V.1......X....VR-7000.@......X...X............................4N(.V.R.-.7.0.0.0.....T.1......X....Viewer..>......X...X.......+....................6[..V.i.e.w.e.r.....j.2.....RT.J .LIVEPL~1.EXE..N......X...X.......H........................l.i.v.e.p.l.a.y.e.r...e.x.e.......j...............-.......i..............Q.....C:\Program Files (x86)\FURUNO\VR-7000\Viewer\liveplayer.exe..J.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.\.V.i.e.w.e.r.\.l.i.v.e.p.l.a.y.e.r...e.x.e.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.\.V.i.e.w.e.r...p.r.e.v.i.o.u.s

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000 Previous Version\VR-7000 VDR Maintenance Viewer OLD (01.10).lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Thu Apr 25 01:44:45 2024, mtime=Thu Apr 25 01:44:47 2024, atime=Fri Feb 18 08:16:32 2022, length=26624, window=hide
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	4.587136975210344
Encrypted:	false
SSDEEP:	24:8eREjdOExePxBbIRS8AZa2WdybdyAUU1PqyFm:8eOjdO/BguZaXdodaryF
MD5:	FD1171FEE0C855311C9F1B3ACE1DBE27
SHA1:	F3B7CA08A808DA3F9653C502E95DD762786E6760
SHA-256:	7FE731FAF046D43757A845B1C97E87D2183612E02185050D37874D37B3E5CA88
SHA-512:	BFF29B9EE343A816BAD53AD35AD53813CA4E7792F16382825309A7D3FFCBF1620DC6D8A2D46B7F128F9213379E5A93EC4C5F35E6C13DC5904FD1E7052495F83B
Malicious:	false
Preview:	L..................F.... ....3E.....(K.........7.$...h......................1....P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V.....l...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1......X....FURUNO..>......X...X............................l...F.U.R.U.N.O.....V.1......X....VR-7000.@......X...X............................4N(.V.R.-.7.0.0.0.....T.1......X....Viewer..>......X...X.......+....................6[..V.i.e.w.e.r.....l.2..h..RT.J .MAINTE~1.EXE..P......X...X.......H........................m.a.i.n.t.e.n.a.n.c.e...e.x.e.......k...............-.......j..............Q.....C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.exe..K.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.\.V.i.e.w.e.r.\.m.a.i.n.t.e.n.a.n.c.e...e.x.e.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.\.V.i.e.w.e.r...p.r.e.v.i.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000\Live Player V5 (01.64).lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 01:44:45 2024, mtime=Thu Apr 25 01:44:45 2024, atime=Fri Feb 18 08:16:32 2022, length=35328, window=hide
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.593707678754647
Encrypted:	false
SSDEEP:	24:8mks+E7dOEeePxB+RLA+aJUdyDdyDUU1vqyFm:8mtx7dO+BW8+aJUdYdfryF
MD5:	1281DD603D37C5ABE3F0CADD1D313960
SHA1:	633958E7BFCAA8615F6F2F01147A5CACA659AB22
SHA-256:	E5B2A4ED91EC03A569234FA36B4895539986D1D69E0540FEA8C20DEC030F84B8
SHA-512:	3CE34177F6D7F7796842DFB69DC3B57FC9E14DC80331A5BC8CD96129D9A1C42D21CFE66DBE19882E89047E0F187AD6E0719AD0616B98C4052ABE98E07BB9C85F
Malicious:	false
Preview:	L..................F.... .....B......3E........7.$........................../....P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V.....?...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1......X....FURUNO..>......X...X............................l...F.U.R.U.N.O.....V.1......X....VR-7000.@......X...X............................4N(.V.R.-.7.0.0.0.....T.1......X....Viewer..>......X...X.......+....................6[..V.i.e.w.e.r.....j.2.....RT.J .LIVEPL~1.EXE..N......X...X.......H........................l.i.v.e.p.l.a.y.e.r...e.x.e.......j...............-.......i..............Q.....C:\Program Files (x86)\FURUNO\VR-7000\Viewer\liveplayer.exe..J.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.\.V.i.e.w.e.r.\.l.i.v.e.p.l.a.y.e.r...e.x.e.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.\.V.i.e.w.e.r.........*........

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000\VR-7000 Uninstall.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 01:44:40 2024, mtime=Thu Apr 25 01:44:40 2024, atime=Thu Apr 25 01:44:27 2024, length=717985, window=hide
Category:	dropped
Size (bytes):	1208
Entropy (8bit):	4.628404061104646
Encrypted:	false
SSDEEP:	24:8mFuPlREjdOExeP3Q1IQADavdyBHgdyFUU1rqyFm:8mFuPlOjdOm14DavdgHgdRnyF
MD5:	02338BF58D205A89AC552A6DE1BC34B4
SHA1:	D9CBD8C723A2F036210DF1B88A9717A13FAB438B
SHA-256:	81144B23A8739D1C8B2DC2E8EA4E2F49B0B7231869C0B0FEE17873FA654513D3
SHA-512:	8D2D868977B6A9698A63A462EC0829FAA4E89BCBBE8CBCC63F4FBE7CFF6663D140C0C0F519007558EDBB24186B37D8B3D524FA25023969F472E4E1ADCC4478AE
Malicious:	false
Preview:	L..................F.... ...7.4.....7.4......>i}.................................P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V.....l...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1......X....FURUNO..>......X...X............................l...F.U.R.U.N.O.....V.1......X....VR-7000.@......X...X............................4N(.V.R.-.7.0.0.0.....f.2......X.. .unins000.exe..J......X...X......r:......................k.u.n.i.n.s.0.0.0...e.x.e.......a...............-.......`..............Q.....C:\Program Files (x86)\FURUNO\VR-7000\unins000.exe..A.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.\.u.n.i.n.s.0.0.0...e.x.e.%.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.........*................@Z\|...K.J.........`.......X.......367706...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,............

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VR-7000\VR-7000 VDR Maintenance Viewer (01.64).lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Apr 25 01:44:45 2024, mtime=Thu Apr 25 01:44:45 2024, atime=Fri Feb 18 08:16:32 2022, length=26624, window=hide
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	4.581020567254097
Encrypted:	false
SSDEEP:	24:8mJREjdOExePxBbIRS8AZa2WdybdyDUU1PqyFm:8mJOjdO/BguZaXdodfryF
MD5:	0C8C8580C11F2BD955DD1CAA167D194F
SHA1:	47FFDE97FD894B84D99735CE932976B7BA0AF25D
SHA-256:	2E7456C66F61B0582CECD0261AA3F5C7B8EAEFA75DD4C9B26D6F7DA75DF6277C
SHA-512:	56FFC4BACF82967AE88A97D7E519BA6A0EFB99DE5F8FE0DF23AC2D481170B2C51F4B03AB9C3F00B0B09867395E154B40A3FFB0B3DA22C548699598CE3FA6EF1D
Malicious:	false
Preview:	L..................F.... ....3E......3E........7.$...h......................1....P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V.....l...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....T.1......X....FURUNO..>......X...X............................l...F.U.R.U.N.O.....V.1......X....VR-7000.@......X...X............................4N(.V.R.-.7.0.0.0.....T.1......X....Viewer..>......X...X.......+....................6[..V.i.e.w.e.r.....l.2..h..RT.J .MAINTE~1.EXE..P......X...X.......H........................m.a.i.n.t.e.n.a.n.c.e...e.x.e.......k...............-.......j..............Q.....C:\Program Files (x86)\FURUNO\VR-7000\Viewer\maintenance.exe..K.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.\.V.i.e.w.e.r.\.m.a.i.n.t.e.n.a.n.c.e...e.x.e.,.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.F.U.R.U.N.O.\.V.R.-.7.0.0.0.\.V.i.e.w.e.r.........*...

C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp

Download File

Process:	C:\Users\user\Desktop\view_01-64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	706560
Entropy (8bit):	6.506360176420555
Encrypted:	false
SSDEEP:	12288:yTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5MRxyF:6PcYn5c/rPx37/zHBA6pFptZ1CEQqMRU
MD5:	A2C4D52C66B4B399FACADB8CC8386745
SHA1:	C326304C56A52A3E5BFBDCE2FEF54604A0C653E0
SHA-256:	6C0465CE64C07E729C399A338705941D77727C7D089430957DF3E91A416E9D2A
SHA-512:	2A66256FF8535E2B300AA0CA27B76E85D42422B0AAF5E7E6D055F7ABB9E338929C979E185C6BE8918D920FB134B7F28A76B714579CACB8ACE09000C046DD34D6
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................~........................@..............................................@...............................%..................................................................................................................CODE.....}.......~.................. ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................T..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-S4J2T.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.289297026665552
Encrypted:	false
SSDEEP:	48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
MD5:	C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA1:	D0EACD5322C036554D509C7566F0BCC7607209BD
SHA-256:	E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
SHA-512:	2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-S4J2T.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:E:E
MD5:	99621A0530658F18A5D4F84C0FF4B071
SHA1:	23ABE145CB7ADB887055EA16923A32B570272126
SHA-256:	D8F9E37F452811BF847A0D18DAB117087800C5A127E48DA1CCCC53A5EC924298
SHA-512:	6F2F7C151466252B7B1B68A3624DD57C2BE053720DB328532AC080086B98CF9A0488AF62C1EB0F7892CFD6236613557C470E2DAD30260304318D182D3C3C887D
Malicious:	false
Preview:	DONE. ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999844518431257
TrID:	Win32 Executable (generic) a (10002005/4) 98.73% Inno Setup installer (109748/4) 1.08% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	view_01-64.exe
File size:	15'161'609 bytes
MD5:	72ac0fb34f691758105bbc4eb920ad8a
SHA1:	6e4f9dedfeed0d06aec464584ca510ce08cbb5f4
SHA256:	ff6cc44c832e3318bc9d673f8eb053666d38002698814c23c88df9a6d357fd66
SHA512:	637ddbbfd8e384465ce3d6fe38d5d73aaf135998c4ba03db57ffad29c4d2cfdcbe5b140a6bf2920ca3e546b2e378e17c043ad5db89ccfdd44d2e7a720d2753a4
SSDEEP:	393216:FeYI9oIw52l01iwjCL3d1B/b85Mwi/n3oO:FeYI9B99w+dwiP9
TLSH:	FCE633CD322E9D70F65AE07C5B94C7981E37A92D297A1CBD039CA40D2F9FD801B9A135
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x40a5f8
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007FE780AE81A3h
call 00007FE780AE93AAh
call 00007FE780AE9639h
call 00007FE780AE96DCh
call 00007FE780AEB67Bh
call 00007FE780AEDFE6h
call 00007FE780AEE14Dh
xor eax, eax
push ebp
push 0040ACC9h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040AC92h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007FE780AEEBFBh
call 00007FE780AEE7E6h
cmp byte ptr [0040B234h], 00000000h
je 00007FE780AEF6DEh
call 00007FE780AEECF8h
xor eax, eax
call 00007FE780AE8E99h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007FE780AEBC8Bh
mov edx, dword ptr [ebp-10h]
mov eax, 0040CE28h
call 00007FE780AE823Ah
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CE28h]
mov dl, 01h
mov eax, 0040738Ch
call 00007FE780AEC51Ah
mov dword ptr [0040CE2Ch], eax
xor edx, edx
push ebp
push 0040AC4Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FE780AEEC56h
mov dword ptr [0040CE34h], eax
mov eax, dword ptr [0040CE34h]
cmp dword ptr [eax+0Ch], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x2c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9d30	0x9e00	c3bd95c4b1a8e5199981e0d9b45fd18c	False	0.6052709651898734	data	6.631765876950794	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x250	0x400	1ee71d84f1c77af85f1f5c278f880572	False	0.306640625	data	2.751820662285145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe8c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8c4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x2c00	0x2c00	8f3fe7422f44a569a8d94bc5fbbc4e32	False	0.3251953125	data	4.493913254697086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1147c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x119e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x11ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x12574	0x2f2	data			0.35543766578249336
RT_STRING	0x12868	0x30c	data			0.3871794871794872
RT_STRING	0x12b74	0x2ce	data			0.42618384401114207
RT_STRING	0x12e44	0x68	data			0.75
RT_STRING	0x12eac	0xb4	data			0.6277777777777778
RT_STRING	0x12f60	0xae	data			0.5344827586206896
RT_RCDATA	0x13010	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x1303c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x1307c	0x4f4	data	English	United States	0.2547318611987382
RT_MANIFEST	0x13570	0x5a4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.42590027700831024

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Target ID:	0
Start time:	04:44:27
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\view_01-64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\view_01-64.exe"
Imagebase:	0x400000
File size:	15'161'609 bytes
MD5 hash:	72AC0FB34F691758105BBC4EB920AD8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:44:27
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-2G7KF.tmp\view_01-64.tmp" /SL5="$7047C,14900298,56832,C:\Users\user\Desktop\view_01-64.exe"
Imagebase:	0x400000
File size:	706'560 bytes
MD5 hash:	A2C4D52C66B4B399FACADB8CC8386745
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:44:47
Start date:	25/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateService.bat""
Imagebase:	0x7ff65be30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:44:47
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:44:48
Start date:	25/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop "VDR Servers Service"
Imagebase:	0x7ff77f030000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:44:48
Start date:	25/04/2024
Path:	C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe
Wow64 process (32bit):	true
Commandline:	server\bin\ServiceMinit.exe /UnregServer
Imagebase:	0x400000
File size:	245'760 bytes
MD5 hash:	01C338C4765202CB8D712FD7CCDF9BD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:44:48
Start date:	25/04/2024
Path:	C:\Program Files (x86)\FURUNO\VR-7000\server\bin\ServiceMinit.exe
Wow64 process (32bit):	true
Commandline:	server\bin\ServiceMinit.exe /Service
Imagebase:	0x400000
File size:	245'760 bytes
MD5 hash:	01C338C4765202CB8D712FD7CCDF9BD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:44:48
Start date:	25/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\CreateSeverEnvironment.bat""
Imagebase:	0x7ff65be30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:44:48
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:44:48
Start date:	25/04/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	wscript InstSeverEnvironment.vbs
Imagebase:	0x7ff788c80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:44:49
Start date:	25/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\FURUNO\VR-7000\Viewer\CreateLatestBackup.bat""
Imagebase:	0x7ff65be30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:44:49
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:44:49
Start date:	25/04/2024
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /E /Y ..\_previous ..\_latest
Imagebase:	0x7ff77f8b0000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:44:49
Start date:	25/04/2024
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /E /Y /U ..\dlls ..\_latest\dlls
Imagebase:	0x7ff77f8b0000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:44:50
Start date:	25/04/2024
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /E /Y /U ..\server ..\_latest\server
Imagebase:	0x7ff77f8b0000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:44:50
Start date:	25/04/2024
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	false
Commandline:	xcopy /E /Y /U ..\Viewer ..\_latest\Viewer
Imagebase:	0x7ff77f8b0000
File size:	50'688 bytes
MD5 hash:	39FBFD3AF58238C6F9D4D408C9251FF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	1471
Total number of Limit Nodes:	21

Executed Functions

Function 00409B78 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B8A
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B95
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BD6
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409C08
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409C18

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction ID: 4a1d84bb43d4a47cf168f169447d483ed62c711ee8ccb48f5bfbfd053dbeaed9
Opcode Fuzzy Hash: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction Fuzzy Hash: D421A1B16043006BDA309AA99C85E57B7E8AF45360F144C2BFA99E72C3D239FC40C669

Uniqueness

Uniqueness Score: -1.00%

Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

Uniqueness

Uniqueness Score: -1.00%

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040A618), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,0040A618), ref: 004045C6

Strings

kernel32.dll, xrefs: 0040457D
SetDllDirectoryW, xrefs: 00404589
SetProcessDEPPolicy, xrefs: 004045B5
SetSearchPathMode, xrefs: 0040459F

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAB4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040AAC1

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,020F7B98), ref: 0040966C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(0007047C,000000FC,00409960), ref: 0040AB15
RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(0007047C,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

/SL5="$%x,%d,%d,, xrefs: 0040AB55
InnoSetupLdrWindow, xrefs: 0040AAF2
STATIC, xrefs: 0040AAF7

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3757039580-3001827809
Opcode ID: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
Instruction ID: 81987b3bab642c92fe87a7372e0454594c4b8fe140ce311e0f93b1eeebf6ab37
Opcode Fuzzy Hash: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
Instruction Fuzzy Hash: 25412E70604204DBDB10EBA9EE89B9E37A5EB44304F10467FF510B72E2D7B89855CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090C4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090DE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4

Strings

kernel32.dll, xrefs: 004090BF, 004090D9
Wow64DisableWow64FsRedirection, xrefs: 004090BA
Wow64RevertWow64FsRedirection, xrefs: 004090D4
shell32.dll, xrefs: 00409110

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction ID: 214dda5481ef482ebe311b1329301f35405b1013d97e3062c17ffb2c8286d57d
Opcode Fuzzy Hash: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction Fuzzy Hash: 21017C70748342AEFB00BB76DD4AB163A68E785704F60457BF640BA2D3DABD4C04D66E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AAA2 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(0007047C,000000FC,00409960), ref: 0040AB15

Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040AB86,?), ref: 00406B94

Part of subcall function 004099EC: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020F7B98,00409AD8,00000000,00409ABF), ref: 00409A5C
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020F7B98,00409AD8,00000000), ref: 00409A70
Part of subcall function 004099EC: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
Part of subcall function 004099EC: GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020F7B98,00409AD8), ref: 00409AA4

RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(0007047C,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

/SL5="$%x,%d,%d,, xrefs: 0040AB55
InnoSetupLdrWindow, xrefs: 0040AAF2
STATIC, xrefs: 0040AAF7

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
Instruction ID: d3376fcde1141b4290a3dca450fc2844fa47922897975e075ebf06e3b6db64eb
Opcode Fuzzy Hash: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
Instruction Fuzzy Hash: 77411A71604204DFD714EBA9EE85B5A37B5EB48304F20427BF500BB2E1D7B8A855CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004099EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020F7B98,00409AD8,00000000,00409ABF), ref: 00409A5C
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020F7B98,00409AD8,00000000), ref: 00409A70
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,020F7B98,00409AD8), ref: 00409AA4

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,020F7B98), ref: 0040966C

Strings

D, xrefs: 00409A36

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
Instruction ID: b58d0f6e2b8975977e6c7b71aada5392bea55c03070ce9fad3dcef5aa6d4018a
Opcode Fuzzy Hash: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
Instruction Fuzzy Hash: EE1142B16402486EDB00EBE6CC42F9EB7ACEF49714F50013BB604F72C6DA785D048A69

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A814 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

y@, xrefs: 0040A981
.tmp, xrefs: 0040A8BE

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
Instruction ID: 5e9257013af3d55ef2b6e359c41f87f67318ae2a4e6dbf07461b5d8c6de74657
Opcode Fuzzy Hash: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
Instruction Fuzzy Hash: 3B41C030704200CFD311EF25DED1A1A77A5EB49304B214A3AF804B73E1CAB9AC11CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040A82F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

y@, xrefs: 0040A981
.tmp, xrefs: 0040A8BE

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
Instruction ID: 95bba075cf9db07042691c1556ef0613dbe482a65a3614fff4d0ead14828e6f7
Opcode Fuzzy Hash: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
Instruction Fuzzy Hash: E341BE30700200DFC711EF65DED2A1A77A5EB49304B104A3AF804B73E2CAB9AC01CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F

Strings

.tmp, xrefs: 0040935F

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction ID: b240cf9bc22f775501a2d99da134be40bb2f76fb21a7d6e050461713caae6e8b
Opcode Fuzzy Hash: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction Fuzzy Hash: 9E216774A00208ABDB05EFA1C8429DFB7B8EF88304F50457BE901B73C2DA3C9E058A65

Uniqueness

Uniqueness Score: -1.00%

Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409507
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
Opcode Fuzzy Hash: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 004099C0 Relevance: 4.5, APIs: 3, Instructions: 19
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TranslateMessage.USER32 ref: 004099C9
DispatchMessageA.USER32 ref: 004099CF
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 004099DD

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 1802b87248827978fc4904d3dad91f1bd0b0d0248e3ce7d919b28dce25163666
Instruction ID: 1f5564cf95287219c4939fbd1766d219a06dd5c17758edf6696d0a01df122bc8
Opcode Fuzzy Hash: 1802b87248827978fc4904d3dad91f1bd0b0d0248e3ce7d919b28dce25163666
Instruction Fuzzy Hash: B6D012D178030033E82031721CC3F5B100C079172CF24157B7B02792D3E6BDA510506D

Uniqueness

Uniqueness Score: -1.00%

Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

Uniqueness

Uniqueness Score: -1.00%

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00408FBC Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FF3
GetLastError.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FFB

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
Instruction ID: 1f0403e6899a51d1d5356f81b6020870d4ad1054c4e625117792cee712869c3b
Opcode Fuzzy Hash: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
Instruction Fuzzy Hash: 16F0C871A04704ABCB01DF759D4159DB3E8DB8831475045BBF814F3682EA385E108599

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC4F Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(0007047C,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Part of subcall function 004094D8: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
String ID:
API String ID: 2192421792-0
Opcode ID: 2c973cdf999bbb1192929a8364406a109d64bb88cfdea17aa602a860d5632052
Instruction ID: be585450a05658aa0cbbe96fcd01bcdb7ec8c3c433658d061b63fb0e61c88a9e
Opcode Fuzzy Hash: 2c973cdf999bbb1192929a8364406a109d64bb88cfdea17aa602a860d5632052
Instruction Fuzzy Hash: 24F03170244200DBD724EB69EEC9B1632A5A784305F10423BF500B72F1C7FC98A1CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406FAA
LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568

Uniqueness

Uniqueness Score: -1.00%

Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020E03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

Uniqueness

Uniqueness Score: -1.00%

Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB

Uniqueness

Uniqueness Score: -1.00%

Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020E03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Uniqueness

Uniqueness Score: -1.00%

Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F

Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98

Uniqueness

Uniqueness Score: -1.00%

Function 00409960 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CallWindowProcA.USER32(FFFF0489,?,?,?,?), ref: 004099B1

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: d47673c21cdf8bedaefe554fec503b575a75a474267a2dbf9455b1d63e9c71b8
Instruction ID: e57f10db922cec4d4aa75c49cba833a2d307090ecd0f1caf60a141382681e8b2
Opcode Fuzzy Hash: d47673c21cdf8bedaefe554fec503b575a75a474267a2dbf9455b1d63e9c71b8
Instruction Fuzzy Hash: 8DF096B02042089BDB10CE5DCD449AB33D8EB8C300F44853EB505A7395C37CDC118BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428

Uniqueness

Uniqueness Score: -1.00%

Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020E03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676

Uniqueness

Uniqueness Score: -1.00%

Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F

Uniqueness

Uniqueness Score: -1.00%

Function 0040995E Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CallWindowProcA.USER32(FFFF0489,?,?,?,?), ref: 004099B1

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cd8b3a923812b403d100148a9a9efe44a0198c26f302b53ce8b31bb20f351b7a
Instruction ID: 5aacb6b592f2088f07acfaa9316de6eac8589a4f62fc3c725c92bc6cd7e99d3e
Opcode Fuzzy Hash: cd8b3a923812b403d100148a9a9efe44a0198c26f302b53ce8b31bb20f351b7a
Instruction Fuzzy Hash: 05E01AB13001086BD704DEADCD54D7B73DD9BCC300B04C52A7609D7399D534EC014768

Uniqueness

Uniqueness Score: -1.00%

Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,020F7BEC,0040AA59,00000000), ref: 004076B3

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020E03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666

Uniqueness

Uniqueness Score: -1.00%

Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519

Uniqueness

Uniqueness Score: -1.00%

Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B

Uniqueness

Uniqueness Score: -1.00%

Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Uniqueness

Uniqueness Score: -1.00%

Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407558

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D

Uniqueness

Uniqueness Score: -1.00%

Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00409457
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040949D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004094A2
ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3

Strings

SeShutdownPrivilege, xrefs: 0040946F

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F

Uniqueness

Uniqueness Score: -1.00%

Function 00409C34 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409C3E
SizeofResource.KERNEL32(00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 00409C51
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000), ref: 00409C63
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92), ref: 00409C74

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction ID: 5c2a5118689e511edc0a9dde7e1b9e77d0383d271af581b44440e1e73e890ea9
Opcode Fuzzy Hash: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction Fuzzy Hash: B0E07E80B8874726FA6576FB08C7B6B008C4BA570EF00003BB700792C3DDBC8C04462E

Uniqueness

Uniqueness Score: -1.00%

Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76

Uniqueness

Uniqueness Score: -1.00%

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,0040A622), ref: 00405D02

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040840C Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
Opcode Fuzzy Hash: 4d767100099eb102bdc21c19fdb755dbde7929e86d9821f584b3da527505dd0e
Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 0040704D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 004070A1

Strings

Locale, xrefs: 00407090
.DEFAULT\Control Panel\International, xrefs: 00407078
kernel32.dll, xrefs: 00407048
GetUserDefaultUILanguage, xrefs: 00407043
Control Panel\Desktop\ResourceLocale, xrefs: 004070B0

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E

Uniqueness

Uniqueness Score: -1.00%

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Strings

AMPM, xrefs: 004055A9
m/d/yy, xrefs: 004054AD
:mm, xrefs: 004055C0
:mm:ss, xrefs: 004055DA
mmmm d, yyyy, xrefs: 004054CF

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C

Uniqueness

Uniqueness Score: -1.00%

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040A60E), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,0040A60E), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103
%d, xrefs: 004030F3

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@$%d
API String ID: 2123368496-819127239
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,00409918,00000000), ref: 00406E4C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC

Strings

)q@, xrefs: 00406F3F, 00406E98, 00406EA8, 00406F04, 00406F28, 00406F18, 00406EEF

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: QueryValue
String ID: )q@
API String ID: 3660427363-2284170586
Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99

Uniqueness

Uniqueness Score: -1.00%

Function 00409C88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 00409CBD

Strings

Setup, xrefs: 00409CAD
The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 00409CA1

Memory Dump Source

Source File: 00000000.00000002.1947836225.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1947805035.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947857775.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947877521.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_view_01-64.jbxd

Similarity

API ID: Message
String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
API String ID: 2030045667-3271211647
Opcode ID: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction ID: b8b600ed6bdfe48e96a015bdf4867c85bc36f5512d0f27a60c0f94c744360238
Opcode Fuzzy Hash: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction Fuzzy Hash: 8EE0E5302482087EE311EA528C13F6A7BACE789B04F600477F900B15C3D6786E00A068

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: view_01-64.tmpPID: 7548, Parent PID: 7532COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	113

Executed Functions

Function 004706A8 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 965COMMON

Download Yara Rule

Strings

Dest file exists., xrefs: 004709BB
Existing file is a newer version. Skipping., xrefs: 00470C02
User opted not to overwrite the existing file. Skipping., xrefs: 00470E4D
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470E96
Will register the file (a DLL/OCX) later., xrefs: 0047151F
@, xrefs: 004707B0
Incrementing shared file count (64-bit)., xrefs: 0047158C
Installing into GAC, xrefs: 00471714
Version of existing file: %u.%u.%u.%u, xrefs: 00470B7C
Same version. Skipping., xrefs: 00470CE5
Couldn't read time stamp. Skipping., xrefs: 00470D35
Time stamp of existing file: (failed to read), xrefs: 00470A37
Time stamp of our file: %s, xrefs: 0047099B
Will register the file (a type library) later., xrefs: 00471513
Version of existing file: (none), xrefs: 00470CFA
Version of our file: %u.%u.%u.%u, xrefs: 00470AF0
Skipping due to "onlyifdestfileexists" flag., xrefs: 00470EFA
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470CB5
Version of our file: (none), xrefs: 00470AFC
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470CC4
Time stamp of our file: (failed to read), xrefs: 004709A7
Stripped read-only attribute., xrefs: 00470EC7
-- File entry --, xrefs: 004706FB
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470CD0
Incrementing shared file count (32-bit)., xrefs: 004715A5
Time stamp of existing file: %s, xrefs: 00470A2B
.tmp, xrefs: 00470FB7
Uninstaller requires administrator: %s, xrefs: 0047118F
Skipping due to "onlyifdoesntexist" flag., xrefs: 004709CE
Existing file is protected by Windows File Protection. Skipping., xrefs: 00470DEC
Failed to strip read-only attribute., xrefs: 00470ED3
Non-default bitness: 64-bit, xrefs: 004708AF
Non-default bitness: 32-bit, xrefs: 004708BB
Same time stamp. Skipping., xrefs: 00470D55
Installing the file., xrefs: 00470F09
InUn, xrefs: 0047115F
Existing file has a later time stamp. Skipping., xrefs: 00470DCF
, xrefs: 00470BCF, 00470DA0, 00470E1E
Dest filename: %s, xrefs: 00470894
Dest file is protected by Windows File Protection., xrefs: 004708ED

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-4021121268
Opcode ID: a27af26e7e39879e55e12172b3fa09cc2b88a96f453993cfd7508716b919e6cb
Instruction ID: 04e5041402f80353ef90c659d92e8d378e84d4fed116f8838aecbbc27e5febe3
Opcode Fuzzy Hash: a27af26e7e39879e55e12172b3fa09cc2b88a96f453993cfd7508716b919e6cb
Instruction Fuzzy Hash: 31927574A0424CDFDB21DFA9C445BDDBBB5AF05304F1480ABE848A7392D7789E49CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0042E09C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
GetVersion.KERNEL32(00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A

Strings

advapi32.dll, xrefs: 0042E107
CheckTokenMembership, xrefs: 0042E102

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: ddfde2249367763e4ec650b3d771d1987385f17006922e03e7cb49a40b8ec1f8
Instruction ID: e5677345bf142a8b1d9111380f95962c8bb8cf61ba8e960ca5c3fd0f127139eb
Opcode Fuzzy Hash: ddfde2249367763e4ec650b3d771d1987385f17006922e03e7cb49a40b8ec1f8
Instruction Fuzzy Hash: E351A271B44215EEEB10EAE69C42BBF77ACEB09704F9404BBB901F7281D57C99018B79

Uniqueness

Uniqueness Score: -1.00%

Function 004502C0 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00480B52), ref: 004502D3
LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480B52), ref: 004502EB
GetProcAddress.KERNEL32(00000000,RmStartSession), ref: 00450309
GetProcAddress.KERNEL32(00000000,RmRegisterResources), ref: 0045031E
GetProcAddress.KERNEL32(00000000,RmGetList), ref: 00450333
GetProcAddress.KERNEL32(00000000,RmShutdown), ref: 00450348
GetProcAddress.KERNEL32(00000000,RmRestart), ref: 0045035D
GetProcAddress.KERNEL32(00000000,RmEndSession), ref: 00450372

Strings

RmEndSession, xrefs: 00450367
Rstrtmgr.dll, xrefs: 004502E6
RmRegisterResources, xrefs: 00450313
RmGetList, xrefs: 00450328
RmShutdown, xrefs: 0045033D
RmStartSession, xrefs: 004502FE
RmRestart, xrefs: 00450352

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 1968650500-3419246398
Opcode ID: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction ID: c77cef2ad5653e61b65a4477cbb73d0d56cf7b8a9d174f96be3e9b6947252677
Opcode Fuzzy Hash: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction Fuzzy Hash: B211F7B4510301DBD710FB61BF45A2E36E9E728315B08063FE804961A2CB7C4844CF8C

Uniqueness

Uniqueness Score: -1.00%

Function 00423C0C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f88a0fad56de9c729f2995427ba7f602706c1c2dd85511d5f0d29e6fe2ee61
Instruction ID: afb4f91cf4018cf9acc1c9974f14325182323c15c0e0405bd0f9b005e596376e
Opcode Fuzzy Hash: a8f88a0fad56de9c729f2995427ba7f602706c1c2dd85511d5f0d29e6fe2ee61
Instruction Fuzzy Hash: 03E1AE31700124EFDB04DF69E989AADB7B5FB54300FA440AAE5559B352C73CEE81DB09

Uniqueness

Uniqueness Score: -1.00%

Function 0042285C Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 3fc7cefd77d309d2013a8afda780c24615e088d2c333d8c3c434309d64232e3f
Instruction ID: 9e9026b6a08d43f4c34b0c014f83afec13b9727198b5f0eb67f7172f0d04fbcb
Opcode Fuzzy Hash: 3fc7cefd77d309d2013a8afda780c24615e088d2c333d8c3c434309d64232e3f
Instruction Fuzzy Hash: 90915171B04214BFDB11EFA9DA86F9D77F4AB04304F5500BAF504AB392CB78AE419B58

Uniqueness

Uniqueness Score: -1.00%

Function 004673A4 Relevance: 15.6, APIs: 4, Strings: 4, Instructions: 1649windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004958CC: GetWindowRect.USER32(00000000), ref: 004958E2

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00467773

Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,0046778D), ref: 0041D6DB

Part of subcall function 00467180: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249
Part of subcall function 00467180: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0

Part of subcall function 00466B40: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58

Part of subcall function 00495B50: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00495B5A

Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0049581C: GetDC.USER32(00000000), ref: 0049583E
Part of subcall function 0049581C: SelectObject.GDI32(?,00000000), ref: 00495864
Part of subcall function 0049581C: ReleaseDC.USER32(00000000,?), ref: 004958B5

Part of subcall function 00495B40: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00495B4A

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 004683FD
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 0046840E
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00468426

Part of subcall function 0042A05C: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A072

Strings

STOPIMAGE, xrefs: 00467768
(Default), xrefs: 00468A0F
, xrefs: 00467835
%H, xrefs: 0046766D, 00467681

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadMessageProcRectReleaseSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE$%H
API String ID: 3231140908-2624782221
Opcode ID: cd61aa661d0cbe35304877807cea77ca0702e96d718fc27b010991c92e86a780
Instruction ID: 1a3196d4b4984e68f3522cc8585b165e0004af585c118fa25862355e2bbb38c0
Opcode Fuzzy Hash: cd61aa661d0cbe35304877807cea77ca0702e96d718fc27b010991c92e86a780
Instruction Fuzzy Hash: 95F2C6346005248FCB00EF69D9D9F9973F1BF49304F1582BAE5049B36ADB74AC46CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00455E0C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42
GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,00455F29,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E98

Strings

kernel32.dll, xrefs: 00455E37
GetDiskFreeSpaceExA, xrefs: 00455E32

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: 409835b603e199d4170178d82c1615a1651ba94ec2cafac24c158ef3a131e909
Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
Opcode Fuzzy Hash: 409835b603e199d4170178d82c1615a1651ba94ec2cafac24c158ef3a131e909
Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68

Uniqueness

Uniqueness Score: -1.00%

Function 00474F88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004750F2,?,?,0049C1E0,00000000), ref: 00474FE1
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,004750F2,?,?,0049C1E0,00000000), ref: 004750BE
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,004750F2,?,?,0049C1E0,00000000), ref: 004750CC

Strings

unins???.*, xrefs: 00474FCB
unins, xrefs: 00475034

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: a279201f9e697c0a7e05849c7d3b952df7516ca14a76b18e0d077e96bcfe2de0
Instruction ID: 191fa049ef1442540897bd6b232d6b1da598bf4afdbbee48782243349675ce5a
Opcode Fuzzy Hash: a279201f9e697c0a7e05849c7d3b952df7516ca14a76b18e0d077e96bcfe2de0
Instruction Fuzzy Hash: 95315074A00548ABCB10EB65CD81BDEB7A9DF45304F50C0B6E40CAB3A2DB789F418B59

Uniqueness

Uniqueness Score: -1.00%

Function 00452A60 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 77a4f9a42a9b182eca9a30cb1eee9c943385d3d0e7805387745d9337962f8593
Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
Opcode Fuzzy Hash: 77a4f9a42a9b182eca9a30cb1eee9c943385d3d0e7805387745d9337962f8593
Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8

Uniqueness

Uniqueness Score: -1.00%

Function 00408568 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8

Uniqueness

Uniqueness Score: -1.00%

Function 00423B84 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 88ecfa13f3ee270e805d5ccef1650ee506ec8760b8390f8b6ad1d401d880426f
Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
Opcode Fuzzy Hash: 88ecfa13f3ee270e805d5ccef1650ee506ec8760b8390f8b6ad1d401d880426f
Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90

Uniqueness

Uniqueness Score: -1.00%

Function 0045559C Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 004555B2

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
Opcode Fuzzy Hash: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756

Uniqueness

Uniqueness Score: -1.00%

Function 0046F058 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046EE44: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,0047620E,?,0049C1E0,?,0046F15B,?,00000000,0046F6F6,?,_is1), ref: 0046EE67

Part of subcall function 0046EEB4: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F532,?,?,00000000,0046F6F6,?,_is1,?), ref: 0046EEC7

RegCloseKey.ADVAPI32(?,0046F6FD,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F748,?,?,0049C1E0,00000000), ref: 0046F6F0

Strings

Inno Setup: Selected Tasks, xrefs: 0046F26F
HelpTelephone, xrefs: 0046F45B
QuietUninstallString, xrefs: 0046F3E7
Readme, xrefs: 0046F4B2
Inno Setup: Selected Components, xrefs: 0046F228
Inno Setup: User, xrefs: 0046F1EA
Comments, xrefs: 0046F4EC
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046F0AE
Inno Setup: App Path, xrefs: 0046F17E
Inno Setup: User Info: Serial, xrefs: 0046F2D0
NoModify, xrefs: 0046F520
Inno Setup: User Info: Name, xrefs: 0046F2A6
Inno Setup: Language, xrefs: 0046F2F7
Inno Setup: Deselected Components, xrefs: 0046F247
Inno Setup: Icon Group, xrefs: 0046F1AD
URLInfoAbout, xrefs: 0046F43E
InstallDate, xrefs: 0046F553
Inno Setup: Setup Version, xrefs: 0046F149
Inno Setup: User Info: Organization, xrefs: 0046F2BB
RegisterPreviousData, xrefs: 0046F6A6
Publisher, xrefs: 0046F421
Contact, xrefs: 0046F4CF
Inno Setup: Deselected Tasks, xrefs: 0046F28E
MajorVersion, xrefs: 0046F57F
Inno Setup: No Icons, xrefs: 0046F1CB
Inno Setup: Setup Type, xrefs: 0046F209
NoRepair, xrefs: 0046F534
InstallLocation, xrefs: 0046F19E
" /SILENT, xrefs: 0046F3DA
EstimatedSize, xrefs: 0046F66D
DisplayName, xrefs: 0046F356
URLUpdateInfo, xrefs: 0046F495
5.5.3 (a), xrefs: 0046F14E
DisplayVersion, xrefs: 0046F404
UninstallString, xrefs: 0046F3AD
ModifyPath, xrefs: 0046F50C
HelpLink, xrefs: 0046F478
_is1, xrefs: 0046F0B4
DisplayIcon, xrefs: 0046F373
MinorVersion, xrefs: 0046F591

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Value$Close
String ID: " /SILENT$5.5.3 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3391052094-3342197833
Opcode ID: 20177b5e09bda3d39b0f5a3b3099d0b20d53ab700288e26487c926a63f738ffb
Instruction ID: 0d1426ff9ce9a688a4d167ea33859b9e50b28094dc6fe7db73e07d6bdcf854ec
Opcode Fuzzy Hash: 20177b5e09bda3d39b0f5a3b3099d0b20d53ab700288e26487c926a63f738ffb
Instruction Fuzzy Hash: D1125935A001089BDB04EF95E881ADE73F5EB48304F24817BE8506B366EB79AD45CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00456638 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

756FE550.OLE32(00499A74,00000000,00000001,00499774,?,00000000,004569E3), ref: 0045667E
756FE550.OLE32(00499764,00000000,00000001,00499774,?,00000000,004569E3), ref: 004566A4
SysFreeString.OLEAUT32(00000000), ref: 0045685B

Strings

IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456892
CoCreateInstance, xrefs: 004566AF
IPersistFile::Save, xrefs: 00456962
IPropertyStore::Commit, xrefs: 004568E3
%ProgramFiles(x86)%\, xrefs: 0045672E
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004567BD
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 00456840
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 00456904
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004567F1
{pf32}\, xrefs: 0045671E
IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 004568CA

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: E550$FreeString
String ID: %ProgramFiles(x86)%\$CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)${pf32}\
API String ID: 491012016-2363233914
Opcode ID: 26ac11ebc8d2bbba6934e2b7da4071208c956f88b3f37f3572524cf0602978ca
Instruction ID: 2d3acbfbfe5134b3b68b6dcde43dfe431d970b0eaffbfac770a5f5266a6492d0
Opcode Fuzzy Hash: 26ac11ebc8d2bbba6934e2b7da4071208c956f88b3f37f3572524cf0602978ca
Instruction Fuzzy Hash: 39B13170A00104AFDB50DFA9C845B9E7BF8AF09706F5540AAF804E7362DB78DD48CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00483A7C Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483A8D
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483A9A
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483AA8
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483AB0
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483ABC
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483ADD
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483AF0
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483AF6
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483B0D

Strings

IsWow64Process, xrefs: 00483AAA
RegDeleteKeyExA, xrefs: 00483AE6
advapi32.dll, xrefs: 00483AEB
GetNativeSystemInfo, xrefs: 00483A94
kernel32.dll, xrefs: 00483A88
GetSystemWow64DirectoryA, xrefs: 00483AD7

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 7dca9948a1095c4364ab55fa8ed369d502b26d1142efbcbd424e95be4cda74f5
Instruction ID: d1db678d6bd555fecb25ccca0b477ef677e73c145b16f55f8d8b06b946339d0c
Opcode Fuzzy Hash: 7dca9948a1095c4364ab55fa8ed369d502b26d1142efbcbd424e95be4cda74f5
Instruction Fuzzy Hash: 7F1181C0204741A4DA00BFB94D45B6F65889B11F2AF040C7B6840AA287EABCEF44A76E

Uniqueness

Uniqueness Score: -1.00%

Function 00473784 Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 585
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,00473D7D,?,?,?,?,00000000,00473ED7,?,?,0049C1E0), ref: 0047390C
RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,00473D7D,?,?,?,?,00000000,00473ED7), ref: 00473915

Part of subcall function 004735D8: GetLastError.KERNEL32(00000000,00000000,00000000,004736AC,?,?,0049C1E0,00000000), ref: 00473665

RegDeleteValueA.ADVAPI32(?,00000000,00000000,00473D6C,?,?,00000000,00473D7D,?,?,?,?,00000000,00473ED7), ref: 00473A33

Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

Part of subcall function 004735D8: GetLastError.KERNEL32(00000000,00000000,00000000,004736AC,?,?,0049C1E0,00000000), ref: 0047367B

Strings

{olddata}, xrefs: 00473ACB, 00473B62
olddata, xrefs: 00473B36, 00473B95
Cannot access 64-bit registry keys on this version of Windows, xrefs: 00473862
break, xrefs: 00473BA3
Failed to parse "qword" value, xrefs: 00473CBF

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DeleteErrorLastValue$CloseCreate
String ID: Cannot access 64-bit registry keys on this version of Windows$Failed to parse "qword" value$break$olddata${olddata}
API String ID: 2638610037-3092547568
Opcode ID: 356c3b5b8d8f4929bc56c1983a8e1045bff08dcde48a4cf0f614ea1849d18e3c
Instruction ID: 3e2b9752622e9f4493cacab5286c5da74f492e684211289e8b809de7765dc76f
Opcode Fuzzy Hash: 356c3b5b8d8f4929bc56c1983a8e1045bff08dcde48a4cf0f614ea1849d18e3c
Instruction Fuzzy Hash: 41321D74E00248AFDB15DFA9D481BDEBBF5AF08305F048066F914AB362DB38AD45DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00468D88 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00468FA2,?,?,00000001,00000000,00000000,00468FBD,?,00000000,00000000,?), ref: 00468F8B

Strings

Inno Setup: App Path, xrefs: 00468E4A
Inno Setup: No Icons, xrefs: 00468E73
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468DE7
Inno Setup: Icon Group, xrefs: 00468E66
Inno Setup: Deselected Tasks, xrefs: 00468F19
%s\%s_is1, xrefs: 00468E05
Inno Setup: Selected Components, xrefs: 00468EAA
Inno Setup: Setup Type, xrefs: 00468E9A
Inno Setup: Deselected Components, xrefs: 00468ECC
Inno Setup: User Info: Serial, xrefs: 00468F6D
Inno Setup: Selected Tasks, xrefs: 00468EF7
Inno Setup: User Info: Name, xrefs: 00468F47
Inno Setup: User Info: Organization, xrefs: 00468F5A

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: b9928a5b5c0cf6c1dc91f6627cbb06318d05b30c5d76f15ccadbaf9fdfcb7506
Instruction ID: 069c4cdb4b1287edb5c1b702bebeb6c44c7684ad2aa17a57d1fdfe9a2539746b
Opcode Fuzzy Hash: b9928a5b5c0cf6c1dc91f6627cbb06318d05b30c5d76f15ccadbaf9fdfcb7506
Instruction Fuzzy Hash: 6B51A330A006449BCB15DB65D881BDEB7F5EB48304F50857EE840AB391EB79AF01CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047C66C Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5), ref: 0042D8AB

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

SHGetKnownFolderPath.SHELL32(00499D30,00008000,00000000,?,00000000,0047C942), ref: 0047C846
757283B0.OLE32(?,0047C88B), ref: 0047C87E

Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049B628,00000000,00000000), ref: 0042D233

Strings

\Program Files, xrefs: 0047C75B
SystemDrive, xrefs: 0047C6D3
cmd.exe, xrefs: 0047C8FC
ProgramFilesDir, xrefs: 0047C734, 0047C7BB
Common Files, xrefs: 0047C7A5
CommonFilesDir, xrefs: 0047C76E, 0047C7EA
Failed to get path of 64-bit Common Files directory, xrefs: 0047C80C
COMMAND.COM, xrefs: 0047C91D
Failed to get path of 64-bit Program Files directory, xrefs: 0047C7DD

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Directory$757283AddressEnvironmentFolderHandleKnownModulePathProcSystemVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 795111782-544719455
Opcode ID: 23963da8b4b34a95ffd58041a931adf40c150fbdd8371ea61f0364dbdea36cdf
Instruction ID: 88e29a10730232d74bbdb0c5b7d00c3ea12cf2700f44d19641833b453bfd909d
Opcode Fuzzy Hash: 23963da8b4b34a95ffd58041a931adf40c150fbdd8371ea61f0364dbdea36cdf
Instruction Fuzzy Hash: 1461CF74A00204AFDB10EBA5D8C2A9E7B69EB44319F90C47FE404A7392DB3C9A44CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00472B48 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472D00
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472E07
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472E1D
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472E42

Strings

.url, xrefs: 00472C1A
Filename: %s, xrefs: 00472CA2
Desktop.ini, xrefs: 00472EC3
.pif, xrefs: 00472BF7, 00472D8B
{group}\, xrefs: 00472BA2
target.lnk, xrefs: 00472E8C
.lnk, xrefs: 00472BD4

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 7a5ae740bf12d7c0914506075995ef9616c65b722964304fe64b2cd854615d78
Instruction ID: 7edda302242157afef40b0e7c7e05039b068dedd9e36cd510e855ba872eb221a
Opcode Fuzzy Hash: 7a5ae740bf12d7c0914506075995ef9616c65b722964304fe64b2cd854615d78
Instruction Fuzzy Hash: D0D14574A001489FDB11EFA9D981BDDBBF4AF08304F50816AF904B7392C778AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00423874 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
RegisterClassA.USER32(00499630), ref: 004238B7
GetSystemMetrics.USER32(00000000), ref: 004238D9
GetSystemMetrics.USER32(00000001), ref: 004238E8
SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2

Strings

|6B, xrefs: 00423893, 00423914

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: |6B
API String ID: 183575631-3009739247
Opcode ID: 5571f2138a9ea83ce0d9c1dcd1b3cc51cb16f92404a0700befc21e2951ab6ca0
Instruction ID: 5979ac727d64f3fe5c9a0a43452729076f54e0f9e4c251b9a4c28f9d6bed272f
Opcode Fuzzy Hash: 5571f2138a9ea83ce0d9c1dcd1b3cc51cb16f92404a0700befc21e2951ab6ca0
Instruction Fuzzy Hash: E63152B17402006AEB10AF69DC82F6A37989B14709F60017BFA44EF2D7C6BDED40876D

Uniqueness

Uniqueness Score: -1.00%

Function 0047CE78 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047CF7A

Strings

shell32.dll, xrefs: 0047CF25
_isetup\_shfoldr.dll, xrefs: 0047CEAA
SHFOLDERDLL, xrefs: 0047CEB7
]xI, xrefs: 0047CF58
Failed to get version numbers of _shfoldr.dll, xrefs: 0047CED0
Failed to get address of SHGetFolderPath function, xrefs: 0047CF8B
SHGetFolderPathA, xrefs: 0047CF6F
Failed to load DLL "%s", xrefs: 0047CF5D
shfolder.dll, xrefs: 0047CEDD, 0047CF16

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$]xI$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-256906917
Opcode ID: c4b8d3d93c7f37bb14fa31bc5bbe574b3393d33fbabbe9beac26f258e91ad005
Instruction ID: ec9c61b31d03a4d18d2fa5da2167344019e511a33ceb5cf80618cf604467b355
Opcode Fuzzy Hash: c4b8d3d93c7f37bb14fa31bc5bbe574b3393d33fbabbe9beac26f258e91ad005
Instruction Fuzzy Hash: 20311D30E001499BCB10EFA5D5D1ADEB7B5EF44308F50847BE504E7281D778AE458B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498BC0), ref: 00406322
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498BC0), ref: 00406366

Strings

SetSearchPathMode, xrefs: 0040633F
SetProcessDEPPolicy, xrefs: 00406355
SetDllDirectoryW, xrefs: 00406329
kernel32.dll, xrefs: 0040631D

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD

Uniqueness

Uniqueness Score: -1.00%

Function 0041321B Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 633COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Strings

yA, xrefs: 004132DE
3A, xrefs: 0041343D

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: LongWindow$Prop
String ID: 3A$yA
API String ID: 3887896539-3278460822
Opcode ID: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction ID: bcb4e109f9bb3244d1d15a250a8b19338fc20a7c4ef9bfc7c396c8b3ff51cb63
Opcode Fuzzy Hash: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction Fuzzy Hash: 8C22D06508E3C05FE31B9B74896A5D57FA0EE13325B1D45DFC4C28B1A3D21E8A8BC71A

Uniqueness

Uniqueness Score: -1.00%

Function 00481854 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00481A11
FreeLibrary.KERNEL32(00000000), ref: 00481A25
SendNotifyMessageA.USER32(0007047C,00000496,00002710,00000000), ref: 00481A97

Strings

GetCustomSetupExitCode, xrefs: 004818B1
DeinitializeSetup, xrefs: 0048190D
Not restarting Windows because Setup is being run from the debugger., xrefs: 00481A46
Deinitializing Setup., xrefs: 00481872
Restarting Windows., xrefs: 00481A72

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 050724d5784164bcc6f320fb88d14c1ed674207e07551f10b43b093d89fd870c
Instruction ID: b122ee3e0244d1cffd13458a0655c780be2d4a3cdc4850abd58d30bc7702deed
Opcode Fuzzy Hash: 050724d5784164bcc6f320fb88d14c1ed674207e07551f10b43b093d89fd870c
Instruction Fuzzy Hash: C651BF347042409FD715EB69E9A5B6E7BE8EB19314F10887BE800C72B2DB389C46CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00467180 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467223
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467249

Part of subcall function 004670C0: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00467158
Part of subcall function 004670C0: DestroyCursor.USER32(00000000), ref: 0046716E

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004672A0
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467301
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467327

Strings

c:\directory, xrefs: 0046721E
shell32.dll, xrefs: 00467284
%H, xrefs: 0046718B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll$%H
API String ID: 3376378930-166502273
Opcode ID: d7a251f7ede599729126a20c6e5bc656e487c76ea0efebb03c6af550fa195c4c
Instruction ID: 732e1a1751fb8a235258c93266195bfa595ebd68417bad8a6af0601d960a2915
Opcode Fuzzy Hash: d7a251f7ede599729126a20c6e5bc656e487c76ea0efebb03c6af550fa195c4c
Instruction Fuzzy Hash: 8A516070604244AFD710DF65CD8AFDFB7A8EB48308F1081A6F80897351D6789E81DA59

Uniqueness

Uniqueness Score: -1.00%

Function 0042F560 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F58F
GetFocus.USER32 ref: 0042F597
RegisterClassA.USER32(004997AC), ref: 0042F5B8
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,00458352,00000000,0049B628), ref: 0042F654

Strings

TWindowDisabler-Window, xrefs: 0042F5EF, 0042F635

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: 6457ecc35c2f1d364d6e716b0d71ec85e57c583cde0b886464f42e17a697c21b
Instruction ID: c3989f54cd535b42bfd745bd8d6279a550c1ea008e6f4be51b2d228796931bcd
Opcode Fuzzy Hash: 6457ecc35c2f1d364d6e716b0d71ec85e57c583cde0b886464f42e17a697c21b
Instruction Fuzzy Hash: B021A170740710BAE310EF66AD43F1A76B8EB04B44F91853BF604AB2E1D7B86D0586AD

Uniqueness

Uniqueness Score: -1.00%

Function 004729F8 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00472AB9,?,?,?,00000008,00000000,00000000,00000000,?,00472D15,?,?,00000000,00472F84), ref: 00472A1C

Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00472AB9,?,?,?,00000008,00000000,00000000,00000000,?,00472D15), ref: 00472A93
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00472AB9,?,?,?,00000008,00000000,00000000,00000000), ref: 00472A99

Strings

desktop.ini, xrefs: 00472A30
CLSID2, xrefs: 00472A46
target.lnk, xrefs: 00472A71
.ShellClassInfo, xrefs: 00472A4B
{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 00472A55

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: d8d5a0be0440fc7cb79ca7a1d8c05833802e09f0bac54326b854a3cb5eabaf25
Instruction ID: 1765d5ebfc4e6887f49e3816ac39c9d5a3c16910e93b0aec031ce55b1572895b
Opcode Fuzzy Hash: d8d5a0be0440fc7cb79ca7a1d8c05833802e09f0bac54326b854a3cb5eabaf25
Instruction Fuzzy Hash: 6711B2707005147BD721EAAA8D82B9F73ACDB49714F61C17BB404B72C2DBBCAE01861C

Uniqueness

Uniqueness Score: -1.00%

Function 004531F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 00453210
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 0045322A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Strings

shell32.dll, xrefs: 0045325C
Wow64RevertWow64FsRedirection, xrefs: 00453220
Wow64DisableWow64FsRedirection, xrefs: 00453206
kernel32.dll, xrefs: 0045320B, 00453225

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: d7661fd9f0913dad122060e2c1ded37189c483bc636f4dff06c0b7ded89dfa78
Instruction ID: a781b9bdaab79611976bfea65fa4e072d6e85bd62b4b6e26dfe65079d72397a7
Opcode Fuzzy Hash: d7661fd9f0913dad122060e2c1ded37189c483bc636f4dff06c0b7ded89dfa78
Instruction Fuzzy Hash: EA01D470240B00FED301AF63AD12F663A58D7557ABF6044BBFC14965C2C77C4A088E6D

Uniqueness

Uniqueness Score: -1.00%

Function 00430940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
GetCurrentThreadId.KERNEL32 ref: 00430971
GlobalAddAtomA.KERNEL32(00000000), ref: 00430992

Strings

WndProcPtr%.8X%.8X, xrefs: 00430983
commdlg_FindReplace, xrefs: 00430952
commdlg_help, xrefs: 00430943

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction ID: 0bd92e6c8c1c5a5b8444157758b44b4e11dae02c37acc47d2edddbd1fb793b69
Opcode Fuzzy Hash: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction Fuzzy Hash: 22F012B0458340DEE300EB65994271E7BD0EF58718F50467FF498A6392D7795904CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 00455010 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7

Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Strings

.bat, xrefs: 004550A0
.cmd, xrefs: 004550BB
D, xrefs: 00455158
cmd.exe" /C ", xrefs: 004550ED
COMMAND.COM" /C , xrefs: 00455124

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 33a21594b2f272348ca173e1bf8fbb29317a3fdaed0398a7107b4f02c3bab763
Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
Opcode Fuzzy Hash: 33a21594b2f272348ca173e1bf8fbb29317a3fdaed0398a7107b4f02c3bab763
Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042368C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
OemToCharA.USER32(?,?), ref: 0042375C
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Strings

2, xrefs: 004236EA
MAINICON, xrefs: 00423711

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: cdc8d4d12959e52a4e35ddab44250c7989461c9b781fe211d3ab07d5faa44346
Instruction ID: 339a64ebbf2375270c19ef2cfa2d714624ee8dcb7e06b01b5ae6522dc3b50067
Opcode Fuzzy Hash: cdc8d4d12959e52a4e35ddab44250c7989461c9b781fe211d3ab07d5faa44346
Instruction Fuzzy Hash: 243181B0A042549ADF10EF29D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418F38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
GetCurrentThreadId.KERNEL32 ref: 00418F79
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A

Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144

Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D

Strings

ControlOfs%.8X%.8X, xrefs: 00418F8B
Delphi%.8X, xrefs: 00418F4F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction ID: d883a59e21ed3b4d0722d018b4a025de81f9e45e1fd093e44b5ebaba0e30331f
Opcode Fuzzy Hash: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction Fuzzy Hash: AC115E706142419AD740FF76A94235A7BE1DF64308F40943FF448A7391DB3DA9448B5F

Uniqueness

Uniqueness Score: -1.00%

Function 0042DE44 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,0049785D), ref: 0042DE6B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71
RegDeleteKeyExA.KERNELBASE(00000000,00000000,00000100,00000000,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000), ref: 0042DE8D

Strings

advapi32.dll, xrefs: 0042DE66
RegDeleteKeyExA, xrefs: 0042DE61

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Delete$AddressHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 636244128-1846899949
Opcode ID: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction ID: e7246de0df94fba710dd2820c0ca51643d5dd29c3ac0bea476bad59fd0e01b91
Opcode Fuzzy Hash: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction Fuzzy Hash: 73E06DF1B41B30AAD72022657C8ABA33729DB75365F658437F105AD19183FC2C50CE9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041363C Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction ID: 06abc153636d574f2b9d5b42ed2ef1d3d1989bf2b09c04f5b7aa0ee96fd2bcf7
Opcode Fuzzy Hash: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction Fuzzy Hash: 1011C975100244BFEF00DF9DDC84EDA37E8EB19364F144666B958DB2A2D738DD908B68

Uniqueness

Uniqueness Score: -1.00%

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
Opcode Fuzzy Hash: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE

Uniqueness

Uniqueness Score: -1.00%

Function 0047CB94 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047CCEA,?,?,00000000,0049B628,00000000,00000000,?,00498539,00000000,004986E2,?,00000000), ref: 0047CC27
GetLastError.KERNEL32(00000000,00000000,00000000,0047CCEA,?,?,00000000,0049B628,00000000,00000000,?,00498539,00000000,004986E2,?,00000000), ref: 0047CC30

Strings

Created temporary directory: , xrefs: 0047CBC9
_isetup, xrefs: 0047CC12
\_setup64.tmp, xrefs: 0047CCA2

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: 15246a7260a354d37efc87005b8c751c01ee3b74e4206f1c0260e9ccc9d04e3e
Instruction ID: e6577b7b61f0e0a35e690824fc442bae28cfcbc8f9cba78cd8161ab2dbd6b5d1
Opcode Fuzzy Hash: 15246a7260a354d37efc87005b8c751c01ee3b74e4206f1c0260e9ccc9d04e3e
Instruction Fuzzy Hash: E6412834A001099BDB11EFA5D882ADEB7B5EF45309F50843BE81577392DA38AE05CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00423A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A1C), ref: 00423AA8
GetWindow.USER32(?,00000003), ref: 00423ABD
GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

Strings

\AB, xrefs: 00423AF2, 00423AF6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: \AB
API String ID: 4191631535-3948367934
Opcode ID: 1f387ac1e946b45dcea70a74dde1e3cf145931a60cd8f654a7309261af8d74ee
Instruction ID: 3ad81c14f5822e14e615a382c86082b2427cd388a5bf15486a3129e996868218
Opcode Fuzzy Hash: 1f387ac1e946b45dcea70a74dde1e3cf145931a60cd8f654a7309261af8d74ee
Instruction Fuzzy Hash: D6115E70700610ABDB109F28E885F5677E8EB08715F10026AF994AB2E3C378ED41CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0046BB10 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

Need to restart Windows? %s, xrefs: 0046BE95
PrepareToInstall failed: %s, xrefs: 0046BE6E
NextButtonClick, xrefs: 0046BC4C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: 5d17874146d60b75ad460dbe0a65a057f1b706e416996ea922dce04c170435bc
Instruction ID: 9de4db1b3e70fdebeced0fe060001c857bcfdee1b2562a0b259a97201065334e
Opcode Fuzzy Hash: 5d17874146d60b75ad460dbe0a65a057f1b706e416996ea922dce04c170435bc
Instruction Fuzzy Hash: 46D12F34A00108DFCB14EB99D985AED77F5EF49304F5440BAE404EB362D778AE85CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00483084 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,004833D5), ref: 004831A8
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00483246

Strings

, xrefs: 00483303
Need to restart Windows? %s, xrefs: 00483283

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: f3164b8d1c7f9ae2aabe4aebf04c2bbf0d3651d11bf05fff97eb65ef8f772e24
Instruction ID: 855c298393525188f16043e43c8caa20abfdb27870bda8f6eb76b0fac02994d3
Opcode Fuzzy Hash: f3164b8d1c7f9ae2aabe4aebf04c2bbf0d3651d11bf05fff97eb65ef8f772e24
Instruction Fuzzy Hash: 7E918F34A042449FDB10EF69D8C6BAD77E0AF55708F5484BBE8009B362DB78AE05CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0046FADC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

GetLastError.KERNEL32(00000000,0046FCD9,?,?,0049C1E0,00000000), ref: 0046FBB6
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FC30
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FC55

Strings

Creating directory: %s, xrefs: 0046FB9E

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: b081b5451f9253bf7df266bab53e6145b6a86aabad9903036a0d0a35cf4a9b86
Instruction ID: a145aa70eb484b5d007d33f2831cd5d1f219efd535f83afbcf26a903565c5eea
Opcode Fuzzy Hash: b081b5451f9253bf7df266bab53e6145b6a86aabad9903036a0d0a35cf4a9b86
Instruction Fuzzy Hash: 7D512F74E00248ABDB01DBA5D982ADEBBF4AF49304F50847AEC50B7382D7795E08CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00454DD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC

Strings

sfc.dll, xrefs: 00454E44
SfcIsFileProtected, xrefs: 00454E7C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: bb559eb6b427547f50ac361efa45694dce53a5facbc0d321e4ca2111cb35c873
Instruction ID: 709c5f55a6f5f8285c9c61fd8393730e8027effee09c5548c71846991cac34f0
Opcode Fuzzy Hash: bb559eb6b427547f50ac361efa45694dce53a5facbc0d321e4ca2111cb35c873
Instruction Fuzzy Hash: E8419671A04318DBEB20EF59DC85B9DB7B8AB4430DF5041B7A908A7293D7785F88CA1C

Uniqueness

Uniqueness Score: -1.00%

Function 00452510 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,00497900), ref: 00452530
74D41500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,00497900), ref: 0045255D
74D41540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,00497900), ref: 00452577

Strings

%E, xrefs: 004525BB, 00452583

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: D41500D41520D41540
String ID: %E
API String ID: 2153611984-175436132
Opcode ID: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction ID: f5dca5bfdad9659449235e2d7a4f424f1fde127461be4d93bb02e754cc996b3f
Opcode Fuzzy Hash: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction Fuzzy Hash: D2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765

Uniqueness

Uniqueness Score: -1.00%

Function 0044B38C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B401
SelectObject.GDI32(?,00000000), ref: 0044B424
ReleaseDC.USER32(00000000,?), ref: 0044B457

Strings

%H, xrefs: 0044B394

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID: %H
API String ID: 1831053106-1959103961
Opcode ID: 613a86eb96bd964688756472f8397141eb38d2c4caf6b0936a0a8cf616000036
Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
Opcode Fuzzy Hash: 613a86eb96bd964688756472f8397141eb38d2c4caf6b0936a0a8cf616000036
Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Error, xrefs: 00404DB9
Runtime error at 00000000, xrefs: 00404DBE, 00404DD1

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0044B0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,%H,?,?), ref: 0044B11E
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165

Strings

%H, xrefs: 0044B0C8

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID: %H
API String ID: 65125430-1959103961
Opcode ID: b9978a40832644be7eb99ff61e6ae739c3599586bb389d309c0d7579617ef2e1
Instruction ID: fec6fabf6d030a51aab30bc406273ff78954f96defe81b00f374268ef7e1f253
Opcode Fuzzy Hash: b9978a40832644be7eb99ff61e6ae739c3599586bb389d309c0d7579617ef2e1
Instruction Fuzzy Hash: 2A11CBB27046047FEB00DB6A9C91D6F77ECDB49750F10817BF504D72D0D6399E018669

Uniqueness

Uniqueness Score: -1.00%

Function 0042ED38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8

Strings

shlwapi.dll, xrefs: 0042ED73
SHAutoComplete, xrefs: 0042EDA2

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: 42f9dcb05abbf77f41298dba7160eccf52289638d4fdae2cac913a0c4d077c72
Instruction ID: e807f919b0f5f47641bb36d66eaae5ab4e0d2818c3cb02d7dc2bc8906116ae4e
Opcode Fuzzy Hash: 42f9dcb05abbf77f41298dba7160eccf52289638d4fdae2cac913a0c4d077c72
Instruction Fuzzy Hash: 3311A330B00319BBD711EB62FD85B8E7BA8DB55704F90447BF40066291DBB8AE05C65D

Uniqueness

Uniqueness Score: -1.00%

Function 00455A10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E

Strings

PendingFileRenameOperations2, xrefs: 00455A4F
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C
PendingFileRenameOperations, xrefs: 00455A40

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 336a8554af3216e9fad4f98949cc8fac3f30a8fbf7097481dd1a9e766711aba3
Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
Opcode Fuzzy Hash: 336a8554af3216e9fad4f98949cc8fac3f30a8fbf7097481dd1a9e766711aba3
Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C

Uniqueness

Uniqueness Score: -1.00%

Function 00472154 Relevance: 6.3, APIs: 4, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00472325,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1), ref: 00472301
FindClose.KERNEL32(000000FF,0047232C,00472325,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1,?), ref: 0047231F
FindNextFileA.KERNEL32(000000FF,?,00000000,00472447,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1), ref: 00472423
FindClose.KERNEL32(000000FF,0047244E,00472447,?,00000000,?,0049C1E0,00000000,00472515,?,00000000,?,00000000,?,004726E1,?), ref: 00472441

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 65dc353f2030dd18e07aaeef7864a9d66aca62f19fb7e6a9d2780936c582d727
Instruction ID: ff38abb04fb96460afd2c3532f2e87b2ffc4f25b99c166b2ff4046d92e8ebf4f
Opcode Fuzzy Hash: 65dc353f2030dd18e07aaeef7864a9d66aca62f19fb7e6a9d2780936c582d727
Instruction Fuzzy Hash: 3EC14C3490424D9FCF11DFA5C981ADEBBB8FF49304F5080AAE808B3251D7789A46CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0047FCF8 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147,?,?,00000000), ref: 0047FD9E
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147,?,?), ref: 0047FDAB
FindNextFileA.KERNEL32(000000FF,?,00000000,0047FEC4,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147), ref: 0047FEA0
FindClose.KERNEL32(000000FF,0047FECB,0047FEC4,?,?,?,?,00000000,0047FEF1,?,00000000,00000000,?,?,00481147,?), ref: 0047FEBE

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 7885f72f33c927dd17ab6110890c22dfa466a1eb5677d5fc3a671adfc4768c66
Instruction ID: 5570db9595827249690d4c596f970be035a6cb65fb6c4bc3b070d2a6e7e06d26
Opcode Fuzzy Hash: 7885f72f33c927dd17ab6110890c22dfa466a1eb5677d5fc3a671adfc4768c66
Instruction Fuzzy Hash: 34512D71A006499FCB21DF65CC45ADEB7B8EB88319F1084BAA818A7351D7389F89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00421274 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421361
SetMenu.USER32(00000000,00000000), ref: 0042137E
SetMenu.USER32(00000000,00000000), ref: 004213B3
SetMenu.USER32(00000000,00000000), ref: 004213CF

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction ID: 68e231870b0c3442489bede8fdcf2aa1db34e154331db007d9f14f65c1163b63
Opcode Fuzzy Hash: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction Fuzzy Hash: 4641AE3070425447EB20EA3AA9857AB36925B20308F4841BFFC40DF7A3CA7CDD45839D

Uniqueness

Uniqueness Score: -1.00%

Function 00417218 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417260
SetCursor.USER32(00000000), ref: 004172A3
GetLastActivePopup.USER32(?), ref: 004172CD
GetForegroundWindow.USER32(?), ref: 004172D4

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 242b528dc0661d8a8af5a0610b9d1e2f1ff1289e875425a5f099e83dad9ec218
Instruction ID: de3f0dc6b436800086b9427ec8ddd2ec86eeedce3a35093462374e80c8eda50e
Opcode Fuzzy Hash: 242b528dc0661d8a8af5a0610b9d1e2f1ff1289e875425a5f099e83dad9ec218
Instruction Fuzzy Hash: C52183313086118AD720AFA9E945AE733F1EF44754B0544ABF8558B352DB3DDC82CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 00416B42 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B84
SetTextColor.GDI32(?,00000000), ref: 00416B9E
SetBkColor.GDI32(?,00000000), ref: 00416BB8
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69

Uniqueness

Uniqueness Score: -1.00%

Function 00454F7C Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: e6feda7d3358a80d2693463bb1cb51aaf78648cef31b4280cf5022ab190105ae
Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
Opcode Fuzzy Hash: e6feda7d3358a80d2693463bb1cb51aaf78648cef31b4280cf5022ab190105ae
Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78

Uniqueness

Uniqueness Score: -1.00%

Function 004230C8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042311E
EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
ReleaseDC.USER32(00000000,00000000), ref: 00423144

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE

Uniqueness

Uniqueness Score: -1.00%

Function 0047CD48 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047CD69
GetLastError.KERNEL32 ref: 0047CD73
GetTickCount.KERNEL32 ref: 0047CD7D
Sleep.KERNEL32(00000032), ref: 0047CD8D

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 81c97dbf5948de899416f6368447fdcf0451c727da6d5f131c1a33ac7977f59e
Instruction ID: 56d8cd0ebf6ab4a4d31aad6ab38b951dee0ff9c0bbbb70c30f4e079d31b44593
Opcode Fuzzy Hash: 81c97dbf5948de899416f6368447fdcf0451c727da6d5f131c1a33ac7977f59e
Instruction Fuzzy Hash: C6E0ED6A30921149863131AE98CA6AF4D48CBC2324B28853FE08CE6283C89C4C0A867E

Uniqueness

Uniqueness Score: -1.00%

Function 0045C264 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933

FlushFileBuffers.KERNEL32(?), ref: 0045C499

Strings

NumRecs range exceeded, xrefs: 0045C396
EndOffset range exceeded, xrefs: 0045C3CD

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 801dcd038e335b265826125cf8ff6a7c252aa7dfa969982b1ed0869fe0f6d4ae
Instruction ID: 69b4fe9c868b7cadc716880164946defc5db249b4b2908964217ac1dcc813941
Opcode Fuzzy Hash: 801dcd038e335b265826125cf8ff6a7c252aa7dfa969982b1ed0869fe0f6d4ae
Instruction Fuzzy Hash: 4F617334A002588FDB25DF25C891AD9B7B5AF49305F0084DAED88AB353D674AEC8CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0048358C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00483716,?,00000000,00483757,?,?,?,?,00000000,00000000,00000000,?,0046BD99), ref: 004835C5
SetActiveWindow.USER32(?,00000000,00483716,?,00000000,00483757,?,?,?,?,00000000,00000000,00000000,?,0046BD99), ref: 004835D7

Strings

Will not restart Windows automatically., xrefs: 004836F6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: 6a85ffbd85d05442efd69aeba4e15de951a42de5f6e0288b431692a2a75d33eb
Instruction ID: 4bdce942002d158aae482430f0c171f92fa141a3e9c551c877f01fd154286bbb
Opcode Fuzzy Hash: 6a85ffbd85d05442efd69aeba4e15de951a42de5f6e0288b431692a2a75d33eb
Instruction Fuzzy Hash: 7F414870648240BFD321FF68DC92B6D3BE49718B09F6448B7E440573A2E37D9A059B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00498BA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00498BB6), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00498BB6), ref: 00403356

Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498BC0), ref: 00406322
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498BC0), ref: 00406366

Part of subcall function 004063C4: 6F571CD0.COMCTL32(00498BC5), ref: 004063C4

Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2

Part of subcall function 00419040: GetVersion.KERNEL32(00498BDE), ref: 00419040

Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498BF2), ref: 0044F77F
Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049B790,00498BF7), ref: 0044FC1F

Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 00453210
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498C06), ref: 0045322A
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Part of subcall function 004570B4: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8

Part of subcall function 004645F4: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498C1A), ref: 00464603
Part of subcall function 004645F4: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609

Part of subcall function 0046CDF0: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE05

Part of subcall function 00478C20: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498C24), ref: 00478C26
Part of subcall function 00478C20: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478C33
Part of subcall function 00478C20: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478C43

Part of subcall function 00483F88: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484077

Part of subcall function 00495BB4: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 00495BCD

SetErrorMode.KERNEL32(00000001,00000000,00498C6C), ref: 00498C3E

Part of subcall function 00498968: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498C48,00000001,00000000,00498C6C), ref: 00498972
Part of subcall function 00498968: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498978

Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,00498C6C), ref: 00498C9F

Part of subcall function 004825C8: SetActiveWindow.USER32(?), ref: 00482676

Strings

Setup, xrefs: 00498C85

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF571FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
String ID: Setup
API String ID: 3527831634-3839654196
Opcode ID: b35466028edd7e3a1b236c6640422c08041f3fa3d34e6d3560873e5a4108b4d0
Instruction ID: b535e719d7157e93998cc10f536158ae488692691c8c4e2dacdcbf5c7207fd3e
Opcode Fuzzy Hash: b35466028edd7e3a1b236c6640422c08041f3fa3d34e6d3560873e5a4108b4d0
Instruction Fuzzy Hash: 873104312446409FD601BBBBFD5392D3B94EF8A728B91447FF80496693DE3C68508A7E

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC

Strings

$=H, xrefs: 0042DD2F, 0042DC88, 0042DC98, 0042DCF4, 0042DD18, 0042DD08, 0042DCDF

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: QueryValue
String ID: $=H
API String ID: 3660427363-3538597426
Opcode ID: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
Opcode Fuzzy Hash: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00453A24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73

Strings

.tmp, xrefs: 00453A53

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: ad15d04db016d8ec48b224cf88302df48740c9a9b896926c32662353b3187fec
Instruction ID: 2c169793aa1d4e8b0ae54453200dd0eeecd34c8d921a2c5b894f13e1de3ec917
Opcode Fuzzy Hash: ad15d04db016d8ec48b224cf88302df48740c9a9b896926c32662353b3187fec
Instruction Fuzzy Hash: BD213575A002089BDB01EFA5C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00483F88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00483A7C: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483A8D
Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483A9A
Part of subcall function 00483A7C: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483AA8
Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483AB0
Part of subcall function 00483A7C: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483ABC
Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483ADD
Part of subcall function 00483A7C: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483AF0
Part of subcall function 00483A7C: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483AF6

Part of subcall function 00483DA8: GetVersionExA.KERNEL32(?,00483FBA,00000000,0048408F,?,?,?,?,?,00498C29), ref: 00483DB6
Part of subcall function 00483DA8: GetVersionExA.KERNEL32(0000009C,?,00483FBA,00000000,0048408F,?,?,?,?,?,00498C29), ref: 00483E08

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00484077

Strings

SHGetKnownFolderPath, xrefs: 00484062
shell32.dll, xrefs: 0048406C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 3869789854-2936008475
Opcode ID: 24bfbd8baf235fcbd7404033d7799f009542697b8823181e059981251f96c700
Instruction ID: 8066e8dcbdf9c94243579ba2519058cd674f052446347c20ec70bbddfecd8a90
Opcode Fuzzy Hash: 24bfbd8baf235fcbd7404033d7799f009542697b8823181e059981251f96c700
Instruction Fuzzy Hash: 1021F1B06103116AC700BFBE599611B3BA5EB9570C380893FF904DB391D77E68149B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00452908 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 0045293F
GetLastError.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 00452947

Strings

T$H, xrefs: 00452975

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: T$H
API String ID: 2018770650-488339322
Opcode ID: fbcc140a81a3acb9c96393828f2cc587f034b3ec3a8bc9b7824854e1d547cdb8
Instruction ID: a1d21d86fbcf93c7076efe682877c1f84c37cf58088428800e153654eea74c02
Opcode Fuzzy Hash: fbcc140a81a3acb9c96393828f2cc587f034b3ec3a8bc9b7824854e1d547cdb8
Instruction Fuzzy Hash: 05F0C2B2B04608ABDB01EFB59D414AEB7E8EB4E315B6045B7FC04E3742E6B85E148598

Uniqueness

Uniqueness Score: -1.00%

Function 00452E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E47
GetLastError.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E4F

Strings

T$H, xrefs: 00452E7D

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID: T$H
API String ID: 377330604-488339322
Opcode ID: 8769a646033274a50feaa89106c60670f2dbad91017c501587ea10a2b48d2d14
Instruction ID: a8b2bafe79397aca91686f8656b478e2385adfe3b855dfce5f6cc0b9ba314abc
Opcode Fuzzy Hash: 8769a646033274a50feaa89106c60670f2dbad91017c501587ea10a2b48d2d14
Instruction Fuzzy Hash: 70F0FC71A04708AFCF01EF759D4249EB7E8DB4E31575049B7FC14E3642E7785E048598

Uniqueness

Uniqueness Score: -1.00%

Function 0047C5D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047C92C,00000000,0047C942), ref: 0047C63A

Strings

RegisteredOrganization, xrefs: 0047C629
RegisteredOwner, xrefs: 0047C617

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: fe32ea5757c181cea0fad4739291adb7fe5cb56e5df920aee23c3361bee12acf
Instruction ID: 97ba07fcc0924f8d698b93a4c32f8f7a3ceb81663af41ec066a5e596666b9838
Opcode Fuzzy Hash: fe32ea5757c181cea0fad4739291adb7fe5cb56e5df920aee23c3361bee12acf
Instruction Fuzzy Hash: F5F09060700204ABEB00D6A8ACD2BAA3769D750304F60907FA1058F382C679EE019B5C

Uniqueness

Uniqueness Score: -1.00%

Function 0047524C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475483), ref: 00475271
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00475483), ref: 00475288

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

CreateFile, xrefs: 0047527D

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 2c7b4fae504844472e6a07c4f0bcfda842c0d735d71c8af9ff6e211e096a353b
Instruction ID: b0794b45f16520e4762b2717541816a935241bfc2e667b83be7f23d95be3de9d
Opcode Fuzzy Hash: 2c7b4fae504844472e6a07c4f0bcfda842c0d735d71c8af9ff6e211e096a353b
Instruction Fuzzy Hash: 99E06D702403447FEA10FA69CCC6F4A77989B04728F10C152BA48AF3E3C5B9FC808A58

Uniqueness

Uniqueness Score: -1.00%

Function 0042DE1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DE36
;H, xrefs: 0042DE32, 0042DE35

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows$;H
API String ID: 71445658-2565060666
Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4

Uniqueness

Uniqueness Score: -1.00%

Function 004570B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00457044: CoInitialize.OLE32(00000000), ref: 0045704A

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004570D8

Strings

shell32.dll, xrefs: 004570CD
SHCreateItemFromParsingName, xrefs: 004570C3

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: 9d30f7af3022304e39d9007edb753d7b8512de14ad0f58a0e87bb64db50414c6
Instruction ID: 7fba65882f7194314ab185764ebfac318737a269d5660949bdaf7135ffc1064c
Opcode Fuzzy Hash: 9d30f7af3022304e39d9007edb753d7b8512de14ad0f58a0e87bb64db50414c6
Instruction Fuzzy Hash: ECC08CA074860093CB40B3FA344320E1841AB8071FB10C07F7A04A66C7DE3C88088B2E

Uniqueness

Uniqueness Score: -1.00%

Function 0046CDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CE05

Strings

shell32.dll, xrefs: 0046CDFA
SHPathPrepareForWriteA, xrefs: 0046CDF0

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 4f35c33f472421c4948a2ce6cac4f72f28d005e98571f32e7a9733a845a9f857
Instruction ID: c0603f0a452a360a01ce82207306765f02b8a986224f2e77b24b084cc810d505
Opcode Fuzzy Hash: 4f35c33f472421c4948a2ce6cac4f72f28d005e98571f32e7a9733a845a9f857
Instruction Fuzzy Hash: 44B092A060074086DB40B7A298D262B28269740319B20843BB0CC9BA95EB3E88240B9F

Uniqueness

Uniqueness Score: -1.00%

Function 00481C7C Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,00481DB4), ref: 00481D4C
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00481D5D
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00481D75

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: 672145a2bbc7660003845448dd8fd579fca208d3c81716cd1fbd69936c4767aa
Instruction ID: 44f8b16540ed1c6eecf525242fd074403e334eda66194076213ef08da8c10300
Opcode Fuzzy Hash: 672145a2bbc7660003845448dd8fd579fca208d3c81716cd1fbd69936c4767aa
Instruction Fuzzy Hash: 3431D4307043441AD721FB769C82BAE3A989F15318F54483FF901AB2E3CA7CAD09879D

Uniqueness

Uniqueness Score: -1.00%

Function 004243FC Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
TranslateMessage.USER32(?), ref: 0042448F
DispatchMessageA.USER32(?), ref: 00424499

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A

Uniqueness

Uniqueness Score: -1.00%

Function 00416644 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 0041666A
SetPropA.USER32(00000000,00000000), ref: 0041667F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 953367bc10487f5f00132df45b9f4bdc07709d3a3f88142737615a1cc8063318
Instruction ID: 6913c5f2d07602d921388148e43cadd8ab2d6729f30613f48e4cae6714e3bc13
Opcode Fuzzy Hash: 953367bc10487f5f00132df45b9f4bdc07709d3a3f88142737615a1cc8063318
Instruction Fuzzy Hash: ACF01271701210ABDB10AB599C85FA732DCAB09714F16057AB905EF286C778DC40C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE54 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE64
IsWindowEnabled.USER32(?), ref: 0041EE6E
EnableWindow.USER32(?,00000000), ref: 0041EE94

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction ID: 3b4cb379701a2ac24b7d0c87bf9454d2e26b3d0fb89a85d5a5a22e513a73856b
Opcode Fuzzy Hash: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction Fuzzy Hash: EAE06DB5100301AAE301AB2BDC81B5B7A9CAB54350F05843BA9089B292D63ADC408B7C

Uniqueness

Uniqueness Score: -1.00%

Function 00406288 Relevance: 4.5, APIs: 3, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00406289
GlobalUnWire.KERNEL32(00000000), ref: 00406290
GlobalFree.KERNEL32(00000000), ref: 00406295

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Global$FreeHandleWire
String ID:
API String ID: 318822183-0
Opcode ID: 6fb441d58b367f32f482df158d6c8a90520777f868e58a6b13673b60c2f5b21c
Instruction ID: 0bd3332245bc481727117fba3a6c85ee4c387b864c86d5f24a339be909c9c9d3
Opcode Fuzzy Hash: 6fb441d58b367f32f482df158d6c8a90520777f868e58a6b13673b60c2f5b21c
Instruction Fuzzy Hash: 4FA001C4800A01A9DC0432B2080B93B200CD84122C390096B3408BA182887C88401A3D

Uniqueness

Uniqueness Score: -1.00%

Function 00469F1C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0046A02D

Strings

PrepareToInstall, xrefs: 00469FD7, 0046A07E

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: 30e11ce9976a3a5fd6352dee54882fc084dc5e436ff3c9a7e429a444cfd2bee3
Instruction ID: c614f106b7f0b4f176116dff63491c2ec041d81708a05a15fd0d1780f22877a3
Opcode Fuzzy Hash: 30e11ce9976a3a5fd6352dee54882fc084dc5e436ff3c9a7e429a444cfd2bee3
Instruction Fuzzy Hash: 97A14934A00109DFCB00EF99D986EDEB7F5AF48304F5540B6E404AB362D738AE45CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0046C4BC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046C658, 0046C66F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: e5c60157bcf2278da473a52dbfa3e40327efacf8e8b2ac4b78b74c9d89147c88
Instruction ID: 6c3526c54916fe71946563460b5bd12015a165326d65a32731909bc5939f884d
Opcode Fuzzy Hash: e5c60157bcf2278da473a52dbfa3e40327efacf8e8b2ac4b78b74c9d89147c88
Instruction Fuzzy Hash: CF71C370A40215BADB10E766DCD2FEE7BA19F05308F148067F580BB292E779AD458B4E

Uniqueness

Uniqueness Score: -1.00%

Function 004825C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00482676

Strings

InitializeWizard, xrefs: 0048260F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 610dba628312dcddd63cee716be368e1ad8af3103a0d365a4a52240be508be69
Instruction ID: 0fabbc08dbff6a0894d12042e1c617afa12541eacf44f0b659f2bb150b55c2ae
Opcode Fuzzy Hash: 610dba628312dcddd63cee716be368e1ad8af3103a0d365a4a52240be508be69
Instruction Fuzzy Hash: 8311C130204200AFD700EB69EED6B1A37E4E764328F60057BE404D72A1EA796C41CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 0047CD9C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047CDE6

Strings

Failed to remove temporary directory: , xrefs: 0047CDFF

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 45da43fd3ae20599d6e25ac9ed9d33e8d604a7859b1119de6f2a098991fc0130
Instruction ID: ec3213607a6b09ae82705bdd380353c192e2de6e0dbfdfb704aaf67811413441
Opcode Fuzzy Hash: 45da43fd3ae20599d6e25ac9ed9d33e8d604a7859b1119de6f2a098991fc0130
Instruction Fuzzy Hash: 0F01B930644604BADB21EB72ED87BDA7798DB45709F60847FB804A7192EA7CA904C95C

Uniqueness

Uniqueness Score: -1.00%

Function 0047C4F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047C740,00000000,0047C942), ref: 0047C539

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047C509

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 058bbab7ea9ec86a0dd33160b35f36364f977485e0abef3b7f9f2bc760079b92
Instruction ID: acdf9366f140fa0c09696ff4b806567a5b27613a006b44f2785fa8682630d216
Opcode Fuzzy Hash: 058bbab7ea9ec86a0dd33160b35f36364f977485e0abef3b7f9f2bc760079b92
Instruction Fuzzy Hash: 6CF0823170052477DA00A65E6C82B9FA79D8B84758F60403FF508DB242EABAEE0243EC

Uniqueness

Uniqueness Score: -1.00%

Function 0046EE44 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,0047620E,?,0049C1E0,?,0046F15B,?,00000000,0046F6F6,?,_is1), ref: 0046EE67

Strings

Inno Setup: Setup Version, xrefs: 0046EE65

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: 80676ca53bf8d59feef104d4bc7cb567c816a54b460bafb4a4ed583678a3f251
Instruction ID: 37dbbd71146fd60ed96ba35b84ff74d599aeccd68d0f9eb37ee109455dfe34ad
Opcode Fuzzy Hash: 80676ca53bf8d59feef104d4bc7cb567c816a54b460bafb4a4ed583678a3f251
Instruction Fuzzy Hash: B1E06D753012043FE710AA2B9C85F5BBADCDF88365F10403AB908DB392D578DD0181A9

Uniqueness

Uniqueness Score: -1.00%

Function 0046EEB4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F532,?,?,00000000,0046F6F6,?,_is1,?), ref: 0046EEC7

Strings

NoModify, xrefs: 0046EEC5

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: f40bfeae81701b53243146576d0ffb0e6a468f93b3df03c8cd4f9f1e738a44cb
Instruction ID: 84621f748531697c6bb4a8e0450a59e651a2caf9945441e4ffcb8bd5fa838dfd
Opcode Fuzzy Hash: f40bfeae81701b53243146576d0ffb0e6a468f93b3df03c8cd4f9f1e738a44cb
Instruction Fuzzy Hash: F6E04FB4640308BFEB04DB55CD4AF6B77ECDB48714F10405ABA049B281E674FE00C669

Uniqueness

Uniqueness Score: -1.00%

Function 00454100 Relevance: 3.2, APIs: 2, Instructions: 200fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047CDFB,00000000,0047CD48,00000000), ref: 00454322
FindClose.KERNEL32(000000FF,0045434D,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047CDFB,00000000,0047CD48,00000000,00000000), ref: 00454340

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 07b889b83a7295c6f73e667f2b380822f62956f362989e6861c4cee483300a21
Instruction ID: 54d7d993b90550b5414970fc4389b15b7902a372ed294bc13edf2f45dfba5a61
Opcode Fuzzy Hash: 07b889b83a7295c6f73e667f2b380822f62956f362989e6861c4cee483300a21
Instruction Fuzzy Hash: BE817430A0424D9FCF11DFA5C8457EFBB74AF49309F1440A6EC546B3A2D3399A8ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0047E474 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047E753,?,-0000001A,00480609,-00000010,?,00000004,0000001B,00000000,00480956,?,0045DB68), ref: 0047E4EA

Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,004809BD,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E

SendNotifyMessageA.USER32(0007047C,00000496,00002711,-00000001), ref: 0047E6BA

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: 7f479caed6d506e1fedd37a3e9b8fbc918d7d672324c4412b746d2e8a14c4527
Instruction ID: a62c935d52da393e7312112ce75ddb0898731394ffd2a16b1d4fc3e518f8127d
Opcode Fuzzy Hash: 7f479caed6d506e1fedd37a3e9b8fbc918d7d672324c4412b746d2e8a14c4527
Instruction Fuzzy Hash: 5B5195746001049BC710FF67E98169A37E5EB58308B90C67BA8049B3A6DB3CED45CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0047DD98 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047DF83,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047DF3D

Part of subcall function 0042CA00: GetSystemMetrics.USER32(0000002A), ref: 0042CA12

Strings

/G, xrefs: 0047DF6D, 0047DEE0, 0047DEF1, 0047DDD7, 0047DDE2, 0047DE01, 0047DE10

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ByteCharMetricsMultiSystemWide
String ID: /G
API String ID: 224039744-2088674125
Opcode ID: 9f8ad520ff63b3f089cafa147e7d8bbd1691bb3a433f158030b0d1014876a4d7
Instruction ID: 84c81a41a939c89cd5cf89585cf0d961f9543ff151f38a86aad590f5673b43e0
Opcode Fuzzy Hash: 9f8ad520ff63b3f089cafa147e7d8bbd1691bb3a433f158030b0d1014876a4d7
Instruction Fuzzy Hash: 53518070A04215AFDB21DF55D8C4FAA7BB8EF64318F118077E404AB3A1C778AE45CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042DEC0 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: 54e2847b2ed8cbec0c232d6556bf46b22f1e93997a90c035dd6b8310f6c19c74
Instruction ID: d62689c7b7995b9893119ef97773413105dd68debc8ff02f2d4f9d8a28cc91ff
Opcode Fuzzy Hash: 54e2847b2ed8cbec0c232d6556bf46b22f1e93997a90c035dd6b8310f6c19c74
Instruction Fuzzy Hash: DD31B270F04258AEDB11DFA6DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D

Uniqueness

Uniqueness Score: -1.00%

Function 004527E8 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 0045283C
GetLastError.KERNEL32(00000000,00000000,?,?,00458278,00000000,00458260,?,?,?,00000000,00452862,?,?,?,00000001), ref: 00452844

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: c95f5f81879e10580f0beb684fbefc560c00cfbc54ddd80bc382dcc14dc7984f
Instruction ID: fcc055d8c1a696a2a0db1e32a085008d871673fec5534948229a16d4440eefa6
Opcode Fuzzy Hash: c95f5f81879e10580f0beb684fbefc560c00cfbc54ddd80bc382dcc14dc7984f
Instruction Fuzzy Hash: A2113C72600208AF8B40DEA9DD41D9F77ECEB4E310B114567FD18D3241D678EE148B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 07387713778517d694c210176a4718dd0562bb365b6db4bb8115bda04798bcb6
Instruction ID: 3d7a77417cef7b3885e8747e4544195f2de945da78ee84bb1155330bb8f828e3
Opcode Fuzzy Hash: 07387713778517d694c210176a4718dd0562bb365b6db4bb8115bda04798bcb6
Instruction Fuzzy Hash: 0301F771300700AFD700FF69EC52E1B77EDDB46714710807AF500AB3D1D639AC10966A

Uniqueness

Uniqueness Score: -1.00%

Function 0041EEA4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EEF3
EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction ID: bcaa23655132f8f2785c0a842f21b48ac99b37e3223c43442b01e3940dbd0cdf
Opcode Fuzzy Hash: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction Fuzzy Hash: 31015B76A04604BFD706CF6BEC1199ABBE8E789720B22887BEC04D3690E7355C10DF18

Uniqueness

Uniqueness Score: -1.00%

Function 00452C80 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: bd02338dff925e1bcf0a80027825a402961c9c10eaaecac7b210e684feb30c76
Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
Opcode Fuzzy Hash: bd02338dff925e1bcf0a80027825a402961c9c10eaaecac7b210e684feb30c76
Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558

Uniqueness

Uniqueness Score: -1.00%

Function 00452770 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 903dc6f46ae0353656b5ef1fe2250cc8cd8775a19ac3db80fd29e7e5856ea863
Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
Opcode Fuzzy Hash: 903dc6f46ae0353656b5ef1fe2250cc8cd8775a19ac3db80fd29e7e5856ea863
Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C

Uniqueness

Uniqueness Score: -1.00%

Function 0042323C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423249
LoadCursorA.USER32(00000000,00000000), ref: 00423273

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction ID: 5e34cf6406f075c2c63d733b1f02ef4b9a88184ee1572dc0f3c8875cc615d59b
Opcode Fuzzy Hash: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction Fuzzy Hash: 9EF0A711B04254AADA109E7E6CC0D6B72A8DF82735B61037BFA3EC72D1C62E1D414569

Uniqueness

Uniqueness Score: -1.00%

Function 0042E394 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E39E
LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
Opcode Fuzzy Hash: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928

Uniqueness

Uniqueness Score: -1.00%

Function 0046E0E4 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0046E17A), ref: 0046E0EE
756FE550.OLE32(00499B98,00000000,00000001,00499BA8,?,?,0046E17A), ref: 0046E10A

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: E550Version
String ID:
API String ID: 1323609852-0
Opcode ID: 323ef6e325584454da74969db5385277b15969f7569c16a340aaa36caeb4eadb
Instruction ID: e32462cabb755f907f5de1887460af807d545ab7c9798ff14e002636b2035e3f
Opcode Fuzzy Hash: 323ef6e325584454da74969db5385277b15969f7569c16a340aaa36caeb4eadb
Instruction Fuzzy Hash: 90F0A7352812009FEB10975ADC86B8937C47B22315F50007BE04497292D2BD94C0471F

Uniqueness

Uniqueness Score: -1.00%

Function 004162CA Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004162E1
GetClassInfoA.USER32(00000000,?,?), ref: 004162F1

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 1299c1a0664136db271893dd0cc50e967199de2eea8caf0295a053f4b6d41932
Instruction ID: 8e3ee469ef83f81d8c71ae4630d2e8c7c449d5c480d74fd2e2a5eda3e874073d
Opcode Fuzzy Hash: 1299c1a0664136db271893dd0cc50e967199de2eea8caf0295a053f4b6d41932
Instruction Fuzzy Hash: BDE012B26015155ED710DBA89D81EE736DCDB08350B210177BE08CA256D364DD008BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0047C88B Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00499D40,00008000,00000000,?), ref: 0047C89B
757283B0.OLE32(?,0047C8DE), ref: 0047C8D1

Strings

\Program Files, xrefs: 0047C75B
SystemDrive, xrefs: 0047C6D3
cmd.exe, xrefs: 0047C8FC
ProgramFilesDir, xrefs: 0047C734, 0047C7BB
Common Files, xrefs: 0047C7A5
CommonFilesDir, xrefs: 0047C76E, 0047C7EA
Failed to get path of 64-bit Common Files directory, xrefs: 0047C80C
COMMAND.COM, xrefs: 0047C91D
Failed to get path of 64-bit Program Files directory, xrefs: 0047C7DD

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: 757283FolderKnownPath
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 733073498-544719455
Opcode ID: c380859d91d2530b1710b7ab5da91f48806622674321ef44444f1ad2bc0d7433
Instruction ID: f48ec61de784b6bea0373c7a91bc006da4a0813e938d35ae17fa89473a65de5f
Opcode Fuzzy Hash: c380859d91d2530b1710b7ab5da91f48806622674321ef44444f1ad2bc0d7433
Instruction Fuzzy Hash: 22E09230340604BFEB15EB61DC92F6977A8EB48B01B72847BF504E2680D67CAD00DB1C

Uniqueness

Uniqueness Score: -1.00%

Function 004508F8 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,00470149,?,00000000), ref: 0045090E
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,00470149,?,00000000), ref: 00450916

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,00497E2C,00000001,00000000,00000002,00000000,00497F8D,?,?,00000005,00000000,00497FC1), ref: 004506B7

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: da9b101d890a5785f8a9e71de1b90467d9f3c90ee8d89fa87e0c2c0eb401b44d
Instruction ID: 32d43412562f4d6ab64aa8be608e77008e370c57458e4df53f7444e76f76d0cb
Opcode Fuzzy Hash: da9b101d890a5785f8a9e71de1b90467d9f3c90ee8d89fa87e0c2c0eb401b44d
Instruction Fuzzy Hash: 0EE012E93042015BF700EA6599C1B2F22DCDB44315F00446ABD44CA28BE678CC048B29

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFF4 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F00E
EnumThreadWindows.USER32(00000000,0041EF90,00000000), ref: 0041F014

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 28faba8d13260114aebe4435219a546304dde162066a62bc81d999aa95987238
Instruction ID: 1bd0ab66c6aeceffdc4f5e21b8af03a27ec20acb013402289ac5ff21683637d0
Opcode Fuzzy Hash: 28faba8d13260114aebe4435219a546304dde162066a62bc81d999aa95987238
Instruction Fuzzy Hash: EBE02676600200AEDB12DF7AAD4575B37D0A394314F12483FA904D61A1D2745C84DB19

Uniqueness

Uniqueness Score: -1.00%

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 004085DC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB

Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction ID: 9026c6f0acc6bf601755118861b832b1e3c4c92574a9a05948c89544872af2a3
Opcode Fuzzy Hash: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction Fuzzy Hash: 47314E35E00109ABCB00EB55CC819EEB779EF84314F558577E815BB286EB38AA018B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0046C450 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C4AE,?,00000000,?,?,0046C6C0,?,00000000,0046C734), ref: 0046C492

Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: 0af19ab3550c8734ef4e1cf2f84aef4c41dad365f35295dd8d2c2646a272cfa9
Instruction ID: eef1953176fed27c4f60a3b97998f4e8fb1447464a393d6256780c84e8a913cd
Opcode Fuzzy Hash: 0af19ab3550c8734ef4e1cf2f84aef4c41dad365f35295dd8d2c2646a272cfa9
Instruction Fuzzy Hash: 5AF0B471248300BFE705DF62ECA6B35B6E8D748714F61047BF40886590E97D5844D51E

Uniqueness

Uniqueness Score: -1.00%

Function 00416550 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 004149B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004507C4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
Opcode Fuzzy Hash: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042CCCC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 93d9079c03dc8f32fd5285902e105fc94467d2f9586780870fbde36cd9cf365c
Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
Opcode Fuzzy Hash: 93d9079c03dc8f32fd5285902e105fc94467d2f9586780870fbde36cd9cf365c
Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468

Uniqueness

Uniqueness Score: -1.00%

Function 0042E8C8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E

Uniqueness

Uniqueness Score: -1.00%

Function 0041AF70 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetTextExtentPointA.GDI32(?,00000000,00000000), ref: 0041AF9B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ExtentPointText
String ID:
API String ID: 566491939-0
Opcode ID: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
Instruction ID: 6b43be1268843882f9474f888990ee0a0f71ddbfb678ee1088bae751a0726d8f
Opcode Fuzzy Hash: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
Instruction Fuzzy Hash: E3E086F13097102BD600E67E1DC19DB77DC8A483697148177F458E7392D62DDE1A43AE

Uniqueness

Uniqueness Score: -1.00%

Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71

Uniqueness

Uniqueness Score: -1.00%

Function 0042DDE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00454BF8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0047096C,00000000,00471782,?,00000000,004717CB,?,00000000,00471904,?,00000000,?,00000000), ref: 00454C0E

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 5fa30469d5901369cae71ef69ad319006633826a63df018e1b1487f7861a22f8
Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
Opcode Fuzzy Hash: 5fa30469d5901369cae71ef69ad319006633826a63df018e1b1487f7861a22f8
Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617

Uniqueness

Uniqueness Score: -1.00%

Function 0041467C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(004959E6,?,00495A08,?,?,00000000,004959E6,?,?), ref: 0041469B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00406F10 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675

Uniqueness

Uniqueness Score: -1.00%

Function 0042364C Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D

ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 5ea0717b5a237d90ae3b60c45d238232e42852dd61880cea7560cbd7bb09fbd7
Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
Opcode Fuzzy Hash: 5ea0717b5a237d90ae3b60c45d238232e42852dd61880cea7560cbd7bb09fbd7
Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C

Uniqueness

Uniqueness Score: -1.00%

Function 004242C4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242DC

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD6C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00452C55,00000000,00452C6E,?,-00000001,00000000), ref: 0042CD77

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abded0c002ebc78192aa504463f5e40d8ea57a748cef45cf468d0a982b541a78
Instruction ID: 2eab32a2699244162946c929296992ee32eb3599f5fc22494aed3d9886f7b4af
Opcode Fuzzy Hash: abded0c002ebc78192aa504463f5e40d8ea57a748cef45cf468d0a982b541a78
Instruction Fuzzy Hash: 51D012D036121015DF1455BD28C535F05884B65375BA82F37B66DE62E2D23D8857281C

Uniqueness

Uniqueness Score: -1.00%

Function 00466B40 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467828,00000000,00000000,00000000,0000000C,00000000), ref: 00466B58

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0042CD24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a2c5bb09e392fd69b508e639abd752817b5c1d67cf81785bd365d6d583db0f26
Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
Opcode Fuzzy Hash: a2c5bb09e392fd69b508e639abd752817b5c1d67cf81785bd365d6d583db0f26
Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818

Uniqueness

Uniqueness Score: -1.00%

Function 00406EC0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Uniqueness

Uniqueness Score: -1.00%

Function 0041F39C Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F3B0

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91

Uniqueness

Uniqueness Score: -1.00%

Function 0045092C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,00497E2C,00000001,00000000,00000002,00000000,00497F8D,?,?,00000005,00000000,00497FC1), ref: 004506B7

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18

Uniqueness

Uniqueness Score: -1.00%

Function 00406F50 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
Instruction ID: 1cff4f98fe1f8e2c1d524c72e998173d896329315b0501cca3ecf0a0fad01fcd
Opcode Fuzzy Hash: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
Instruction Fuzzy Hash: E4B012E13D224A26CB0079FE4CC1D1A00CC4A293063406A3A3006F72C3D83CC8180014

Uniqueness

Uniqueness Score: -1.00%

Function 004072A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,00497DBA,00000000,00497F8D,?,?,00000005,00000000,00497FC1,?,?,00000000), ref: 004072B3

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18

Uniqueness

Uniqueness Score: -1.00%

Function 0047D0CC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00481A2F), ref: 0047D0E2

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 798a4a0ef963ce7c9d3a16661f4bde20b6947b212f410e13b3a4d6eab8997eff
Instruction ID: 195a0cc7c2ab23ef077b9fe4dc52bf4a0a1d122fd989c5672d6e5019e3023c1d
Opcode Fuzzy Hash: 798a4a0ef963ce7c9d3a16661f4bde20b6947b212f410e13b3a4d6eab8997eff
Instruction Fuzzy Hash: D2C00271B902018FC754EB759DD4B6536E49715305F1144775424EB164D6746484CF29

Uniqueness

Uniqueness Score: -1.00%

Function 00481C6C Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 00481C74

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1bc723d2fafea9f50f28bdb772eb68fb7ee591a9533dee5a29c72c4421e393ba
Instruction ID: fbd2fd99f2342ae97ce2e912f06b4f6775a0193fa59faa32ac81747571f1ea96
Opcode Fuzzy Hash: 1bc723d2fafea9f50f28bdb772eb68fb7ee591a9533dee5a29c72c4421e393ba
Instruction Fuzzy Hash: E2A002343C430430F47462511D03F4400441744F05EE1909573053C0C704D82520201E

Uniqueness

Uniqueness Score: -1.00%

Function 004165EC Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004165F3

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3C4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction ID: 3312bc658de40493dbbbdb628fa1ac862c14c743cb2aabe02eeb7d71ec829e14
Opcode Fuzzy Hash: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction Fuzzy Hash: D5115A752007059BCB20DF19D880B82FBE5EF98390F10C53BE9688B385D3B4E8458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00452FC4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 9b36e42861a8e97045d3d1c2d68090febbf4b925d95e27d87fd5eab6f39d8911
Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
Opcode Fuzzy Hash: 9b36e42861a8e97045d3d1c2d68090febbf4b925d95e27d87fd5eab6f39d8911
Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664

Uniqueness

Uniqueness Score: -1.00%

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Uniqueness

Uniqueness Score: -1.00%

Function 00401340 Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000644,?,0049B450,004013A3,?,?,00401443,?,?,?,?,?,00401983), ref: 00401353

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 833cffc3d4ae6fddf196a7017a3fa962a39b4640526386715143ff6d9bbaf8a6
Instruction ID: 71c91fbc4c3ed8fd369fb1531a6952d3d9178ec9d6227f0a2e7a8dd8dab45303
Opcode Fuzzy Hash: 833cffc3d4ae6fddf196a7017a3fa962a39b4640526386715143ff6d9bbaf8a6
Instruction Fuzzy Hash: 0CF05E717013018FE724CF29D980656B7E1EBA9365F24807EE5C5D7761D3358C419B94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041F118 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F

Strings

BtnWndProc3d, xrefs: 0041F252
Ctl3dUnAutoSubclass, xrefs: 0041F228
CTL3D32.DLL, xrefs: 0041F149
Ctl3dRegister, xrefs: 0041F181
Ctl3dDlgFramePaint, xrefs: 0041F1E9
Ctl3dUnregister, xrefs: 0041F1AA
Ctl3dCtlColorEx, xrefs: 0041F1FE
Ctl3dSubclassCtl, xrefs: 0041F1BF
Ctl3dAutoSubclass, xrefs: 0041F213
Ctl3DColorChange, xrefs: 0041F23D
Ctl3dSubclassDlgEx, xrefs: 0041F1D4

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 671fdaa251972b62047104a2fe9ad863bdd7b53d79a33238f475940deae409a8
Instruction ID: e724c2aa341d6685c6ab1c4031cb88844a897dd828fe35f3324890dc483947ec
Opcode Fuzzy Hash: 671fdaa251972b62047104a2fe9ad863bdd7b53d79a33238f475940deae409a8
Instruction Fuzzy Hash: 8E314FB2640700ABEB01EBB9AC46A6B3794F328724741093FB508D7192D77C5C55CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 004585C8 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045862F
QueryPerformanceCounter.KERNEL32(00000000,00000000,004588C2,?,?,00000000,00000000,?,00458FBE,?,00000000,00000000), ref: 00458638
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00458642
GetCurrentProcessId.KERNEL32(?,00000000,00000000,004588C2,?,?,00000000,00000000,?,00458FBE,?,00000000,00000000), ref: 0045864B
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004586C1
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 004586CF
CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,0045887E), ref: 00458717
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0045886D,?,00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,0045887E), ref: 00458750

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004587F9
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045882F
CloseHandle.KERNEL32(000000FF,00458874,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458867

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

Helper process PID: %u, xrefs: 0045884C
helper %d 0x%x, xrefs: 004587D8
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00458697
Starting 64-bit helper process., xrefs: 004585FD
D, xrefs: 00458772
CreateNamedPipe, xrefs: 004586DF
i, xrefs: 004587AC
64-bit helper EXE wasn't extracted, xrefs: 00458623
CreateFile, xrefs: 00458725
Cannot utilize 64-bit features on this version of Windows, xrefs: 00458610
SetNamedPipeHandleState, xrefs: 00458759
CreateProcess, xrefs: 00458802

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: be3e2aad74af535179bad2a73bbdbce7deeedee64d3617dbf3cbed6bd2dfb7d8
Instruction ID: 54c9584e853abf465b9d0f30fdd509929e5717807e8393d963d4681616065440
Opcode Fuzzy Hash: be3e2aad74af535179bad2a73bbdbce7deeedee64d3617dbf3cbed6bd2dfb7d8
Instruction Fuzzy Hash: 19710470A003449EDB11EB65CC45B9E77F4EB05705F1085BAF904FB282DB7899488F69

Uniqueness

Uniqueness Score: -1.00%

Function 00478504 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00478370: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02382BDC,?,?,?,02382BDC,00478534,00000000,00478652,?,?,-00000010,?), ref: 00478389
Part of subcall function 00478370: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047838F
Part of subcall function 00478370: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02382BDC,?,?,?,02382BDC,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783A2
Part of subcall function 00478370: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02382BDC,?,?,?,02382BDC), ref: 004783CC
Part of subcall function 00478370: CloseHandle.KERNEL32(00000000,?,?,?,02382BDC,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783EA

Part of subcall function 00478448: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,004784DA,?,?,?,02382BDC,?,0047853C,00000000,00478652,?,?,-00000010,?), ref: 00478478

ShellExecuteEx.SHELL32(0000003C), ref: 0047858C
GetLastError.KERNEL32(00000000,00478652,?,?,-00000010,?), ref: 00478595
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004785E2
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00478606
CloseHandle.KERNEL32(00000000,00478637,00000000,00000000,000000FF,000000FF,00000000,00478630,?,00000000,00478652,?,?,-00000010,?), ref: 0047862A

Strings

<, xrefs: 0047854B
ShellExecuteEx returned hProcess=0, xrefs: 004785B6
MsgWaitForMultipleObjects, xrefs: 004785EF
GetExitCodeProcess, xrefs: 0047860F
runas, xrefs: 00478559
ShellExecuteEx, xrefs: 004785A6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: 79d3e53d443c3b79e7afe342da530abadc549f51104da72aa591649ec2f08439
Instruction ID: b05a94d88e1d9ee0fbafe330a65326fe691daae9ca7e583bddfe233bc85c86e1
Opcode Fuzzy Hash: 79d3e53d443c3b79e7afe342da530abadc549f51104da72aa591649ec2f08439
Instruction Fuzzy Hash: 0E314470A40208BEDB11EFE6C859ADEB7B8EB45718F50843FF508E7281DA7C99058B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00418384 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418393
GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
GetWindowRect.USER32(?), ref: 004183CC
GetWindowLongA.USER32(?,000000F0), ref: 004183DA
GetWindowLongA.USER32(?,000000F8), ref: 004183EF
ScreenToClient.USER32(00000000), ref: 004183F8
ScreenToClient.USER32(00000000,?), ref: 00418403

Strings

,, xrefs: 0041839C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004555E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F

Strings

SeShutdownPrivilege, xrefs: 0045560B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: df5f2c4a541694cd1c04f8324160b67a3be1538f30066156bb5e3b01538ef1f2
Instruction ID: 23182b732e3c774e917f784577cc733395bd6f0e504c2650860deaf78f25ff04
Opcode Fuzzy Hash: df5f2c4a541694cd1c04f8324160b67a3be1538f30066156bb5e3b01538ef1f2
Instruction Fuzzy Hash: CBF0C870294B41B9EA10A6718C17F3B21C89B40709F80083ABD05E90D3D7BDD40C4A2E

Uniqueness

Uniqueness Score: -1.00%

Function 004980A4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004981E2,?,?,00000000,0049B628,?,0049836C,00000000,004983C0,?,?,00000000,0049B628), ref: 004980FB
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0049817E
FindNextFileA.KERNEL32(000000FF,?,00000000,004981BA,?,00000000,?,00000000,004981E2,?,?,00000000,0049B628,?,0049836C,00000000), ref: 00498196
FindClose.KERNEL32(000000FF,004981C1,004981BA,?,00000000,?,00000000,004981E2,?,?,00000000,0049B628,?,0049836C,00000000,004983C0), ref: 004981B4

Strings

isRS-???.tmp, xrefs: 004980E5
isRS-, xrefs: 0049811B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: cf57b069758ae0ba75426c42834bf48102169a3864c26a2386e50379bf8921c1
Instruction ID: fc6fb5a4e2302b333323d0d019d05182e8323e6fc1a1653111c694b95695a562
Opcode Fuzzy Hash: cf57b069758ae0ba75426c42834bf48102169a3864c26a2386e50379bf8921c1
Instruction Fuzzy Hash: E1316A719016186FCF10EF69CC42ADEBBBCDB45314F5044BBA808E3291DA3C9F458E58

Uniqueness

Uniqueness Score: -1.00%

Function 00457594 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457611
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457638
SetForegroundWindow.USER32(?), ref: 00457649
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00457921,?,00000000,0045795D), ref: 0045790C

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 0045778C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 07d9476e03c8d7360a343fdd7a71a2d4d0b169a7e8f0ef14eb54f7c401357684
Instruction ID: 8776962154e21e4b1c8854f5ca4bcfaa90dd950cda3ad59ac2e2fede597431d6
Opcode Fuzzy Hash: 07d9476e03c8d7360a343fdd7a71a2d4d0b169a7e8f0ef14eb54f7c401357684
Instruction Fuzzy Hash: 2B91D334608204DFEB15CF55E991F5ABBF5EB89704F2184BAE80497792C638AE04DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00417CD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Strings

,, xrefs: 00417D51

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: b31359e3e3f4af84bc1879df8bb30ee95a40fb82c66b770674b351632ff57231
Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
Opcode Fuzzy Hash: b31359e3e3f4af84bc1879df8bb30ee95a40fb82c66b770674b351632ff57231
Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00464158 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,0046433F), ref: 004641CD
FindFirstFileA.KERNEL32(00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 00464213
FindNextFileA.KERNEL32(000000FF,?,00000000,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642C8
FindClose.KERNEL32(000000FF,004642F3,004642EC,?,00000000,?,00000000,0046430A,?,00000001,00000000,0046433F), ref: 004642E6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 2d6811fa06900ad868c15e275c3b50514c610b3d34fade445412cb0d57d1262e
Instruction ID: 9d9184480f8630aada0b530c6bd54f2fc26159d28d851f3c8c43bf9f92f270d6
Opcode Fuzzy Hash: 2d6811fa06900ad868c15e275c3b50514c610b3d34fade445412cb0d57d1262e
Instruction Fuzzy Hash: 77418370A00A18DBCF10EFA5DC959DEB7B8EB88305F5044AAF804A7341E7789E448E59

Uniqueness

Uniqueness Score: -1.00%

Function 00463CDC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00463E99), ref: 00463D0D
FindFirstFileA.KERNEL32(00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463D9C
FindNextFileA.KERNEL32(000000FF,?,00000000,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E2E
FindClose.KERNEL32(000000FF,00463E55,00463E4E,?,00000000,?,00000000,00463E6C,?,00000001,00000000,00463E99), ref: 00463E48

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: bf31d160fcf7ce285bb47ef6c8bba3702c3fba93d44b2e30540216d9a5e040f5
Instruction ID: 85e7d80bc36d7b3e80fea797042c039a90a2821ca6a16b1e557570abf42aa49f
Opcode Fuzzy Hash: bf31d160fcf7ce285bb47ef6c8bba3702c3fba93d44b2e30540216d9a5e040f5
Instruction Fuzzy Hash: 3A41B770A00A589FCB11EF65CC45ADEB7B8EB88705F4044BAF404A7381E67D9F48CE59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E934 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: ca7e64f53124eee773614f4530e241cea0742e07ac6524e5167bff1d6a405f94
Instruction ID: 661b18b1de4eb1238568a50ab540e77c3175952f9b14320adb6d96c9b056064d
Opcode Fuzzy Hash: ca7e64f53124eee773614f4530e241cea0742e07ac6524e5167bff1d6a405f94
Instruction Fuzzy Hash: 80F090B23A17207AF620B57A5C86F7F418CCB89B68F10423BBA04FF1D1D9A85D0555AD

Uniqueness

Uniqueness Score: -1.00%

Function 0048393C Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0048397A
GetWindowLongA.USER32(00000000,000000F0), ref: 00483998
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A8,00482E56,00482E8A,00000000,00482EAA,?,?,?,0049C0A8), ref: 004839BA
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A8,00482E56,00482E8A,00000000,00482EAA,?,?,?,0049C0A8), ref: 004839CE

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: eced40890854bebd7317fa2d6d43d84d766b7a93c8695781d913d3e5347b8eed
Instruction ID: 3cea9153c2b451a1fdc95e78a984a36fb28f479a74ffefb17a89e5a976076ef3
Opcode Fuzzy Hash: eced40890854bebd7317fa2d6d43d84d766b7a93c8695781d913d3e5347b8eed
Instruction Fuzzy Hash: 160156B0705200ABEA00BF659CCBB5F22C55714745F44093BF4459B292CAADDA859B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00462750 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00462824), ref: 004627A8
FindNextFileA.KERNEL32(000000FF,?,00000000,00462804,?,00000000,?,00000000,00462824), ref: 004627E4
FindClose.KERNEL32(000000FF,0046280B,00462804,?,00000000,?,00000000,00462824), ref: 004627FE

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 954d581f0cf53edc7e6b10ce46170be6f6e28a3b9bd67e1e89236dd13880fd9e
Instruction ID: e6acefadc91213b77ea930f6be1f86c6134c8588622ee3d3acab995ed1c325b6
Opcode Fuzzy Hash: 954d581f0cf53edc7e6b10ce46170be6f6e28a3b9bd67e1e89236dd13880fd9e
Instruction Fuzzy Hash: 87210831904B08BECB11EB65CC41ACEB7ACDB49304F5084B7E808E32A1F6789E44CE69

Uniqueness

Uniqueness Score: -1.00%

Function 004241DC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241E4
SetActiveWindow.USER32(?,?,?,0046CD53), ref: 004241F1

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,023825AC,0042420A,?,?,?,0046CD53), ref: 00423B4F

SetFocus.USER32(00000000,?,?,?,0046CD53), ref: 0042421E

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction ID: c953833529836f01456b8f788e47b4b7c36f7a841d6c6df07f57e62630513da6
Opcode Fuzzy Hash: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction Fuzzy Hash: 8CF030B170012097CB10BFAAA8C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778

Uniqueness

Uniqueness Score: -1.00%

Function 00417CCE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 19084698f29920acc68274fefc6d1be37826273bcf8ca1bc36e8902df026f6c2
Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
Opcode Fuzzy Hash: 19084698f29920acc68274fefc6d1be37826273bcf8ca1bc36e8902df026f6c2
Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8

Uniqueness

Uniqueness Score: -1.00%

Function 00417598 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175C3
GetCapture.USER32 ref: 004175CC

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: c8f0edb1377470e81cbec4a2b95b5efcfd9f911131a56f14dd142127f01798ba
Instruction ID: 6cb7601519473143bf4e876ebf6758ccc8fc4fa751d6c6e0357a6193460a6b05
Opcode Fuzzy Hash: c8f0edb1377470e81cbec4a2b95b5efcfd9f911131a56f14dd142127f01798ba
Instruction Fuzzy Hash: 0AF0A4723056425BD730AB2EC984AB762F69F84314B14403BE419CBFA1EB3CDCC08798

Uniqueness

Uniqueness Score: -1.00%

Function 00424194 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042419B

Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724

Uniqueness

Uniqueness Score: -1.00%

Function 004125D8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 52e37b400ef70ce07d55a0833d187e2ce83493dd1eac51222033d67a41acb98e
Instruction ID: 2c049f03cfb376e3baa0368465928f91904f6d03483072bf0e6cb5f6a46bccc5
Opcode Fuzzy Hash: 52e37b400ef70ce07d55a0833d187e2ce83493dd1eac51222033d67a41acb98e
Instruction Fuzzy Hash: 4A5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75D

Uniqueness

Uniqueness Score: -1.00%

Function 00478AC0 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00478C0E

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 844696e8b897343bdf835c25a6a000e65cc716b27902cfddd3917abf911a0a20
Instruction ID: 8fc52e73ba06cc46e730b07d7f7f94568764801a7b8f51cd1014d1f63996c257
Opcode Fuzzy Hash: 844696e8b897343bdf835c25a6a000e65cc716b27902cfddd3917abf911a0a20
Instruction Fuzzy Hash: EC4148B5A44104DFCB10CF99C6888AAB7F5FB49310B64C99AF848DB701D738EE45DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042F520 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 84fa915654b0e9cabe4af8b3610e56d273e883bd018482bfacacc2813b1fcd3b
Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
Opcode Fuzzy Hash: 84fa915654b0e9cabe4af8b3610e56d273e883bd018482bfacacc2813b1fcd3b
Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5

Uniqueness

Uniqueness Score: -1.00%

Function 0044B658 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498BF2), ref: 0044B67F
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3

Strings

GetThemeColor, xrefs: 0044B79D
GetThemeInt, xrefs: 0044B7E5
IsThemeActive, xrefs: 0044B917
IsAppThemed, xrefs: 0044B929
DrawThemeIcon, xrefs: 0044B767
uxtheme.dll, xrefs: 0044B67A
DrawThemeBackground, xrefs: 0044B6B3
GetThemeTextMetrics, xrefs: 0044B71F
GetThemeString, xrefs: 0044B7C1
HitTestThemeBackground, xrefs: 0044B743
EnableThemeDialogTexture, xrefs: 0044B94D
GetCurrentThemeName, xrefs: 0044B995
GetThemeSysSize, xrefs: 0044B8CF
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B78B
GetThemeRect, xrefs: 0044B82D
GetThemeSysColorBrush, xrefs: 0044B8AB
GetThemeFilename, xrefs: 0044B887
GetThemeAppProperties, xrefs: 0044B971
GetThemeTextExtent, xrefs: 0044B70D
GetThemeSysString, xrefs: 0044B8F3
GetThemeMargins, xrefs: 0044B83F
GetThemePartSize, xrefs: 0044B6FB
IsThemeDialogTextureEnabled, xrefs: 0044B95F
GetThemeBackgroundRegion, xrefs: 0044B731
EnableTheming, xrefs: 0044B9CB
GetThemeBackgroundContentRect, xrefs: 0044B6D7, 0044B6E9
GetThemePosition, xrefs: 0044B809
GetThemeSysBool, xrefs: 0044B8BD
GetThemeEnumValue, xrefs: 0044B7F7
IsThemePartDefined, xrefs: 0044B779
CloseThemeData, xrefs: 0044B6A1
GetThemePropertyOrigin, xrefs: 0044B863
SetWindowTheme, xrefs: 0044B875
DrawThemeParentBackground, xrefs: 0044B9B9
GetThemeSysFont, xrefs: 0044B8E1
GetThemeSysInt, xrefs: 0044B905
GetWindowTheme, xrefs: 0044B93B
SetThemeAppProperties, xrefs: 0044B983
GetThemeMetric, xrefs: 0044B7AF
OpenThemeData, xrefs: 0044B68F
DrawThemeEdge, xrefs: 0044B755
GetThemeDocumentationProperty, xrefs: 0044B9A7
DrawThemeText, xrefs: 0044B6C5
GetThemeFont, xrefs: 0044B81B
GetThemeIntList, xrefs: 0044B851
GetThemeSysColor, xrefs: 0044B899
GetThemeBool, xrefs: 0044B7D3

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction ID: e93aa9000a3b975727f71862fff1c9a8a52c50bca2d3d110ef64c9f3a3b13d35
Opcode Fuzzy Hash: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction Fuzzy Hash: D391A8F0A40B11ABEB00EFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD

Uniqueness

Uniqueness Score: -1.00%

Function 00492848 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,00492D3D,?,?,?,?,00000000,00000000,00000000), ref: 00492888
FindWindowA.USER32(00000000,00000000), ref: 004928B9

Strings

OEMTOCHARBUFF, xrefs: 00492C9B
SENDBROADCASTMESSAGE, xrefs: 00492A55
SLEEP, xrefs: 00492872
REGISTERWINDOWMESSAGE, xrefs: 00492A1B
FREEDLL, xrefs: 00492C34
LOADDLL, xrefs: 00492B4B
FINDWINDOWBYWINDOWNAME, xrefs: 004928D1
SENDNOTIFYMESSAGE, xrefs: 004929BF
SENDMESSAGE, xrefs: 0049290D
POSTBROADCASTMESSAGE, xrefs: 00492AA3
POSTMESSAGE, xrefs: 00492963
CALLDLLPROC, xrefs: 00492BAD
FINDWINDOWBYCLASSNAME, xrefs: 00492895
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00492AF7
CHARTOOEMBUFF, xrefs: 00492CDE
CREATEMUTEX, xrefs: 00492C69

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: fe0993328b1714d090c62d4b65a95ce68cbab2884a00f13d32d38987ffe254b3
Instruction ID: 092cd3663c6e49ee7eb77a287a3c2ed341282e51176ce6ebc4a466309821376d
Opcode Fuzzy Hash: fe0993328b1714d090c62d4b65a95ce68cbab2884a00f13d32d38987ffe254b3
Instruction Fuzzy Hash: D9C182A0B042003BDB14BF3E9D4551F59A99F95708B119A3FB446EB78BCE7CEC0A4359

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA0C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CA40
CreateCompatibleDC.GDI32(?), ref: 0041CA4C
CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
CreateCompatibleDC.GDI32(?), ref: 0041CB2B
SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
RealizePalette.GDI32(00000000), ref: 0041CB7D
SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
RealizePalette.GDI32(0041CE3C), ref: 0041CB95
SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
SelectObject.GDI32(00000000,?), ref: 0041CBEE
DeleteDC.GDI32(00000000), ref: 0041CC04

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: 8288b1a004c19d08e53adfd80f36b756ff19622159534b91a17c952f52f31838
Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
Opcode Fuzzy Hash: 8288b1a004c19d08e53adfd80f36b756ff19622159534b91a17c952f52f31838
Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004983D0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00498768,?,?,00000000,?,00000000,00000000,?,00498B1F,00000000,00498B29,?,00000000), ref: 00498453
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498768,?,?,00000000,?,00000000,00000000,?,00498B1F,00000000), ref: 00498466
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498768,?,?,00000000,?,00000000,00000000), ref: 00498476
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00498497
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498768,?,?,00000000,?,00000000), ref: 004984A7

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

Inno-Setup-RegSvr-Mutex, xrefs: 0049845D
.msg, xrefs: 004984CA
/REG, xrefs: 00498405
/REGU, xrefs: 00498429
Setup, xrefs: 0049843F
.lst, xrefs: 004984E4

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 6acfce5c0d266c00f3cb08664922df7ad17872da4bad7acadb5bfb626d6c80a7
Instruction ID: 1a66146e65e487955493167600903b91e60bc3637ed1504a34615a6495e02ea1
Opcode Fuzzy Hash: 6acfce5c0d266c00f3cb08664922df7ad17872da4bad7acadb5bfb626d6c80a7
Instruction Fuzzy Hash: 5191A434A042049FDF11EBA9DC52BAE7BE5EF4A304F5144BBF500AB692DE7C9C05CA19

Uniqueness

Uniqueness Score: -1.00%

Function 0045A6D8 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A994,?,?,?,?,?,00000006,?,00000000,0049785D,?,00000000,00497900), ref: 0045A846

Strings

Stripped read-only attribute., xrefs: 0045A81F
The file appears to be in use (%d). Will delete on restart., xrefs: 0045A88F
.chw, xrefs: 0045A78D
Failed to strip read-only attribute., xrefs: 0045A82B
.chm, xrefs: 0045A774
.hlp, xrefs: 0045A70F
.gid, xrefs: 0045A728
.fts, xrefs: 0045A74C
.lnk, xrefs: 0045A7B3
Deleting file: %s, xrefs: 0045A7E5
Failed to delete the file; it may be in use (%d)., xrefs: 0045A935

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 43171a4fcbad40929b381a5514e069f0f32426cb02f36866d449381604384e36
Instruction ID: 43962401d403c06de7b31dde6fd87328655f81364e16ca473e433d379c6e1912
Opcode Fuzzy Hash: 43171a4fcbad40929b381a5514e069f0f32426cb02f36866d449381604384e36
Instruction Fuzzy Hash: EC719070B002545BCB00EB6998417AE77A49F4931AF91896BFC01AB383DB7C9E1DC75E

Uniqueness

Uniqueness Score: -1.00%

Function 0045CBC0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045CBDA
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CBFA
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CC07
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CC14
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CC22

Part of subcall function 0045CAC8: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045CB67,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045CB41

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCDB
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CE15,?,?,00000000), ref: 0045CCE4

Strings

advapi32.dll, xrefs: 0045CBF5
W, xrefs: 0045CCF2
SetEntriesInAclW, xrefs: 0045CC1C
GetNamedSecurityInfoW, xrefs: 0045CC01
SetNamedSecurityInfoW, xrefs: 0045CC0E

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 428efc784f41d3aa7d264c2f262ec685fe65e126583ce7bbd5579cd36a3925cf
Instruction ID: 99773ef8a3d0261052733c4904a47669a242c0659fe16ead1f438c4abb71ff4e
Opcode Fuzzy Hash: 428efc784f41d3aa7d264c2f262ec685fe65e126583ce7bbd5579cd36a3925cf
Instruction Fuzzy Hash: BD518471900308EFDB10DF99C881BEEBBB8EB48711F14806AF904E7241C678A945CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3AC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
GetDC.USER32(00000000), ref: 0041B402
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
ReleaseDC.USER32(00000000,00000000), ref: 0041B455
SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00454874 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045AB6A,00000003,00000000,00000000,00454B44), ref: 0045498D

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
RegQueryValueExA.ADVAPI32(0045AB6A,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AB6A,00000000,00000000,?,00000000,?,00000000), ref: 00454A40

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4
RegOpenKeyEx, xrefs: 00454910
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
, xrefs: 004548FE

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 742d62a6869efcab47093dbd07b67c32618791e42156db71d55ecd28429abb8c
Instruction ID: 3b35aed17da8244e85d272d2923899a44a2159637523a8fd9e70e85f8d21f96a
Opcode Fuzzy Hash: 742d62a6869efcab47093dbd07b67c32618791e42156db71d55ecd28429abb8c
Instruction Fuzzy Hash: 23914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69

Uniqueness

Uniqueness Score: -1.00%

Function 00459458 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459364: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004594FF
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 00459569

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459659,?,00000000,00000000,00000000), ref: 004595D0

Strings

v2.0.50727, xrefs: 0045955B
v1.1.4322, xrefs: 004595C2
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00459583
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 004594B2
.NET Framework not found, xrefs: 0045961D
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045951C
v4.0.30319, xrefs: 004594F1
.NET Framework version %s not found, xrefs: 00459609

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 06cdcde3b802fa8939e5b925d5f0cc04c3aa7329a2dd441772a6abba54712f42
Instruction ID: e7879d346446e6db82ad1067b50e8ffdd52b59a139ce3e0e88c8f748029a0227
Opcode Fuzzy Hash: 06cdcde3b802fa8939e5b925d5f0cc04c3aa7329a2dd441772a6abba54712f42
Instruction Fuzzy Hash: EB51A331A04148EBCB01DFA8C8A1BEE77A5DB59305F54447BA801DB353EA3D9E1ECB19

Uniqueness

Uniqueness Score: -1.00%

Function 00458A44 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00458A7B
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00458A97
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00458AA5
GetExitCodeProcess.KERNEL32(?), ref: 00458AB6
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458AFD
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458B19

Strings

Stopping 64-bit helper process. (PID: %u), xrefs: 00458A6D
Helper isn't responding; killing it., xrefs: 00458A87
Helper process exited with failure code: 0x%x, xrefs: 00458AE3
Helper process exited, but failed to get exit code., xrefs: 00458AEF
Helper process exited., xrefs: 00458AC5

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 8d11a9d6b8ebfffa9e94c3bd241da5180e5b7166b03f76cd8ec90a905d120898
Instruction ID: 3f2324d87e707cedf1d5c4e10b6e93e7b0b52df74c864805f1ac214018e434b5
Opcode Fuzzy Hash: 8d11a9d6b8ebfffa9e94c3bd241da5180e5b7166b03f76cd8ec90a905d120898
Instruction Fuzzy Hash: 2F2130706087409AD720E779C44575BB6D49F08345F04CC2FF99AEB283DF78E8488B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00454528 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Strings

RegCreateKeyEx, xrefs: 004545C3
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597
, xrefs: 004545B1
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 1658ad98f5d652d8ab18f870bc50976d397f5a9f15be4283fc870004d2c294f4
Instruction ID: 93c55a0ab54dbcba353dd8d7ef9dbdddde8d62e860aeeeeaccb8ee2ace91ec52
Opcode Fuzzy Hash: 1658ad98f5d652d8ab18f870bc50976d397f5a9f15be4283fc870004d2c294f4
Instruction Fuzzy Hash: 49810F75A00209AFDB00DFD5C981BDEB7B8EB49309F10452AF900FB282D7789E45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00496C50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539AB
Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539BB

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00496CCD
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00496E21), ref: 00496CEE
CreateWindowExA.USER32(00000000,STATIC,00496E30,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00496D15
SetWindowLongA.USER32(?,000000FC,004964A8), ref: 00496D28
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496DF4,?,?,000000FC,004964A8,00000000,STATIC,00496E30), ref: 00496D58
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00496DCC
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496DF4,?,?,000000FC,004964A8,00000000), ref: 00496DD8

Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

DestroyWindow.USER32(?,00496DFB,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496DF4,?,?,000000FC,004964A8,00000000,STATIC), ref: 00496DEE

Strings

STATIC, xrefs: 00496D0E
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00496D87

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: e4b2ecfcfa893ff17553470f1835d2c21342bacfaf5c8ca03e615e843d4af16f
Instruction ID: 18f462a79ff6f3765b6ab1b49dcd34ad23a8ddcce266b6658739bc0f5698dca4
Opcode Fuzzy Hash: e4b2ecfcfa893ff17553470f1835d2c21342bacfaf5c8ca03e615e843d4af16f
Instruction Fuzzy Hash: 61414C70A40208AFDF00EBA5DD42F9E7BB8EB08714F52457AF510F7291D7799E008B68

Uniqueness

Uniqueness Score: -1.00%

Function 0042E418 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E6DC,00000000), ref: 0042E441
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E6DC,00000000), ref: 0042E495

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0042E4A4
GetUserDefaultUILanguage, xrefs: 0042E437
Locale, xrefs: 0042E484
QaE, xrefs: 0042E4D7, 0042E4DF, 0042E4EA, 0042E50C
.DEFAULT\Control Panel\International, xrefs: 0042E46C
kernel32.dll, xrefs: 0042E43C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
API String ID: 4190037839-2312295185
Opcode ID: 6084c433af3ee4d64f0cd9982e7ad42a34d4dd09e5920a5815d9b88696e74604
Instruction ID: f42d7e7755912f49377b3a3c2778cbb45b18f2cdc7334bb7b0fb93ca3fe573dd
Opcode Fuzzy Hash: 6084c433af3ee4d64f0cd9982e7ad42a34d4dd09e5920a5815d9b88696e74604
Instruction Fuzzy Hash: E8213230B10225BBDB10EAE6DC51B9E76B8EB44308F90447BA504E7281E77CDE419B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004629F0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 004629FC
GetModuleHandleA.KERNEL32(user32.dll), ref: 00462A10
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462A1D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00462A2A
GetWindowRect.USER32(?,00000000), ref: 00462A76
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462AB4

Strings

user32.dll, xrefs: 00462A0B
GetMonitorInfoA, xrefs: 00462A24
(, xrefs: 00462A55
MonitorFromWindow, xrefs: 00462A17

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 49e394185691d1c2da29acdf0cb3719649ef4a9244e3d7219ece30713ed86938
Instruction ID: 865a179037155f8fdabe2954c964c2dd38b7d55406d5d1e7c7801a7b23b437f8
Opcode Fuzzy Hash: 49e394185691d1c2da29acdf0cb3719649ef4a9244e3d7219ece30713ed86938
Instruction Fuzzy Hash: B7219575701B057BD610D6A88D85F3B36D8EB84715F094A2AF944DB3C1E6F8EC018B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042F188 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F194
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
GetWindowRect.USER32(?,00000000), ref: 0042F20E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C

Strings

MonitorFromWindow, xrefs: 0042F1AF
(, xrefs: 0042F1ED
user32.dll, xrefs: 0042F1A3
GetMonitorInfoA, xrefs: 0042F1BC

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: d786bd72f778b9cca068a569f688e0802e61ee9ccadb1309323c976dabd5d685
Instruction ID: 50a2e38ba83faf67dd7c56e8d7733487d454ef14a416094e89dadcccf0bf0910
Opcode Fuzzy Hash: d786bd72f778b9cca068a569f688e0802e61ee9ccadb1309323c976dabd5d685
Instruction Fuzzy Hash: 3821F279704710ABD300EA68ED41F3B37A9DB89714F88457AF944DB382DA79EC044BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00458C1C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458DFB,?,00000000,00458E5E,?,?,00000000,00000000), ref: 00458C79
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CD6
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000,00000001,00000000,00000000,00000000,00458DFB), ref: 00458CE3
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458D2F
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000), ref: 00458D55
GetLastError.KERNEL32(?,?,00000000,00000001,00458D69,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458D90,?,00000000), ref: 00458D5C

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

TransactNamedPipe, xrefs: 00458CEF
CreateEvent, xrefs: 00458C87

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: ef16c20a6daf1f887f3bc2a9a4f4fdabf826d35dd2b72c43caf5f800eb3833ff
Instruction ID: 06b5d05a5e38ae799b2edb69ba26f0faef77b18cb4ad173b91f5c3c95d125767
Opcode Fuzzy Hash: ef16c20a6daf1f887f3bc2a9a4f4fdabf826d35dd2b72c43caf5f800eb3833ff
Instruction Fuzzy Hash: EF418E75A00608AFDB15DF95C981F9EB7F8EB48714F1044AAF900F72D2DA789E44CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00456D20 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456E85,?,?,00000031,?), ref: 00456D48
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456D4E
LoadTypeLib.OLEAUT32(00000000,?), ref: 00456D9B

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

GetProcAddress, xrefs: 00456D5B
UnRegisterTypeLib, xrefs: 00456E07
UnRegisterTypeLib, xrefs: 00456D3E
ITypeLib::GetLibAttr, xrefs: 00456DD1
LoadTypeLib, xrefs: 00456DA6
OLEAUT32.DLL, xrefs: 00456D43

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
Instruction ID: d1bb8c6bfccdc0522a96f5e3020b18907c52df716e7671809b7eaf465cfb4023
Opcode Fuzzy Hash: e2963ea3afedc97cdb575031c9274042e2bd1e61e6c3a56a36b999a051922bf2
Instruction Fuzzy Hash: 6831A375A00604AFDB41EFAACC12D5BB7BDEB8970675244A6FD04D3352DB38DD08CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00416D80 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416E13
SaveDC.GDI32(?), ref: 00416E27
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
RestoreDC.GDI32(?,?), ref: 00416E65
CreateSolidBrush.GDI32(00000000), ref: 00416EE5
FrameRect.USER32(?,?,?), ref: 00416F18
DeleteObject.GDI32(?), ref: 00416F22
CreateSolidBrush.GDI32(00000000), ref: 00416F32
FrameRect.USER32(?,?,?), ref: 00416F65
DeleteObject.GDI32(?), ref: 00416F6F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 31305b42e63a20fe9f9ee5f73744d5e2f5e6a90e84c308e69de84060d35988a9
Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
Opcode Fuzzy Hash: 31305b42e63a20fe9f9ee5f73744d5e2f5e6a90e84c308e69de84060d35988a9
Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Uniqueness

Uniqueness Score: -1.00%

Function 004221E8 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422233
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 794ac4a4d1563d503d4e128f610caca5ba976f2c29ed192f4e654ec8c2abe850
Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
Opcode Fuzzy Hash: 794ac4a4d1563d503d4e128f610caca5ba976f2c29ed192f4e654ec8c2abe850
Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698

Uniqueness

Uniqueness Score: -1.00%

Function 0046168C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004616C7
GetActiveWindow.USER32 ref: 0046172B
CoInitialize.OLE32(00000000), ref: 0046173F
SHBrowseForFolder.SHELL32(?), ref: 00461756
756CD120.OLE32(00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046176B
SetActiveWindow.USER32(?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 00461781
SetActiveWindow.USER32(?,?,00461797,00000000,?,?,?,?,?,00000000,0046181B), ref: 0046178A

Strings

A, xrefs: 004616FF

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ActiveWindow$BrowseD120FolderInitializeMalloc
String ID: A
API String ID: 2698730301-3554254475
Opcode ID: cb3d39f68a826354347aa7a8a61ff080deb010c50648a66159b3978de9eda5bc
Instruction ID: 0f37cca2ee7d5c89cd5c8fe3b5c5f67eac08b275376d6c087401a1ac056189be
Opcode Fuzzy Hash: cb3d39f68a826354347aa7a8a61ff080deb010c50648a66159b3978de9eda5bc
Instruction Fuzzy Hash: C3312F70E00348AFDB10EFA6D885A9EBBF8EB09304F55847AF404E7251E7785A048F59

Uniqueness

Uniqueness Score: -1.00%

Function 0045D2B4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D2BD
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D2CD
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D2DD
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D2ED

Strings

inflateReset, xrefs: 0045D2E7
inflate, xrefs: 0045D2C7
inflateInit_, xrefs: 0045D2B7
inflateEnd, xrefs: 0045D2D7

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 5039b32c95ab4f878aa340bc95ef1656196d0563f790867e571847c0b893819f
Instruction ID: d913f85fec6517a53d2ec7ba369195fd603025f4bffd93910817278a70f0814a
Opcode Fuzzy Hash: 5039b32c95ab4f878aa340bc95ef1656196d0563f790867e571847c0b893819f
Instruction Fuzzy Hash: C20112B0D00701DBE724DFF6ACC672636A5ABA8306F14C03B9D09962A2D77D0459DF2E

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8DC Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A9B9
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
SetBkColor.GDI32(?,?), ref: 0041AA08
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
SetBkColor.GDI32(00000000,?), ref: 0041AAC3

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: c2c61a06e11fc6ac6c72d0136d8e20986a2ab5507b690e8d84a304c9a27ba9fd
Instruction ID: 4467ea82dd13d464879b0bd0dd0607b47ee3045dce17e21d2c6451b7f26a8ea4
Opcode Fuzzy Hash: c2c61a06e11fc6ac6c72d0136d8e20986a2ab5507b690e8d84a304c9a27ba9fd
Instruction Fuzzy Hash: 8761E5B5A00505AFCB40EFADD985E9AB7F8EF08314B10816AF908DB262C775ED40CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004580C4 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458278,?, /s ",?,regsvr32.exe",?,00458278), ref: 004581EA

Strings

0x%x, xrefs: 0045820D
/s ", xrefs: 00458133
/u, xrefs: 00458126
regsvr32.exe", xrefs: 0045810B
CreateProcess, xrefs: 004581DC
Spawning 64-bit RegSvr32: , xrefs: 0045814F
D, xrefs: 004581A0
Spawning 32-bit RegSvr32: , xrefs: 00458171

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 4002d2de1ab03b38d977d670fcb0d45de6735b09ab9cf6adf03ef289ce7e4165
Instruction ID: cda81b302c56d3c3b7af3d8ffa4af26d40175ae7a7c1cff7e24eee752c39b11a
Opcode Fuzzy Hash: 4002d2de1ab03b38d977d670fcb0d45de6735b09ab9cf6adf03ef289ce7e4165
Instruction Fuzzy Hash: 21411670A047486BDB10EFD6D842B8DBBF9AF45305F50407FB904BB292DF789A098B19

Uniqueness

Uniqueness Score: -1.00%

Function 0044D178 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
GetSysColor.USER32(00000014), ref: 0044D1B0
SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
GetSysColor.USER32(00000010), ref: 0044D202
SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 32856f07fc45aa5b94f1f38070a47e962b22e9d58654105098b1be26c78061dc
Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
Opcode Fuzzy Hash: 32856f07fc45aa5b94f1f38070a47e962b22e9d58654105098b1be26c78061dc
Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668

Uniqueness

Uniqueness Score: -1.00%

Function 0041B66C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B745
GetDC.USER32(?), ref: 0041B751
SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
RealizePalette.GDI32(00000000), ref: 0041B792
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4

Strings

%H, xrefs: 0041B674

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: %H
API String ID: 3275473261-1959103961
Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B93C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BA17
GetDC.USER32(?), ref: 0041BA23
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
RealizePalette.GDI32(00000000), ref: 0041BA69
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1

Strings

%H, xrefs: 0041B944

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: %H
API String ID: 3275473261-1959103961
Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004964F4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C342,00000000,0045C4CD,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

GetWindowThreadProcessId.USER32(00000000,?), ref: 00496585
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00496599
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 004965B3
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004965BF
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004965C5
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 004965D8

Strings

Deleting Uninstall data files., xrefs: 004964FB

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 8e8cb50e53c2c3b2038bacabf8c777ac21aad5dfe2dc8a8db11d37eec289bdf4
Instruction ID: caddedc05ae4add9971b90b84c259ce0cd5246952d50e779d54ebc968ffbf915
Opcode Fuzzy Hash: 8e8cb50e53c2c3b2038bacabf8c777ac21aad5dfe2dc8a8db11d37eec289bdf4
Instruction Fuzzy Hash: 73216170204250BFEB10EB6ABC82B2637A8DB54728F53453BB501961D6DA7CAC448A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004701FC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004702F9,?,?,?,?,00000000), ref: 00470263
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004702F9), ref: 0047027A
AddFontResourceA.GDI32(00000000), ref: 00470297
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 004702AB

Strings

Failed to open Fonts registry key., xrefs: 00470281
Failed to set value in Fonts registry key., xrefs: 0047026C
AddFontResource, xrefs: 004702B5

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: f6cb4db48621d05014dac95341ab5faf08594db0be4636be460d29a68d9f0f75
Instruction ID: 122e39bb1ea2b43e4c2a7da55aa69ddad999e5e54c07bca5f4119535fc7344d3
Opcode Fuzzy Hash: f6cb4db48621d05014dac95341ab5faf08594db0be4636be460d29a68d9f0f75
Instruction Fuzzy Hash: 6921E271741204BBDB10EAA68C46FAE67AC9B14704F208477B904EB3C3DA7C9E01866D

Uniqueness

Uniqueness Score: -1.00%

Function 00462E30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE

GetVersion.KERNEL32 ref: 00462E60
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462E9E
SHGetFileInfo.SHELL32(00462F3C,00000000,?,00000160,00004011), ref: 00462EBB
LoadCursorA.USER32(00000000,00007F02), ref: 00462ED9
SetCursor.USER32(00000000,00000000,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462EDF
SetCursor.USER32(?,00462F1F,00007F02,00462F3C,00000000,?,00000160,00004011), ref: 00462F12

Strings

Explorer, xrefs: 00462E7A

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: 271d5cc6534746d744017855cbe3809792a4a5bc456b5a0a77df68c724b1ffee
Instruction ID: b0f6820fd5a5ea072646c086af9eca81c98a3cd1ffd9b7ca0f87214cf94a4ba1
Opcode Fuzzy Hash: 271d5cc6534746d744017855cbe3809792a4a5bc456b5a0a77df68c724b1ffee
Instruction Fuzzy Hash: CD21E7307403047AEB15BB759D47B9A3798DB09708F4004BFFA05EA1C3EEBD9901966D

Uniqueness

Uniqueness Score: -1.00%

Function 00478370 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02382BDC,?,?,?,02382BDC,00478534,00000000,00478652,?,?,-00000010,?), ref: 00478389
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0047838F
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02382BDC,?,?,?,02382BDC,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783A2
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02382BDC,?,?,?,02382BDC), ref: 004783CC
CloseHandle.KERNEL32(00000000,?,?,?,02382BDC,00478534,00000000,00478652,?,?,-00000010,?), ref: 004783EA

Strings

GetFinalPathNameByHandleA, xrefs: 0047837F
kernel32.dll, xrefs: 00478384

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 6bc275baaa87b820f83455aa3780e808e355a1b98666f0b165ca17ab90bcbd73
Instruction ID: 2a72e966618face2f1bd82d2a524167157479a72732682c44667b4342ad9b4bf
Opcode Fuzzy Hash: 6bc275baaa87b820f83455aa3780e808e355a1b98666f0b165ca17ab90bcbd73
Instruction Fuzzy Hash: 370180A07C070536E520316A4C8AFBB654C8B50769F14863FBA1DFA2D3FDED9D06016E

Uniqueness

Uniqueness Score: -1.00%

Function 00459E0C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00459F8E,?,00000000,00000000,00000000,?,00000006,?,00000000,0049785D,?,00000000,00497900), ref: 00459ED2

Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9

Strings

Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459EAC
Stripped read-only attribute., xrefs: 00459E94
Failed to delete directory (%d). Will retry later., xrefs: 00459EEB
Failed to strip read-only attribute., xrefs: 00459EA0
Failed to delete directory (%d)., xrefs: 00459F68
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459F47
Deleting directory: %s, xrefs: 00459E5B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 825b69e71020358a2790d5b66baca682891f253eb20f6d4b4ab0a73fce46c835
Instruction ID: b8d9b7298ea7c3337bda5d500217c07e27fbd6b384233f4239b27a523d6d10d0
Opcode Fuzzy Hash: 825b69e71020358a2790d5b66baca682891f253eb20f6d4b4ab0a73fce46c835
Instruction Fuzzy Hash: 1841A331A04208CACB10EB69C8413AEB6A55F4530AF54897BAC01D73D3CB7C8E0DC75E

Uniqueness

Uniqueness Score: -1.00%

Function 00422E50 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422EA4
GetCapture.USER32 ref: 00422EB3
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
ReleaseCapture.USER32 ref: 00422EBE
GetActiveWindow.USER32 ref: 00422ECD
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
GetActiveWindow.USER32 ref: 00422FBF

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: b1a57ae8c862de22bc82aa702dd5f84040ee9f6a0804fcde46ad074f7f3e30fe
Instruction ID: c6261992695b47722d84ffa44129b55dc5b2a4dad2f70b0012283783c1c7b094
Opcode Fuzzy Hash: b1a57ae8c862de22bc82aa702dd5f84040ee9f6a0804fcde46ad074f7f3e30fe
Instruction Fuzzy Hash: 24417230B00245AFDB10EB69DA86B9E77F1EF44304F5540BAF404AB2A2D778AE40DB49

Uniqueness

Uniqueness Score: -1.00%

Function 0042F290 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
GetActiveWindow.USER32 ref: 0042F2DA
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$ActiveLong$Message
String ID:
API String ID: 2785966331-0
Opcode ID: 267c9eefe26e23fd4e765c6349420bb8bb9da3d18075eb1d96a464b655a4fe2f
Instruction ID: ac844ef734d24c76dc9aa96f201b13a865b129e9c1b137beabd8cb6517960092
Opcode Fuzzy Hash: 267c9eefe26e23fd4e765c6349420bb8bb9da3d18075eb1d96a464b655a4fe2f
Instruction Fuzzy Hash: F931D271A00254AFEB01EFA5DD52E6EBBB8EB09304F9144BAF804E3291D73C9D10CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00429480 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042948A
GetTextMetricsA.GDI32(00000000), ref: 00429493

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 004294A2
GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
SelectObject.GDI32(00000000,00000000), ref: 004294B6
ReleaseDC.USER32(00000000,00000000), ref: 004294BE
GetSystemMetrics.USER32(00000006), ref: 004294E3
GetSystemMetrics.USER32(00000006), ref: 004294FD

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: 960ca5b6b9ec06081429caf0e2ae16fd4423d047ce8cb1d090ce01a2b2c84894
Instruction ID: 8a5b62ad3b2811282b00f4aa11bc4c2c065e9b9ae855548013837f5c18493421
Opcode Fuzzy Hash: 960ca5b6b9ec06081429caf0e2ae16fd4423d047ce8cb1d090ce01a2b2c84894
Instruction Fuzzy Hash: 0F01C4A17087103BE321767A9CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE24 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041DE27
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
GetStockObject.GDI32(00000007), ref: 0041DE5B
GetStockObject.GDI32(00000005), ref: 0041DE67
GetStockObject.GDI32(0000000D), ref: 0041DE73
LoadIconA.USER32(00000000,00007F00), ref: 0041DE84

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: cf3de45f10179e040e4bf754cd3e00afbbff0486b0448c288d4be5e1939ebdb6
Instruction ID: 282f56568f1177e4dad385ec7f61a974d29090d827cf1f87eb40c920fa9ca7e8
Opcode Fuzzy Hash: cf3de45f10179e040e4bf754cd3e00afbbff0486b0448c288d4be5e1939ebdb6
Instruction Fuzzy Hash: 4C1142706457015EE340BFA66E52B6A36A4D725708F40413FF609AF3D1D77A2C448B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00463240 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 00463344
SetCursor.USER32(00000000,00000000,00007F02,00000000,004633D9), ref: 0046334A
SetCursor.USER32(?,004633C1,00007F02,00000000,004633D9), ref: 004633B4

Strings

Internal error: Item already expanding, xrefs: 004632E1
, xrefs: 004635DA
, xrefs: 004635BF

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
Instruction ID: e4e85f4aa3fa623d7d3a169fbc538aa22306e9421cedfdc69a3031d12d347dae
Opcode Fuzzy Hash: 040729a671edf880b94918ceea5f8eaec20fdfbf8da854279a56862745118dff
Instruction Fuzzy Hash: 4CB18270604284EFDB11DF29C545B9ABBF1BF04305F1484AAE8469B792DB78EE44CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00453D30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

Strings

NUL, xrefs: 00453ED9
WININIT.INI, xrefs: 00453DC5
MoveFileEx, xrefs: 00454027
.tmp, xrefs: 00453DD3
[rename], xrefs: 00453E7A, 00453EB6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 262666494607197906d7283235c4c76affd32b2b0fdb9ef9cba9b9ea75353bac
Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
Opcode Fuzzy Hash: 262666494607197906d7283235c4c76affd32b2b0fdb9ef9cba9b9ea75353bac
Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00476C50 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00476CA9
SetWindowLongW.USER32(00000000,000000FC,00476C04), ref: 00476CD0
GetACP.KERNEL32(00000000,00476EE8,?,00000000,00476F12), ref: 00476D0D
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00476D53

Strings

Inno Setup: Language, xrefs: 00476DDB
COMBOBOX, xrefs: 00476CA2

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: 1db359e320ab2741222256d54ad499686456584f5ec697b8868a090b3fdd66eb
Instruction ID: b13fa11fcbd9abdf7db93726dac51e4442bd67f198c8610d2c1064f44be53319
Opcode Fuzzy Hash: 1db359e320ab2741222256d54ad499686456584f5ec697b8868a090b3fdd66eb
Instruction Fuzzy Hash: 46812C346006059FDB10DF69D985AEAB7F2FB09304F15C1BAE808EB762D778AD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408720 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7

Strings

m/d/yy, xrefs: 00408809
:mm, xrefs: 0040891C
mmmm d, yyyy, xrefs: 0040882B
AMPM, xrefs: 00408905
:mm:ss, xrefs: 00408936

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction ID: 5c6fde8006682913ecab3173e7335377554a92ac61a87523d81808753b4ec1a9
Opcode Fuzzy Hash: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction Fuzzy Hash: 7D516C24B00108ABDB01FBA69E4169EB7A9DB94308F50C07FA181BB3C3CE3DDA05975D

Uniqueness

Uniqueness Score: -1.00%

Function 004116F4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A

Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6

Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD

Strings

,, xrefs: 0041179F
?, xrefs: 004117A6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 4986dcd06abefbee5f666d79fc26290c702fe8a84b14e195092edf3558bd7871
Instruction ID: ecf66c9774bccec907b621c371347452b74b7622051e058d8a4a73451c3e974f
Opcode Fuzzy Hash: 4986dcd06abefbee5f666d79fc26290c702fe8a84b14e195092edf3558bd7871
Instruction Fuzzy Hash: D7510674A00245ABDB10EF6ADC816EA7BF9AF09304B11857BF904E73A6D738DD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE63 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
DeleteObject.GDI32(?), ref: 0041BF9F
DeleteObject.GDI32(?), ref: 0041BFA8
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction ID: 74cae3b7aa7aab4ce12a2fbd062d204c5c4082198076ec6df892ad84fd278e80
Opcode Fuzzy Hash: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction Fuzzy Hash: 6A510671A002199FCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041CED8 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
RealizePalette.GDI32(?), ref: 0041CF92
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
SelectPalette.GDI32(?,?,00000001), ref: 0041D05F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
Opcode Fuzzy Hash: 5be0e4e6833feb243a8d388dd1011de92277052336d3d318ec39d49e9b6efc72
Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004572DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 0045732E

Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00457395
TranslateMessage.USER32(?), ref: 004573B3
DispatchMessageA.USER32(?), ref: 004573BC

Strings

[Paused] , xrefs: 00457364

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: 138259db96aaba9c66cb09bcf6582550d327018b684ee04c4d651f5f89e9d65e
Instruction ID: a72840e20965590be0df7748d4dcd1bfe023db3bc5775872eefead19b10ec59e
Opcode Fuzzy Hash: 138259db96aaba9c66cb09bcf6582550d327018b684ee04c4d651f5f89e9d65e
Instruction Fuzzy Hash: 633175319082449ADB11DBB9EC81B9E7FB8EF49314F5540B7EC00E7292D73C9909DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0046B420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046B55F), ref: 0046B4DC
LoadCursorA.USER32(00000000,00007F02), ref: 0046B4EA
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B55F), ref: 0046B4F0
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B55F), ref: 0046B4FA
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B55F), ref: 0046B500

Strings

CheckPassword, xrefs: 0046B484

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: a15a8593e9f633b5a85a0686193dd54b7b5146f7df37d6bd0e19c7d70d8febf0
Instruction ID: 9465d4cba05e43c3341d6d018928b45656d3fee3f016636846a90655da25d4f4
Opcode Fuzzy Hash: a15a8593e9f633b5a85a0686193dd54b7b5146f7df37d6bd0e19c7d70d8febf0
Instruction Fuzzy Hash: D0316334740204AFD711EF69C899B9A7BE4EF45308F5580B6F9049B3A2D7789E40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00477C6C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00477B94: GetWindowThreadProcessId.USER32(00000000), ref: 00477B9C
Part of subcall function 00477B94: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477C93,0049C0A8,00000000), ref: 00477BAF
Part of subcall function 00477B94: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477BB5

SendMessageA.USER32(00000000,0000004A,00000000,00478026), ref: 00477CA1
GetTickCount.KERNEL32 ref: 00477CE6
GetTickCount.KERNEL32 ref: 00477CF0
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00477D45

Strings

CallSpawnServer: Unexpected status: %d, xrefs: 00477D2E
CallSpawnServer: Unexpected response: $%x, xrefs: 00477CD6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3771334282
Opcode ID: a349fc6668a2a279a7709dc0d92d626649643492524c5ed72309cd5f58a9f2ee
Instruction ID: 262cbc5b9954910938d5a1e8e32dc50db46ad6f301169d9d39307b56b522dac3
Opcode Fuzzy Hash: a349fc6668a2a279a7709dc0d92d626649643492524c5ed72309cd5f58a9f2ee
Instruction Fuzzy Hash: 87318474B042159EDB10EBB9C8867EE76A0AF08714F90807AB548EB392D67C9D4187AD

Uniqueness

Uniqueness Score: -1.00%

Function 00459784 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045983F

Strings

Fusion.dll, xrefs: 004597DF
CreateAssemblyCache, xrefs: 00459836
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045984A
Failed to load .NET Framework DLL "%s", xrefs: 00459824
.NET Framework CreateAssemblyCache function failed, xrefs: 00459862

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: 64b7f7115ec2050a4f0e42ab113808549d669c8acfba7d9bf3bad921683fe547
Instruction ID: 9a538673283cb431493768ab67eac729fe35d93f11f945e2dcd414e2b3f175b6
Opcode Fuzzy Hash: 64b7f7115ec2050a4f0e42ab113808549d669c8acfba7d9bf3bad921683fe547
Instruction Fuzzy Hash: A2318B70E10649ABCB10FFA5C88169EB7B8EF45315F50857BE814E7382DB389E08C799

Uniqueness

Uniqueness Score: -1.00%

Function 0041C148 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055

GetFocus.USER32 ref: 0041C168
GetDC.USER32(?), ref: 0041C174
SelectPalette.GDI32(?,?,00000000), ref: 0041C195
RealizePalette.GDI32(?), ref: 0041C1A1
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
ReleaseDC.USER32(?,?), ref: 0041C1ED

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28

Uniqueness

Uniqueness Score: -1.00%

Function 00418C54 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C70
GetSystemMetrics.USER32(0000000D), ref: 00418C78
6F552980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E

Part of subcall function 004107F8: 6F54C400.COMCTL32(0049B628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC

6F5BCB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
6F5BC740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
6F5BCB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
6F550860.COMCTL32(0049B628,00418D0F,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: MetricsSystem$C400C740F550860F552980
String ID:
API String ID: 1828538299-0
Opcode ID: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction ID: f48c8f8e6a400555c090207229051c9eae11b8a9b20c4da93df477ea8fa1a9e8
Opcode Fuzzy Hash: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction Fuzzy Hash: 6B112475744204BBDB50EBA9EC82FAD73F8DB08704F504066B514EB2C1DAB9AD808759

Uniqueness

Uniqueness Score: -1.00%

Function 00483C6C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00483D24), ref: 00483D09

Strings

WinNT, xrefs: 00483CB9
ServerNT, xrefs: 00483CED
System\CurrentControlSet\Control\ProductOptions, xrefs: 00483C90
LanmanNT, xrefs: 00483CD3
ProductType, xrefs: 00483CA8

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: e1bcbbbaaee85d585434023fd650e6813b785c41e8fbc068ac73575afb55ee56
Instruction ID: 212569cff1cfb7858b589fbdbabdc9c693f1f7cc945fcf11155ec0ddb5f1f406
Opcode Fuzzy Hash: e1bcbbbaaee85d585434023fd650e6813b785c41e8fbc068ac73575afb55ee56
Instruction Fuzzy Hash: CC117C30704244AADB10FF65D862B5E7BF9DB45B05F618877A800E7282EB78AE05875C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B462 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00495508 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00495519

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 0049553B
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495AB9), ref: 0049554F
GetTextMetricsA.GDI32(00000000,?), ref: 00495571
ReleaseDC.USER32(00000000,00000000), ref: 0049558E

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00495546

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: 15e89f7ca813e7522845c960856b2cdc022ede195b48aa860a28df6e22a0f939
Instruction ID: fbfe8d588f566b1ae935688c8d8bbf43f3780a3d17a9f30f48774e54417b88ea
Opcode Fuzzy Hash: 15e89f7ca813e7522845c960856b2cdc022ede195b48aa860a28df6e22a0f939
Instruction Fuzzy Hash: 98018476A04704BFEB05DBE9CC41E5EB7EDEB48714F614476F604E7281D678AE008B28

Uniqueness

Uniqueness Score: -1.00%

Function 00423394 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004233AF
WindowFromPoint.USER32(?,?), ref: 004233BC
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
GetCurrentThreadId.KERNEL32 ref: 004233D1
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
SetCursor.USER32(00000000), ref: 00423413

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D

Uniqueness

Uniqueness Score: -1.00%

Function 0049532C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 0049533C
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00495349
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00495356

Strings

user32.dll, xrefs: 00495337
MonitorFromRect, xrefs: 00495343
GetMonitorInfoA, xrefs: 00495350

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 5579b8dc187442e7c517f6558358e9e0fd6dcc5405420102cd7b083255a2d8af
Instruction ID: d6622564654ba01390171a2dbbf88ec7785202fdd48675fe733a6c53722864ad
Opcode Fuzzy Hash: 5579b8dc187442e7c517f6558358e9e0fd6dcc5405420102cd7b083255a2d8af
Instruction Fuzzy Hash: 7EF0F692741F156ADA3121660C41B7F6B8CCB917B1F240137BE44A7382E9ED8C0047ED

Uniqueness

Uniqueness Score: -1.00%

Function 0045D188 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045D191
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045D1A1
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045D1B1

Strings

ISCryptGetVersion, xrefs: 0045D18B
ArcFourCrypt, xrefs: 0045D1AB
ArcFourInit, xrefs: 0045D19B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: dc81785b55ac876962535e0a2eb36b1dd730d24c9132c457d47d12d4ae2e21c2
Instruction ID: d394b6b565b4a55a8c16e24b867b534ad65140704dc94b035c924c7661ebf9a3
Opcode Fuzzy Hash: dc81785b55ac876962535e0a2eb36b1dd730d24c9132c457d47d12d4ae2e21c2
Instruction Fuzzy Hash: A2F030B0D41700CAD318EFF6AC957263B96EB9830AF14C03BA414C51A2D7794454DF2C

Uniqueness

Uniqueness Score: -1.00%

Function 0045D688 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D691
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D6A1
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D6B1

Strings

BZ2_bzDecompress, xrefs: 0045D69B
BZ2_bzDecompressInit, xrefs: 0045D68B
BZ2_bzDecompressEnd, xrefs: 0045D6AB

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 0c00d940adfee3eed657d73ca32928dd6beaef8d72542be6af97d79d08c28db7
Instruction ID: 26f5c6c79611f6cc0facecefa5b4932716cc5d8e9f8ea2477ead0514974f6e87
Opcode Fuzzy Hash: 0c00d940adfee3eed657d73ca32928dd6beaef8d72542be6af97d79d08c28db7
Instruction Fuzzy Hash: 0EF01DB0D00705DFD724EFB6ACC672736D5AB6831AF50813B990E95262D778045ACF2C

Uniqueness

Uniqueness Score: -1.00%

Function 0042EA1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,004812C8), ref: 0042EA35
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA4C

Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60

Strings

user32.dll, xrefs: 0042EA30
ChangeWindowMessageFilterEx, xrefs: 0042EA2B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction ID: 20967f7a279d57b19857f2ad39d34e10c6be6de8430a8d3efc5b40b14e24a4c3
Opcode Fuzzy Hash: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction Fuzzy Hash: 99E092A1741B20EAEA10B7B67C86FAA2658EB1076DF500037F100A51F1C3BD1C80CE9E

Uniqueness

Uniqueness Score: -1.00%

Function 0044C7DC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C

Strings

LresultFromObject, xrefs: 0044C7F6
CreateStdAccessibleObject, xrefs: 0044C806
oleacc.dll, xrefs: 0044C7E6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction ID: d6497c9818d993b67a5702c7731996643d684f189bbd4b702b1f6e54e13363b7
Opcode Fuzzy Hash: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction Fuzzy Hash: 50F0DA70282305CAE750BBB5FDD57263694E3A470AF18277BE841551A2C7B94844CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 00478C20 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498C24), ref: 00478C26
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478C33
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478C43

Strings

VerSetConditionMask, xrefs: 00478C2D
VerifyVersionInfoW, xrefs: 00478C3D
kernel32.dll, xrefs: 00478C21

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 81267d710db967c56e7e702a34d1e8b60bf08845a808e06a5f27e56110be3c01
Instruction ID: 32a0137ea675787c0bb1f7a77b9c903aea73f6d33f3aa717a8ad139b0a70eb03
Opcode Fuzzy Hash: 81267d710db967c56e7e702a34d1e8b60bf08845a808e06a5f27e56110be3c01
Instruction Fuzzy Hash: 4DC0C9F02C1700EEAA01B7B11DCAA7A255CC500728320843F7049BA182D97C0C104F3C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B508 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B57E
GetDC.USER32(?), ref: 0041B58A
GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
ReleaseDC.USER32(?,?), ref: 0041B626

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045D04C Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045D184,?,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0F6

Strings

CLASSES_ROOT, xrefs: 0045D07C
CURRENT_USER, xrefs: 0045D08B
MACHINE, xrefs: 0045D09A
USERS, xrefs: 0045D0A9

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
Instruction ID: 81e1e27ad3ae8d1ea1d6b81b4c13ff0be47bc54c17845d393ef4ad8e2f10c1e8
Opcode Fuzzy Hash: 44daac30ba6290961f85a10f910adeebe56024b8db7d764ffa7b36a0de599fb3
Instruction Fuzzy Hash: 2C117535A04608AFD731DA91C942B9EB6ADDF4470AF6040776D00572C3D67C5F0B992E

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
GetDC.USER32(00000000), ref: 0041BDE9
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
ReleaseDC.USER32(00000000,00000000), ref: 0041BE56

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0047E758 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047E766
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CD49), ref: 0047E78C
GetWindowLongA.USER32(?,000000EC), ref: 0047E79C
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047E7BD
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047E7D1
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047E7ED

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 761baba5ea275c4f8ba8f3b2538ab5f77c1d2b06cda4c3ad0feadca871259e14
Instruction ID: 463a5c2536fff799c7bf7cf61cbf8045bc8b98cac2b0bb45a0840e8ed8c25010
Opcode Fuzzy Hash: 761baba5ea275c4f8ba8f3b2538ab5f77c1d2b06cda4c3ad0feadca871259e14
Instruction Fuzzy Hash: 53010CB5641210ABEA00D769DE81F6637D8AB1C320F0943A6B959DF3E3C738EC408B49

Uniqueness

Uniqueness Score: -1.00%

Function 0041B270 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B

UnrealizeObject.GDI32(00000000), ref: 0041B27C
SelectObject.GDI32(?,00000000), ref: 0041B28E
SetBkColor.GDI32(?,00000000), ref: 0041B2B1
SetBkMode.GDI32(?,00000002), ref: 0041B2BC
SetBkColor.GDI32(?,00000000), ref: 0041B2D7
SetBkMode.GDI32(?,00000001), ref: 0041B2E2

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A

Uniqueness

Uniqueness Score: -1.00%

Function 004556D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5

Strings

WININIT.INI, xrefs: 004557E4
PendingFileRenameOperations2, xrefs: 00455784
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738
PendingFileRenameOperations, xrefs: 00455754

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 430bb035026106b65f85e2b07525b73901b650abba9068f13605831850c1f819
Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
Opcode Fuzzy Hash: 430bb035026106b65f85e2b07525b73901b650abba9068f13605831850c1f819
Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58

Uniqueness

Uniqueness Score: -1.00%

Function 004538BC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539AB
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,!nI,_iu,?,00000000,004539F6), ref: 004539BB

Strings

.tmp, xrefs: 0045395F
_iu, xrefs: 0045394D
!nI, xrefs: 004538EC, 004538F7, 00453952, 0045395C, 0045392C, 00453936

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: !nI$.tmp$_iu
API String ID: 3498533004-584216493
Opcode ID: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
Instruction ID: 7da7e9bbb2667b7856572ae533a3071efe8e017fb0344d9459fa270775feb22d
Opcode Fuzzy Hash: 1dee75e2bfc2da78c26475f080e8b0a4db6a1a73d39b0bf1d20dabbe4352c150
Instruction Fuzzy Hash: 1831C5B0A00249ABCB11EF95D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69

Uniqueness

Uniqueness Score: -1.00%

Function 00497D5C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,00497FC1,?,?,00000000), ref: 00497D92

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,00497DBA,00000000,00497F8D,?,?,00000005,00000000,00497FC1,?,?,00000000), ref: 004072B3

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

.dat, xrefs: 00497DD9
Uninstall, xrefs: 00497D78
.msg, xrefs: 00497DF8
IMsg, xrefs: 00497E66

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: d050b8c65b09966d21fe0fc985d660f82682418f1ef04ac2b8f2793e44e24393
Instruction ID: abb28459e614be91aca1b68aa70fad33032f6e559e3bf784a216f74f74fa669e
Opcode Fuzzy Hash: d050b8c65b09966d21fe0fc985d660f82682418f1ef04ac2b8f2793e44e24393
Instruction Fuzzy Hash: 89314F34A14114AFCB00EF65DD9296E7BB5EF89314F91857AF800AB395DB38BD01CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0042EAA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09

Strings

user32.dll, xrefs: 0042EAD5
ShutdownBlockReasonCreate, xrefs: 0042EAD0

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
Opcode Fuzzy Hash: eb577c3347fbf9fd6a249885fcfc34f4074b2fa1c1d8d6afc25abb851ecf655c
Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E

Uniqueness

Uniqueness Score: -1.00%

Function 00457FF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00458028
GetExitCodeProcess.KERNEL32(?,?), ref: 00458049
CloseHandle.KERNEL32(?,0045807C), ref: 0045806F

Strings

GetExitCodeProcess, xrefs: 00458052
MsgWaitForMultipleObjects, xrefs: 00458035

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 0165f3f1031fc1aa6e60b3a9799ba1014783226e14f241c311df118ccfede771
Instruction ID: 2f0632834368beac7d1c7250186d6a5b4d0e74160b608b18ba1b2b0c741dc3d5
Opcode Fuzzy Hash: 0165f3f1031fc1aa6e60b3a9799ba1014783226e14f241c311df118ccfede771
Instruction Fuzzy Hash: 8101A231600204AFD710EBA98C02A5A73A8EB49B25F51407BFC10E73D3DE399E08965D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E9AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004571F1,00457594,00457148,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

Strings

ChangeWindowMessageFilter, xrefs: 0042E9B8
user32.dll, xrefs: 0042E9BD

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction ID: c922fa4e85abb1c6873f36dcd01b6443d81c66d6c3501223796626af46e79b09
Opcode Fuzzy Hash: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction Fuzzy Hash: 5CE0ECB2740324EADA103B627E8AF663558E724B19F50043BF001751F1C7FD1C80CA9E

Uniqueness

Uniqueness Score: -1.00%

Function 00477B94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00477B9C
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477C93,0049C0A8,00000000), ref: 00477BAF
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477BB5

Strings

user32.dll, xrefs: 00477BAA
AllowSetForegroundWindow, xrefs: 00477BA5

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: 0c48b0152dcd94fde7082f0574e48419f86d5c04df14efc0ca492c8631bf730a
Instruction ID: d51ed2a8d8be4cb67b0f2e6afaff03014389f5b4c9f6752a27b175deb1fe6994
Opcode Fuzzy Hash: 0c48b0152dcd94fde7082f0574e48419f86d5c04df14efc0ca492c8631bf730a
Instruction Fuzzy Hash: D7D0C790248701B9D910B3F64D46E9F3A5D894471CB50C47BB418E61C5DA7CFD04893D

Uniqueness

Uniqueness Score: -1.00%

Function 00416C2C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C52
SaveDC.GDI32(?), ref: 00416C83
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
RestoreDC.GDI32(?,?), ref: 00416D0B
EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414800 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414836
MulDiv.KERNEL32(?,?,?), ref: 00414850
MulDiv.KERNEL32(?,?,?), ref: 00414879
MulDiv.KERNEL32(?,?,?), ref: 004148A4
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148EC

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19

Uniqueness

Uniqueness Score: -1.00%

Function 004297CC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
Opcode Fuzzy Hash: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBB8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
GetDC.USER32(00000000), ref: 0041BC12
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
DeleteObject.GDI32(00000000), ref: 0041BC9A

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004735D8 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045D04C: SetLastError.KERNEL32(00000057,00000000,0045D118,?,?,?,?,00000000), ref: 0045D0B7

GetLastError.KERNEL32(00000000,00000000,00000000,004736AC,?,?,0049C1E0,00000000), ref: 00473665
GetLastError.KERNEL32(00000000,00000000,00000000,004736AC,?,?,0049C1E0,00000000), ref: 0047367B

Strings

Setting permissions on registry key: %s\%s, xrefs: 0047362A
Failed to set permissions on registry key (%d)., xrefs: 0047368C
Could not set permissions on the registry key because it currently does not exist., xrefs: 0047366F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: f83a2768d3c65ea5df61b415147cb4a980a2a4da2a2eeea125c2e66a17c72d68
Instruction ID: ad6b00cc897a6d1501f3fc6a2a631de3da5dc8c6e7b4eccdfad28332e4495c63
Opcode Fuzzy Hash: f83a2768d3c65ea5df61b415147cb4a980a2a4da2a2eeea125c2e66a17c72d68
Instruction Fuzzy Hash: A121C870A046445FCB10DFA9C8826EEBBE4DF49319F50817BE408E7392D7785E098B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Uniqueness

Uniqueness Score: -1.00%

Function 004143E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
RealizePalette.GDI32(00000000), ref: 00414421
SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
RealizePalette.GDI32(00000000), ref: 0041443B
ReleaseDC.USER32(00000000,00000000), ref: 00414446

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765

Uniqueness

Uniqueness Score: -1.00%

Function 00424CE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092

Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA

OffsetRect.USER32(?,?,?), ref: 00424DC9
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
OffsetRect.USER32(?,?,?), ref: 00424E9D

Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD

Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47

Strings

vLB, xrefs: 00424CF3, 00424DD1

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
String ID: vLB
API String ID: 1477829881-1797516613
Opcode ID: b071e8f690a675b1b5ec03376c9d1dc0568a9cea913d7d114b2f1dd6f13c8b48
Instruction ID: 1a85cd152e58b5c2614c87f396891e2b5808bef0cf689969089b0637ec596c27
Opcode Fuzzy Hash: b071e8f690a675b1b5ec03376c9d1dc0568a9cea913d7d114b2f1dd6f13c8b48
Instruction Fuzzy Hash: C5812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5

Strings

Z, xrefs: 0040703C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction ID: 78f4b6eea80f90a9c0d6dbacb1000d6f5057f9b0a0312f2c839bfa0eabc808a5
Opcode Fuzzy Hash: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction Fuzzy Hash: 14516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0044CFC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D04E
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101

Strings

, xrefs: 0044D033

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 9cefa38d4a8adbc35dceb9fbd70f94003a2f7c245499b58eac7a7a86e34dc042
Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
Opcode Fuzzy Hash: 9cefa38d4a8adbc35dceb9fbd70f94003a2f7c245499b58eac7a7a86e34dc042
Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042EF74 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042EF9E

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(?,00000000), ref: 0042EFC1
ReleaseDC.USER32(00000000,?), ref: 0042F0A0

Strings

...\, xrefs: 0042F052

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: 174dea87e3c77845355dc2bffde9c2636390ac865bcfddee608935e642ca7c05
Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
Opcode Fuzzy Hash: 174dea87e3c77845355dc2bffde9c2636390ac865bcfddee608935e642ca7c05
Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00416410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
UnregisterClassA.USER32(?,00400000), ref: 004164AB
RegisterClassA.USER32(?), ref: 004164CE

Strings

@, xrefs: 00416429

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 3b6f74928dbe25e833ba5f094c78e46ad4264582666b3af08ebad3e49732e910
Instruction ID: c77080f262680b7bd3c4c6a37e0a11d074b1995aa9dd52ebf92fb76dd285a693
Opcode Fuzzy Hash: 3b6f74928dbe25e833ba5f094c78e46ad4264582666b3af08ebad3e49732e910
Instruction Fuzzy Hash: B8316D702042409BD720EF69C981B9B77E5AB89308F04457FF949DB392DB39DD44CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00498210 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00498B60,00000000,00498306,?,?,00000000,0049B628), ref: 00498280
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00498B60,00000000,00498306,?,?,00000000,0049B628), ref: 004982A9
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 004982C2

Strings

isRS-%.3u.tmp, xrefs: 0049825F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: caa082c947593af69ac399f5aa69a479bfa54a7c4d0fec8f0c1611cec8706775
Instruction ID: fc33356634acd7bce8b4c2965ae56e8bcff63ef6fc68eceab8a95db248f88364
Opcode Fuzzy Hash: caa082c947593af69ac399f5aa69a479bfa54a7c4d0fec8f0c1611cec8706775
Instruction Fuzzy Hash: 0B216471E00609ABCF10EFA9C8819AFBBB8AF45714F10457FB814B72D1DB389E018A59

Uniqueness

Uniqueness Score: -1.00%

Function 00456BFC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456C50
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456C7D

Strings

LoadTypeLib, xrefs: 00456C5B
RegisterTypeLib, xrefs: 00456C88

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
Instruction ID: 3ed1135b8019c5f4588910a0035f5c9e1cabb82a18fedb82429c118dce795412
Opcode Fuzzy Hash: 99adc2ab1761f2fa15f1ac99c5dc87c93e60f5f8f6cafab150dd189b668492eb
Instruction Fuzzy Hash: 2911B430B00604AFDB02EFA6CD51A5EB7BDEB89705F5184B6FC44D3752DA389904CA24

Uniqueness

Uniqueness Score: -1.00%

Function 00457154 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 0045716E
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 0045720B

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 0045719A
Failed to create DebugClientWnd, xrefs: 004571D4

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 3689ec14d1edae2f57f0a744906126f7255bff4f1947e1d6bbead030c2853570
Instruction ID: a6ca84080c04e90ac639e3db27cd2c1e4b46fe4ea5f20cae781d9f83c3d7e460
Opcode Fuzzy Hash: 3689ec14d1edae2f57f0a744906126f7255bff4f1947e1d6bbead030c2853570
Instruction Fuzzy Hash: 1011E770248240AFD710AB69AC85B5FBBD89B54319F15407AFA849B383D7798C18C7AE

Uniqueness

Uniqueness Score: -1.00%

Function 004786EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetFocus.USER32 ref: 00478757
GetKeyState.USER32(0000007A), ref: 00478769
WaitMessage.USER32(?,00000000,00478790,?,00000000,004787B7,?,?,00000001,00000000,?,?,?,00480402,00000000,004812C8), ref: 00478773

Strings

Wnd=$%x, xrefs: 0047873B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: c0ca7a1e78f0957e158d44939737d51478939e9ac1b0c689120181bc9166dade
Instruction ID: f17a5035e7dee30901ec9a03c3a5a372f1d0714b29ccd98a4f066b2945bd060b
Opcode Fuzzy Hash: c0ca7a1e78f0957e158d44939737d51478939e9ac1b0c689120181bc9166dade
Instruction Fuzzy Hash: CE11C634A40244AFD704EF65DC49A9EBBF8EB49314F6184BFF409E7681DB386D00CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0046E610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E618
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E627

Strings

%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046E69C
(invalid), xrefs: 0046E6AA

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 93d3f9926fe1e9ec47fc0153e923e0389e011619b8f85a7a05f57e02ab74589b
Instruction ID: 5dd65cae4c1adac9d47cc9ad6336eda1851498fedff4a8a979bd050f9c4a6815
Opcode Fuzzy Hash: 93d3f9926fe1e9ec47fc0153e923e0389e011619b8f85a7a05f57e02ab74589b
Instruction Fuzzy Hash: A81136A440C3909ED340DF2AC04432BBAE4AB99704F44892EF8C8C6381E779C848DBB7

Uniqueness

Uniqueness Score: -1.00%

Function 00453F76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004986F1,00000000,00498746,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004983A5,00000000), ref: 0045349F

Strings

MoveFile, xrefs: 00453FB1
DeleteFile, xrefs: 00453F94

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: ad4ba0b838e9d5317ad6887f6d8cb75152b6b17696a4ed4ee46c007163692804
Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
Opcode Fuzzy Hash: ad4ba0b838e9d5317ad6887f6d8cb75152b6b17696a4ed4ee46c007163692804
Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529

Uniqueness

Uniqueness Score: -1.00%

Function 00459364 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004594A1,00000000,00459659,?,00000000,00000000,00000000), ref: 004593B1

Strings

.NET Framework not found, xrefs: 004593C0
InstallRoot, xrefs: 004593A0
SOFTWARE\Microsoft\.NETFramework, xrefs: 00459384

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: be4fb59b900ee74e718d87cdc4fcd1eef43a9c564c0a5ec1af3f625bb6e6dd39
Instruction ID: 1950c6f853cc10ed35e504d9d8503a730f6ffd27dc9bba4e9fa27fab35675349
Opcode Fuzzy Hash: be4fb59b900ee74e718d87cdc4fcd1eef43a9c564c0a5ec1af3f625bb6e6dd39
Instruction Fuzzy Hash: 12F0AF31300110DBCB10EB9AD885B6F6299DB9931AF50503BF981DB293E73CCC168629

Uniqueness

Uniqueness Score: -1.00%

Function 00483BC4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483C05
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483C28

Strings

System\CurrentControlSet\Control\Windows, xrefs: 00483BD2
CSDVersion, xrefs: 00483BFC

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 33fca6af7241f4b653fe53c350a6e88c669f1de2ef3da1c7a1752152dae0c121
Instruction ID: 1d850e848a14c5c59b8e95f13e5f63a8fb365af486cc5d6c9f9b701d22fca986
Opcode Fuzzy Hash: 33fca6af7241f4b653fe53c350a6e88c669f1de2ef3da1c7a1752152dae0c121
Instruction Fuzzy Hash: 56F03176E40208A6DF10EAD48C45BAFB3BCAB14B05F104967EA10F7280E678AB048B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042D8F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

Strings

kernel32.dll, xrefs: 0042D905
GetSystemWow64DirectoryA, xrefs: 0042D900

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
Opcode Fuzzy Hash: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68

Strings

ShutdownBlockReasonDestroy, xrefs: 0042EB58
user32.dll, xrefs: 0042EB5D

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD

Uniqueness

Uniqueness Score: -1.00%

Function 0044F744 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498BF2), ref: 0044F77F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Strings

user32.dll, xrefs: 0044F77A
NotifyWinEvent, xrefs: 0044F775

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction ID: 5e946f17392c81a4f172a46fe169fb9a1f72c9003761a5edf28bd31acc2f1150
Opcode Fuzzy Hash: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction Fuzzy Hash: 59E012F0E417049AFF00BBB57B86B1A3A90E764719B00057FF414A6292DB7C481C4F9D

Uniqueness

Uniqueness Score: -1.00%

Function 00498968 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498C48,00000001,00000000,00498C6C), ref: 00498972
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498978

Strings

DisableProcessWindowsGhosting, xrefs: 00498968
user32.dll, xrefs: 0049896D

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 71af8591fbce5d4533a7188bae6238bebf63b2f5996384562a89c67780edd1c3
Instruction ID: 34f838485a85c0df890c3e192e44216071158a5cea444d63bbc0a0b2480586ef
Opcode Fuzzy Hash: 71af8591fbce5d4533a7188bae6238bebf63b2f5996384562a89c67780edd1c3
Instruction Fuzzy Hash: 22B002C0651707589D5032FA0D06B3F48484C5276D728057F3414A51C6DD6C89115D3F

Uniqueness

Uniqueness Score: -1.00%

Function 004645F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498BF2), ref: 0044B67F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498C1A), ref: 00464603
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464609

Strings

shell32.dll, xrefs: 004645FE
SHPathPrepareForWriteA, xrefs: 004645F9

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: edc6f8ec64a36a5908760ff58e990ea99ea877eb638915fc896b3384d426fa6b
Instruction ID: ed4894befccbfeda2ad80f7d1b9e1cb4df1a551eae9986247d0c145e26b1cd95
Opcode Fuzzy Hash: edc6f8ec64a36a5908760ff58e990ea99ea877eb638915fc896b3384d426fa6b
Instruction Fuzzy Hash: DDB092D0A82740A4C90077F2985B90F2A4488A271EB10153B710476483EABC84100EAE

Uniqueness

Uniqueness Score: -1.00%

Function 0047D67C Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047D7F0,?,?,?,?,00000000,0047D945,?,?,?,00000000,?,0047DA54), ref: 0047D7CC
FindClose.KERNEL32(000000FF,0047D7F7,0047D7F0,?,?,?,?,00000000,0047D945,?,?,?,00000000,?,0047DA54,00000000), ref: 0047D7EA

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: aed5ff881d9cd74b79ade3454e116a6c1ede96761b74de0710c412a42c079b2d
Instruction ID: 2ce97de6e4eb512f8d4c2eb376340b964b0e691095a652a34be041e4083b4e02
Opcode Fuzzy Hash: aed5ff881d9cd74b79ade3454e116a6c1ede96761b74de0710c412a42c079b2d
Instruction Fuzzy Hash: 07813A74D0024D9FCF11EFA5CC91ADFBBB8EF49304F5080AAE908A7291D6399A46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004755AC Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36

Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD

GetLastError.KERNEL32(00000000,00475721,?,?,0049C1E0,00000000), ref: 0047560A

Strings

LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 004756DF
MoveFileEx, xrefs: 0047566F
, xrefs: 00475642, 0047565D

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: a13b4d41162069bde37ca5ba37a3bfc16fb44220c5afb8832f1568bbfa6ce935
Instruction ID: cfe7f312216358cbd0971b398f0cafde252de4893b1317a5ce8d70824cf78b76
Opcode Fuzzy Hash: a13b4d41162069bde37ca5ba37a3bfc16fb44220c5afb8832f1568bbfa6ce935
Instruction Fuzzy Hash: 4D418570A006099BDB10EFA5D882AEF77B5FF48314F508537E408BB395D7789A058BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413CF8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D46
GetDesktopWindow.USER32 ref: 00413DFE

Part of subcall function 00418EC0: 6F5BC6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EDC
Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EF9

SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction ID: d0219f8535474b9b7e790bb207accfb6dce16a9ac66decbe361331da1304c66b
Opcode Fuzzy Hash: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction Fuzzy Hash: 91412C75600210AFC710DF2AFA84B56B7E1EB65329B16817BE405CB365DB38DD81CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00408A54 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction ID: 7d65b0a5aa49ad722f3f3263bbe29e3330acee4661d9e2153cfe083702b22da2
Opcode Fuzzy Hash: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction Fuzzy Hash: 1F3123716083849AD370EB65C945BDF77D89B85704F40483FB6C8E72D1EB7859048B6B

Uniqueness

Uniqueness Score: -1.00%

Function 0044E8C4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D

Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991

Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8

IsRectEmpty.USER32(?), ref: 0044E953
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: a4575d285c62c1c56b7686ad69dfdc5ef60a631fed5d3d1fc0705a1474777ead
Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
Opcode Fuzzy Hash: a4575d285c62c1c56b7686ad69dfdc5ef60a631fed5d3d1fc0705a1474777ead
Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299

Uniqueness

Uniqueness Score: -1.00%

Function 00495924 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00495988
OffsetRect.USER32(?,00000000,?), ref: 004959A3
OffsetRect.USER32(?,?,00000000), ref: 004959BD
OffsetRect.USER32(?,00000000,?), ref: 004959D8

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: e6cd63ab1267e2bef36e0ea42f4f89ffcc49fa5b03609306a0fb63f812f5ac90
Instruction ID: 9409249b62c1188f54b5b62e2685c04785358b71117f53a2337039625fc08c68
Opcode Fuzzy Hash: e6cd63ab1267e2bef36e0ea42f4f89ffcc49fa5b03609306a0fb63f812f5ac90
Instruction Fuzzy Hash: 1121AEB6700701AFDB00DE69CD81E5BB7DAEFC4350F248A2AF944C3249D638ED048761

Uniqueness

Uniqueness Score: -1.00%

Function 004955DC Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000008,?), ref: 004955F1
MulDiv.KERNEL32(?,00000008,?), ref: 00495605
MulDiv.KERNEL32(?,00000008,?), ref: 00495619
MulDiv.KERNEL32(?,00000008,?), ref: 00495637

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction ID: b77f8f3c6746ea581d036ce488ab013aedd37a602364075716cddbfd1b85439e
Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction Fuzzy Hash: A5112E72604504ABCB40DEA9D8C4D9B7BECEF8D324B6441AAF908DB242D674ED408B68

Uniqueness

Uniqueness Score: -1.00%

Function 0041F480 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
RegisterClassA.USER32(00499598), ref: 0041F4D4
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: f5329bc195fe8fc87e14c8434c73e300a75752ca243df2a436e9fb21fcb0b6a1
Instruction ID: 7a0dc659497f48f9aad4428a0df7724adcaf244520b53866b591a9b3b5545ee4
Opcode Fuzzy Hash: f5329bc195fe8fc87e14c8434c73e300a75752ca243df2a436e9fb21fcb0b6a1
Instruction Fuzzy Hash: F6011B72240104AADA10EBACED81E9B33999729314B11423BB615E72A2D6399C558BAC

Uniqueness

Uniqueness Score: -1.00%

Function 0040D010 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CB58,0000000A,00000000), ref: 0040D041
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047CB58), ref: 0040D05B
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68

Uniqueness

Uniqueness Score: -1.00%

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0238D36C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0238D36C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0238D36C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0238D36C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 303ccfa916ee30606edfd417ee1dfeae8d79d4aa2781d0ec5268568314661242
Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
Opcode Fuzzy Hash: 303ccfa916ee30606edfd417ee1dfeae8d79d4aa2781d0ec5268568314661242
Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD

Uniqueness

Uniqueness Score: -1.00%

Function 004705A0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 004705F1

Strings

Setting NTFS compression on file: %s, xrefs: 004705BF
Unsetting NTFS compression on file: %s, xrefs: 004705D7
Failed to set NTFS compression state (%d)., xrefs: 00470602

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: e534bd073bd99d1ffd8d8a7551bf23dca8ffa9a0f38022b87dc0121eb45f3a98
Instruction ID: 452327faed6fd823952186a677ff1a78a18aba12ee86070aec797b5412e08bdc
Opcode Fuzzy Hash: e534bd073bd99d1ffd8d8a7551bf23dca8ffa9a0f38022b87dc0121eb45f3a98
Instruction Fuzzy Hash: A5018B71D09248A6CB04D7AD94512DDBBE49F4D314F44C5FFE459D7342DB780A088B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0046FDF4 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046FE45

Strings

Setting NTFS compression on directory: %s, xrefs: 0046FE13
Failed to set NTFS compression state (%d)., xrefs: 0046FE56
Unsetting NTFS compression on directory: %s, xrefs: 0046FE2B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: f57c8121f87b7cbe45d24f1443a8c943819022774a47ae68e03ba31a404fe09e
Instruction ID: 6c3eba688a3488f6cff2036d9eec8e6f632fba0cce39d579df3f4bd3b957a0ce
Opcode Fuzzy Hash: f57c8121f87b7cbe45d24f1443a8c943819022774a47ae68e03ba31a404fe09e
Instruction Fuzzy Hash: E5014421E0824856CB04D7ADE44129DBBA49F49304F4485BBA495E7253EB790A09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00455D9C Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000,0045B7D5), ref: 00455DD8
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B7AE,?,?,?,?,?,00000000), ref: 00455DE1
RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 53be27aa0997865f395f34354d63af882f7726c3d4a8d794711f16c86898bbe7
Instruction ID: 71ccc6c4ad223293e5fa71c014565a1ca4f3f808124b73c5b0663eb55104ffd2
Opcode Fuzzy Hash: 53be27aa0997865f395f34354d63af882f7726c3d4a8d794711f16c86898bbe7
Instruction Fuzzy Hash: 57F0BEB174070036EA10B6BAAC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04962D

Uniqueness

Uniqueness Score: -1.00%

Function 00478204 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8,?,?,?,?,?,00498CDB,00000000), ref: 0047820D
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8,?,?,?,?,?,00498CDB), ref: 00478213
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8), ref: 00478235
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004812C8), ref: 00478246

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 89672e1c1dad377db11468aaf314ccfc00159a4e206af17bba33db1213e8e157
Instruction ID: 91f0679cb69370e855683a510bc75a037ced8834772831ea40795c83ba0b1c60
Opcode Fuzzy Hash: 89672e1c1dad377db11468aaf314ccfc00159a4e206af17bba33db1213e8e157
Instruction Fuzzy Hash: D8F037716447007BD600E6B58C81E5B73DCEB44354F04493E7E98C71C1DA78DC089776

Uniqueness

Uniqueness Score: -1.00%

Function 00424240 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 0042424C
IsWindowVisible.USER32(?), ref: 0042425D
IsWindowEnabled.USER32(?), ref: 00424267
SetForegroundWindow.USER32(?), ref: 00424271

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: d317456c615bf9008b67529b06aff5f9fae4f5f479d94640f2b11ca0dbd6cbb7
Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
Opcode Fuzzy Hash: d317456c615bf9008b67529b06aff5f9fae4f5f479d94640f2b11ca0dbd6cbb7
Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040626F
GlobalUnWire.KERNEL32(00000000), ref: 00406276
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
GlobalFix.KERNEL32(00000000), ref: 00406281

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A218 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047BB01,?,00000000,00000000,00000001,00000000,0047A4B5,?,00000000), ref: 0047A479

Strings

Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0047A2ED
Failed to parse "reg" constant, xrefs: 0047A480

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: 05ee6b3b67afee6859f894b9066335fb286a048b1f35c691c8bdca609618c678
Instruction ID: 25f2a786541cb687838a6194ffc4a73185deb9e5551b5ad8c851c0bf1152322b
Opcode Fuzzy Hash: 05ee6b3b67afee6859f894b9066335fb286a048b1f35c691c8bdca609618c678
Instruction Fuzzy Hash: 22817274E00108AFCB10DF95D485ADEBBF9AF88344F50817AE814B7392D739AE05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004763AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,004764DF,?,00000000,004764F0,?,00000000,00476539), ref: 004764B0
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,004764DF,?,00000000,004764F0,?,00000000,00476539), ref: 004764C4

Strings

Extracting temporary file: , xrefs: 004763EC

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: FileTime$Local
String ID: Extracting temporary file:
API String ID: 791338737-4171118009
Opcode ID: a80e35328548893b295efc7472ac722154afa94c34651c27e26e6e8334cb8313
Instruction ID: 173659db1c42fed311bbc77dc24fc0b62308bfde4479aaaaa113f8cb774a82d8
Opcode Fuzzy Hash: a80e35328548893b295efc7472ac722154afa94c34651c27e26e6e8334cb8313
Instruction Fuzzy Hash: 9541B670E00649AFCB01DFA5C892AAFBBB9EB09704F51847AF814A7291D7789905CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0046CC0C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046CD38
Failed to proceed to next wizard page; aborting., xrefs: 0046CD24

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: 7a25e1645a33cbe6e929f5c7beb1038c0aed19b3e354743701339651447d5c4b
Instruction ID: bcb3787111d781b294161d03010f6e791927551fc3c7e501f8e48cd77162cd73
Opcode Fuzzy Hash: 7a25e1645a33cbe6e929f5c7beb1038c0aed19b3e354743701339651447d5c4b
Instruction Fuzzy Hash: A531C430604204DFD711EB59D9C5BA977F5EB06304F5500BBF448AB392D7786E40CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00478E98 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,;H,?,00000001,?,?,00483BE3,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00478F7E,?,?,00000001,00000000,00000000,00478F99), ref: 00478F67

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478EF2
%s\%s_is1, xrefs: 00478F10

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 4390143081fa1cbfc05a77ab89ffad6b83c856e6c2d55465ffb8b64579313e9f
Instruction ID: 4b2a563bf9abf46f4fe3d7c32e0d4fce195dfbf5fea183d3e913b06dd9c9918d
Opcode Fuzzy Hash: 4390143081fa1cbfc05a77ab89ffad6b83c856e6c2d55465ffb8b64579313e9f
Instruction Fuzzy Hash: EC218070B44244AFDB11DBA9CC45A9EBBF9EB8D704F90847BE408E7381DB789D018B58

Uniqueness

Uniqueness Score: -1.00%

Function 00450168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E

Strings

open, xrefs: 00450221

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
Opcode Fuzzy Hash: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00455290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Strings

<, xrefs: 004552E6

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: 397510d247cb734b7669861417dbfcfbd251f2c0a68ff4605259e86b5c29478d
Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
Opcode Fuzzy Hash: 397510d247cb734b7669861417dbfcfbd251f2c0a68ff4605259e86b5c29478d
Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,0238D36C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,0238D36C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,0238D36C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,0238D36C,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: 09cf32ac568926239da630a480ec85c7fe0e44c3c7351229851fbcf18ccaddb2
Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
Opcode Fuzzy Hash: 09cf32ac568926239da630a480ec85c7fe0e44c3c7351229851fbcf18ccaddb2
Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C

Uniqueness

Uniqueness Score: -1.00%

Function 00496B2E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00496B69

Strings

@, xrefs: 00496B34
/INITPROCWND=$%x , xrefs: 00496B94

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: 065ab22c92abacbd348a857e8389b224364e1a84b4d72130b6d36c29b0d142f9
Instruction ID: 88b10d18150c6b9811cea3f3864e76c9cf3cbfb68c265b437af87b1fefc14b87
Opcode Fuzzy Hash: 065ab22c92abacbd348a857e8389b224364e1a84b4d72130b6d36c29b0d142f9
Instruction Fuzzy Hash: A3117231A042489FDF01DBA4E855BAEBFE8EB49314F51847BE504E7292EB3CA905C658

Uniqueness

Uniqueness Score: -1.00%

Function 00447414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 004474C6

Strings

Unknown Method, xrefs: 0044749F
NIL Interface Exception, xrefs: 00447468

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: eaaa5532a95bbaa63f0b72a9291e33775e11d622c6162567185e6fee38e986d8
Instruction ID: eb0132878ffe7144b3db707554455947565e11d0cdd4dc78092451a8fec87e99
Opcode Fuzzy Hash: eaaa5532a95bbaa63f0b72a9291e33775e11d622c6162567185e6fee38e986d8
Instruction Fuzzy Hash: 8011B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004963A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00496468,?,0049645C,00000000,00496443), ref: 0049640E
CloseHandle.KERNEL32(004964A8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00496468,?,0049645C,00000000), ref: 00496425

Part of subcall function 004962F8: GetLastError.KERNEL32(00000000,00496390,?,?,?,?), ref: 0049631C

Strings

0nI, xrefs: 004963D9, 004963E8

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: 0nI
API String ID: 3798668922-794067871
Opcode ID: 9f8f3e3bd8d813766f30c87d8e8bb38219208be6823d56de1360ae23e0f090d4
Instruction ID: 4379268ebcebee96409867e54b2437a6ba0b21f89d1dc4ba20584320bf55fb87
Opcode Fuzzy Hash: 9f8f3e3bd8d813766f30c87d8e8bb38219208be6823d56de1360ae23e0f090d4
Instruction Fuzzy Hash: 840182B1644248AFDB00EBD1DC42A9EBBACDF08704F51403AB904E7281D6785E008A2D

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8

Strings

Inno Setup: No Icons, xrefs: 0042DD76

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction ID: 8d080c6700cf8453afd411d185ff7d2dd707f59376968ad674d2e7d16536e1ed
Opcode Fuzzy Hash: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction Fuzzy Hash: 1B012B33B55B7179FB3045256D01F7B57889B82B60F64013BF942EA2C0D6999C04936E

Uniqueness

Uniqueness Score: -1.00%

Function 00452E88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,?,00000000,00452EE9,?,?,-00000001,?), ref: 00452EC3
GetLastError.KERNEL32(00000000,?,00000000,00452EE9,?,?,-00000001,?), ref: 00452ECB

Strings

T$H, xrefs: 00452EF9

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: T$H
API String ID: 1799206407-488339322
Opcode ID: 5d86fcf9b6e052d8a24a57bf4ef79df3c2f35f3d819ce0a4394afd1f6d7b89dc
Instruction ID: d2ab7b9b66ca24062e77e49c95e81f13ab46b8af1b1b2eb811bbb53637dcbd2b
Opcode Fuzzy Hash: 5d86fcf9b6e052d8a24a57bf4ef79df3c2f35f3d819ce0a4394afd1f6d7b89dc
Instruction Fuzzy Hash: 86F0F971A04204AB8B01DB7A9D4249EB7ECEB8A32171045BBFC04E3642E7B84E048558

Uniqueness

Uniqueness Score: -1.00%

Function 00498004 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047D0CC: FreeLibrary.KERNEL32(00000000,00481A2F), ref: 0047D0E2

Part of subcall function 0047CD9C: GetTickCount.KERNEL32 ref: 0047CDE6

Part of subcall function 00457294: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004572B3

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0049895B), ref: 00498059
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0049895B), ref: 0049805F

Strings

Detected restart. Removing temporary directory., xrefs: 00498013

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 281135f9a0ad5b4e488772808dcd9eaa6bf3b34c39f962a9f46887a4a11e3304
Instruction ID: bb05712aa7eb36d303e19ffab6eef2c78f2a463723ea7eca767f41585c441369
Opcode Fuzzy Hash: 281135f9a0ad5b4e488772808dcd9eaa6bf3b34c39f962a9f46887a4a11e3304
Instruction Fuzzy Hash: BDE0E532208A406DDA1177BABC1396B7F5CDB46768B22487FF50882552D92D481CC53D

Uniqueness

Uniqueness Score: -1.00%

Function 00403344 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00498BB6), ref: 0040334B
GetCommandLineA.KERNEL32(00000000,00498BB6), ref: 00403356

Strings

P6a, xrefs: 0040335B

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: P6a
API String ID: 2123368496-542390041
Opcode ID: 48b45b62bccbc2a8e5daf731e4078a894a727d510552ebcfe8024faf6b9ab272
Instruction ID: ff8fa06d391bd0b31f892a344b3e95d40f530220570fde7b1ba7fad45aeb04f1
Opcode Fuzzy Hash: 48b45b62bccbc2a8e5daf731e4078a894a727d510552ebcfe8024faf6b9ab272
Instruction Fuzzy Hash: 45C002609013058AD754AF7579467162A94D751349F80447FF114BA3E1D77C82055BDD

Uniqueness

Uniqueness Score: -1.00%

Function 00455674 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455693
Sleep.KERNEL32(?), ref: 004556A3
GetLastError.KERNEL32 ref: 004556B6
GetLastError.KERNEL32 ref: 004556C0

Memory Dump Source

Source File: 00000001.00000002.1946339227.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1946320495.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946396480.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946417224.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946438660.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1946457059.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_view_01-64.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 124e83ad3764f0425cc9cce0cec047ecc2156a8e27ad070cfe64c44283ad0992
Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
Opcode Fuzzy Hash: 124e83ad3764f0425cc9cce0cec047ecc2156a8e27ad070cfe64c44283ad0992
Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ServiceMinit.exePID: 7948, Parent PID: 7880COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9%
Total number of Nodes:	1510
Total number of Limit Nodes:	161

Executed Functions

Function 00403970 Relevance: 38.7, APIs: 10, Strings: 12, Instructions: 171
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00403983

Part of subcall function 00405BB0: InitializeCriticalSection.KERNEL32(0043AA5C,00000064,00430420), ref: 00405BC9
Part of subcall function 00405BB0: EnterCriticalSection.KERNEL32(0043AA5C,00000064,00430420), ref: 00405BDB
Part of subcall function 00405BB0: InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405C12
Part of subcall function 00405BB0: EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405C24
Part of subcall function 00405BB0: _getenv.LIBCMT ref: 00405C57
Part of subcall function 00405BB0: InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405C78
Part of subcall function 00405BB0: EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405C8A
Part of subcall function 00405BB0: _getenv.LIBCMT ref: 00405D05
Part of subcall function 00405BB0: InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405D26
Part of subcall function 00405BB0: EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405D38
Part of subcall function 00405BB0: _getenv.LIBCMT ref: 00405DB3
Part of subcall function 00405BB0: InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405DD4
Part of subcall function 00405BB0: EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405DE6

InitializeCriticalSection.KERNEL32(0043AA5C,0043AA74,?,00000064,00430420), ref: 004039DA
EnterCriticalSection.KERNEL32(0043AA5C,0043AA74,?,00000064,00430420), ref: 004039EC
lstrcmpiA.KERNEL32(00000000,UnregServer), ref: 00403A3C
lstrcmpiA.KERNEL32(00000000,RegServer), ref: 00403A5E
lstrcmpiA.KERNEL32(00000000,Service), ref: 00403A84

Part of subcall function 00404E50: InitializeCriticalSection.KERNEL32(0043AA5C,F0AA0F6A,?,00000000,0042EFA0,000000FF,?,00403A9C,00000001,00000001), ref: 00404E88
Part of subcall function 00404E50: EnterCriticalSection.KERNEL32(0043AA5C,F0AA0F6A,?,00000000,0042EFA0,000000FF,?,00403A9C,00000001,00000001), ref: 00404E9A
Part of subcall function 00404E50: CoInitialize.OLE32(00000000), ref: 00404EC3

Strings

.\ServiceMinit.cpp, xrefs: 00403B0C
RegServer, xrefs: 00403A55
.\ServiceMinit.cpp, xrefs: 004039F2
AppID, xrefs: 00403AC9
{F1D4E2A2-4B35-11D5-89B1-0001028D1A2A}, xrefs: 00403B56
keyAppID.Open() error, xrefs: 00403B20
LocalService, xrefs: 00403BF0
UnregServer, xrefs: 00403A33
.\ServiceMinit.cpp, xrefs: 00403B9D
Service, xrefs: 00403A7B
key.Open() error, xrefs: 00403BB1
CServiceModule::_tWinMain(), xrefs: 00403A06

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$Initialize$Enter$_getenvlstrcmpi$CommandLine
String ID: .\ServiceMinit.cpp$.\ServiceMinit.cpp$.\ServiceMinit.cpp$AppID$CServiceModule::_tWinMain()$LocalService$RegServer$Service$UnregServer$key.Open() error$keyAppID.Open() error${F1D4E2A2-4B35-11D5-89B1-0001028D1A2A}
API String ID: 3403806960-919169053
Opcode ID: 9be5aaa678ae8641ba3fe3cb82d8e0112a281000c9fef272a80bc68efe4cc875
Instruction ID: a64d1a377f4d79a045d4eb934f4541e61a2f64c37e036c9c79492cd34675587d
Opcode Fuzzy Hash: 9be5aaa678ae8641ba3fe3cb82d8e0112a281000c9fef272a80bc68efe4cc875
Instruction Fuzzy Hash: 0771D471940208DBDB04EFA1EC49BEE7B74AB58304F10617EE581B22E1DBB85A54CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406140 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 92
servicewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,?,?,?,?,00405AE4), ref: 00406159
EnterCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,?,?,?,?,00405AE4), ref: 0040616B
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,?,?,?,?,?,00405AE4), ref: 004061B1
MessageBoxA.USER32(00000000,00431878,?,00000000), ref: 004061D0
OpenServiceA.ADVAPI32(00000000,?,00010020), ref: 004061ED
CloseServiceHandle.ADVAPI32(00000000), ref: 00406200
MessageBoxA.USER32(00000000,004318DC,?,00000000), ref: 00406216

Strings

Z@, xrefs: 004061FC, 004061E9
CServiceModule::Uninstall(), xrefs: 00406185
.\ServiceMinit.cpp, xrefs: 00406171

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalMessageOpenSectionService$CloseEnterHandleInitializeManager
String ID: .\ServiceMinit.cpp$CServiceModule::Uninstall()$Z@
API String ID: 146462905-1623470890
Opcode ID: cfc55417f4f085dc926518a2949a1dd43cb884e2c3ab5db4b134038f3dbd8cd1
Instruction ID: 06d43fe44f5f93d897bfa6795492ffaad04e0ec981de45b1b0d2e1dc326417d4
Opcode Fuzzy Hash: cfc55417f4f085dc926518a2949a1dd43cb884e2c3ab5db4b134038f3dbd8cd1
Instruction Fuzzy Hash: A0319234A40204EFEB04EBB4ED59FAE7775AB4C701F10A27AF502B62D0D6789954CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00405BB0 Relevance: 57.9, APIs: 21, Strings: 12, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,00000064,00430420), ref: 00405BC9
EnterCriticalSection.KERNEL32(0043AA5C,00000064,00430420), ref: 00405BDB
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405C12
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405C24
_getenv.LIBCMT ref: 00405C57
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405C78
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405C8A
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405CC3
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405CD5
_getenv.LIBCMT ref: 00405D05
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405D26
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405D38
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405D71
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405D83
_getenv.LIBCMT ref: 00405DB3
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405DD4
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405DE6
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405E1F
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00405E31
LoadStringA.USER32(?,?,?,00000100), ref: 00405E91
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00405F0F

Strings

CServiceModule::PATH=%s, xrefs: 00405CF3
CServiceModule::HG_TOP_DIR=NULL, xrefs: 00405D52
PATH, xrefs: 00405C52
CServiceModule::SERVER_DLLS=%s, xrefs: 00405E4F
CServiceModule::Init(), xrefs: 00405C3E
CServiceModule::SERVER_DLLS=NULL, xrefs: 00405E00
SERVER_DLLS, xrefs: 00405DAE
CServiceModule::HG_TOP_DIR=%s, xrefs: 00405DA1
.\ServiceMinit.cpp, xrefs: 00405BE1, 00405C2A, 00405C90, 00405CDB, 00405D3E, 00405D89, 00405DEC, 00405E37
============================================, xrefs: 00405BF5
HG_TOP_DIR, xrefs: 00405D00
CServiceModule::PATH=NULL, xrefs: 00405CA4

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$Initialize$Enter$_getenv$LoadString
String ID: .\ServiceMinit.cpp$============================================$CServiceModule::HG_TOP_DIR=%s$CServiceModule::HG_TOP_DIR=NULL$CServiceModule::Init()$CServiceModule::PATH=%s$CServiceModule::PATH=NULL$CServiceModule::SERVER_DLLS=%s$CServiceModule::SERVER_DLLS=NULL$HG_TOP_DIR$PATH$SERVER_DLLS
API String ID: 2995279931-2717624542
Opcode ID: 4922ad66b7635c6b891e68e10db0f64cc5a481e4b4e14c81213d2d5b894ba2ce
Instruction ID: acca4f42ff14a162e2a45e04993ce93f744dd9570f822106646db080e30b10af
Opcode Fuzzy Hash: 4922ad66b7635c6b891e68e10db0f64cc5a481e4b4e14c81213d2d5b894ba2ce
Instruction Fuzzy Hash: 2D81D575580244ABDB00EF90ED4DB4A3B70AB18309F24B17EE8C6663A1D3B94568DF1F

Uniqueness

Uniqueness Score: -1.00%

Function 00401220 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401500: _getenv.LIBCMT ref: 00401509

_sprintf.LIBCMT ref: 00401249
_memset.LIBCMT ref: 0040125C

Part of subcall function 004014E0: __stat64i32.LIBCMT ref: 004014EB

_sprintf.LIBCMT ref: 00401299

Part of subcall function 0040CF8A: __output_l.LIBCMT ref: 0040CFDD

LeaveCriticalSection.KERNEL32(0043AA5C), ref: 00401303
GetCurrentThreadId.KERNEL32 ref: 0040139F
_sprintf.LIBCMT ref: 004013FD
_fputs.LIBCMT ref: 0040146A
LeaveCriticalSection.KERNEL32(0043AA5C), ref: 00401486

Part of subcall function 0040CE39: DeleteFileA.KERNEL32(?,004012C2,?,?,?,?,?,?,?,?,?,?,?,?,004011BF,CServiceModule::IsInstalled()), ref: 0040CE3D
Part of subcall function 0040CE39: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004011BF,CServiceModule::IsInstalled()), ref: 0040CE47
Part of subcall function 0040CE39: __dosmaperr.LIBCMT ref: 0040CE56

Strings

%04d/%02d/%02d %02d:%02d:%02d.%03d [%04d:%s:%04d] , xrefs: 004013F1
%s\ServiceMinit.log, xrefs: 0040123D
%s.old, xrefs: 0040128D

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: _sprintf$CriticalLeaveSection$CurrentDeleteErrorFileLastThread__dosmaperr__output_l__stat64i32_fputs_getenv_memset
String ID: %04d/%02d/%02d %02d:%02d:%02d.%03d [%04d:%s:%04d] $%s.old$%s\ServiceMinit.log
API String ID: 2556210007-1441101590
Opcode ID: 3724870ca4b8be6e85ba818a6ab2f69c936aa1394cc3c6c34fc88845c3f4b475
Instruction ID: 0346ccfba624cb3aa74887a46b4c4086b3e99751b9784b494c3a11aa2d327130
Opcode Fuzzy Hash: 3724870ca4b8be6e85ba818a6ab2f69c936aa1394cc3c6c34fc88845c3f4b475
Instruction Fuzzy Hash: 7861A6B5D001189BCB14DB50DD85EDEB378AB48309F4486EEF90977291EA389BC8CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00409690 Relevance: 18.6, APIs: 12, Instructions: 571
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiA.KERNEL32(00000000,00430394), ref: 00409740
lstrcmpiA.KERNEL32(00000000,00430374), ref: 0040975E

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 1742302c096598b4af306b40afe57d209e794b429635fe8f83af9ac050924e33
Instruction ID: 1ca1c44655ee9b4dd4f1bdc294fd0864d4db539a443e4aef00778e1943b2eb76
Opcode Fuzzy Hash: 1742302c096598b4af306b40afe57d209e794b429635fe8f83af9ac050924e33
Instruction Fuzzy Hash: 504226B0904118DBDF14EFA5C899BEEB7B4BB44304F10416EE60A772D2DB385E85CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004067F0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040684E

Strings

.tlb, xrefs: 00406BBA
z, xrefs: 00406892

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: FileModuleName
String ID: .tlb$z
API String ID: 514040917-4222463387
Opcode ID: 9a51ab09195e4603d3529f086a7f388a968a5fe3ba3efdd49027be61dd239d39
Instruction ID: b6f51d081ea25407fdd8ab6e138143139b20290db2911b39c91a2298c9703b6e
Opcode Fuzzy Hash: 9a51ab09195e4603d3529f086a7f388a968a5fe3ba3efdd49027be61dd239d39
Instruction Fuzzy Hash: EEF1E9B1901228DBDB24DF55CD95BDEB7B0AF48304F4041EAE54AB7280DB789EA5CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABB0 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::stl_critical_section_concrt::stl_critical_section_concrt.LIBCPMTD ref: 0040ABC9

Strings

z, xrefs: 0040AD00
Module, xrefs: 0040AF0E, 0040AF2E
", xrefs: 0040AEED
Module_Raw, xrefs: 0040AF82

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Concurrency::details::stl_critical_section_concrt::stl_critical_section_concrt
String ID: "$Module$Module_Raw$z
API String ID: 2239783310-2838227397
Opcode ID: 85a2eb360b5ae7507ac48fc8c50baf3eedd1054085b8059f4df42fbcaabd6a34
Instruction ID: e4e9d695f85cdb35b2a0b3f5634031d0e22b71fd059e4db1701e9b9a2c2604df
Opcode Fuzzy Hash: 85a2eb360b5ae7507ac48fc8c50baf3eedd1054085b8059f4df42fbcaabd6a34
Instruction Fuzzy Hash: 82D13A719052288BDB24EF55DC50BEEB3B0AF49304F0041EEE50977292DB386E95CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401170 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00401189
EnterCriticalSection.KERNEL32(0043AA5C), ref: 0040119B
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 004011D2
OpenServiceA.ADVAPI32(00000000,?,00000001), ref: 004011EE
CloseServiceHandle.ADVAPI32(00000000), ref: 00401208
CloseServiceHandle.ADVAPI32(00000000), ref: 00401212

Strings

CServiceModule::IsInstalled(), xrefs: 004011B5
.\ServiceMinit.cpp, xrefs: 004011A1

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Service$CloseCriticalHandleOpenSection$EnterInitializeManager
String ID: .\ServiceMinit.cpp$CServiceModule::IsInstalled()
API String ID: 310523789-2732721916
Opcode ID: eb1060544750c4826093f5c55a46b1932f4d3a5cca13ffe6d2bd53e4101ec16b
Instruction ID: 869cb28eb4d2686f3ea92feec4f3a971acf7fb16f3c24d3da782c3d241997189
Opcode Fuzzy Hash: eb1060544750c4826093f5c55a46b1932f4d3a5cca13ffe6d2bd53e4101ec16b
Instruction Fuzzy Hash: 2611CE74980308EBDB14EFA0ED4DB6D7B70AB08305F1092A9E941B2391C7B85654DF1E

Uniqueness

Uniqueness Score: -1.00%

Function 004083E0 Relevance: 9.2, APIs: 6, Instructions: 219
librarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00000000,?,F0AA0F6A), ref: 0040846C
LoadLibraryExA.KERNELBASE(00000000,00000000,00000002,00000400,00000000,00000400,0042F0C3,00000400), ref: 0040855B
FindResourceA.KERNEL32(00000000,00000400,00000000), ref: 00408586
FreeLibrary.KERNEL32(00000000,00000000,00000000,?,?,?,?), ref: 004086D0

Part of subcall function 00404640: GetLastError.KERNEL32(?,00404604,?,?,?,?,?,?,?,00000000,0042EF70,000000FF), ref: 00404646

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Library$ErrorFindFreeLastLoadResourcelstrlen
String ID:
API String ID: 3607514145-0
Opcode ID: 63c39e1f7fb701cd30208eb1accc0598d8757d3a3ef54f093196fda49bad776b
Instruction ID: 4444f1c583aa86f41c5867afa53c7a296204d83a082266d3899e2f4ce3aee35d
Opcode Fuzzy Hash: 63c39e1f7fb701cd30208eb1accc0598d8757d3a3ef54f093196fda49bad776b
Instruction Fuzzy Hash: 2BA12AB0C00218DBCB14DFA4DD45BEEB7B4AF44314F1045AEE64977281EB395A85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405A60 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,?,00403A50), ref: 00405A79

Part of subcall function 00406140: InitializeCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,?,?,?,?,00405AE4), ref: 00406159
Part of subcall function 00406140: EnterCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,?,?,?,?,00405AE4), ref: 0040616B

EnterCriticalSection.KERNEL32(0043AA5C,?,00403A50), ref: 00405A8B
CoInitialize.OLE32(00000000), ref: 00405AB4
CoUninitialize.OLE32(00000001,00000000), ref: 00405AF0

Strings

.\ServiceMinit.cpp, xrefs: 00405A91
CServiceModule::UnregisterServer(), xrefs: 00405AA5

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$Initialize$Enter$Uninitialize
String ID: .\ServiceMinit.cpp$CServiceModule::UnregisterServer()
API String ID: 2280959042-2829193702
Opcode ID: aca329e018dae73db719ab051e7e27b3e22e66368adadc2cd5cf2a28bb999bec
Instruction ID: e10cd5b553a9bd4b7c60894b8b0b86a28370015214c549edea9ef6f6513ef909
Opcode Fuzzy Hash: aca329e018dae73db719ab051e7e27b3e22e66368adadc2cd5cf2a28bb999bec
Instruction Fuzzy Hash: E3016D30680204AFDB00EFA1ED4AB5D7BB0AB08705F1061A9E585A62E1DBB86954DF1E

Uniqueness

Uniqueness Score: -1.00%

Function 00406F70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnRegisterTypeLib.OLEAUT32(?,?,?,?,?), ref: 00406FF6

Strings

\o@, xrefs: 00406F76, 00406F8F, 0040702A
\o@, xrefs: 00406F98, 00406F9B

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: RegisterType
String ID: \o@$\o@
API String ID: 2778101878-101146686
Opcode ID: d535b6ee436e7968a2f40d9941124e9375c64837b394b2e2f2dce52b3b04ba23
Instruction ID: fc45a9b89ba459778e767429b4fdca6503fdc3573753b2b4d32699faf48bd2d8
Opcode Fuzzy Hash: d535b6ee436e7968a2f40d9941124e9375c64837b394b2e2f2dce52b3b04ba23
Instruction Fuzzy Hash: 4B31CCB5D00109EFCB04EFA5C891DEFB7B9BF48304F2045ADE515A7291DB34AA41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004010B0 Relevance: 3.8, APIs: 3, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CharNextA.USER32(?), ref: 004010EE
CharNextA.USER32(00000000), ref: 004010FA
CharNextA.USER32(?), ref: 00401109

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 75ec6257532cff03e73f5d8352a44eedde3c7f64488a81d14746b496702df13b
Instruction ID: 82a503c13fc14620c08baa6895582078b2b94726323239102ebfcad9fa8eb189
Opcode Fuzzy Hash: 75ec6257532cff03e73f5d8352a44eedde3c7f64488a81d14746b496702df13b
Instruction Fuzzy Hash: E1015E34505148EFCF08CF60C8949BE7BB5AF49702F24C1AEE9059B661D738DE40DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0041D7A7 Relevance: 3.0, APIs: 2, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00413839,00000001), ref: 0041D7B8
HeapDestroy.KERNEL32 ref: 0041D7EE

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Heap$CreateDestroy
String ID:
API String ID: 3296620671-0
Opcode ID: 0c65be24ec40ea6f2b3044880ab665ce8047fda8414e6124f43c29ce023be7bc
Instruction ID: 1944b28af78936fec655b5920f650459b6bf2640a53089ccc9cc5cd139ce4f4b
Opcode Fuzzy Hash: 0c65be24ec40ea6f2b3044880ab665ce8047fda8414e6124f43c29ce023be7bc
Instruction Fuzzy Hash: DFE092B0E103029EDB266B32AD097AB36D4E740746F20A47AF520C51F4FF7889809F4E

Uniqueness

Uniqueness Score: -1.00%

Function 0041783F Relevance: 3.0, APIs: 2, Instructions: 18
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00417857

Part of subcall function 00418999: __mtinitlocknum.LIBCMT ref: 004189AD
Part of subcall function 00418999: __amsg_exit.LIBCMT ref: 004189B9
Part of subcall function 00418999: EnterCriticalSection.KERNEL32(?,?,?,0041872F,00000004,004370D0,0000000C,0041A0F9,?,?,00000000,00000000,00000000,004197D3,00000001,00000214), ref: 004189C1

__tzset_nolock.LIBCMT ref: 00417868

Part of subcall function 0041715D: __lock.LIBCMT ref: 0041717F
Part of subcall function 0041715D: __invoke_watson.LIBCMT ref: 004171A3
Part of subcall function 0041715D: __invoke_watson.LIBCMT ref: 004171BE
Part of subcall function 0041715D: __invoke_watson.LIBCMT ref: 004171D9
Part of subcall function 0041715D: ____lc_codepage_func.LIBCMT ref: 004171E1
Part of subcall function 0041715D: _strlen.LIBCMT ref: 00417241
Part of subcall function 0041715D: __malloc_crt.LIBCMT ref: 00417248
Part of subcall function 0041715D: _strlen.LIBCMT ref: 0041725E

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: __invoke_watson$__lock_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__malloc_crt__mtinitlocknum__tzset_nolock
String ID:
API String ID: 4249203040-0
Opcode ID: b6d0a5ef3522225c040480bcc56409a52f01f0172ac2c5c1fdc1b7ca5e65f832
Instruction ID: 05eea345bec0531ea4ab7c4cfc0450cad970292eb3119632f0aab6acfd8bd964
Opcode Fuzzy Hash: b6d0a5ef3522225c040480bcc56409a52f01f0172ac2c5c1fdc1b7ca5e65f832
Instruction Fuzzy Hash: D0E0CD71885310D5C7257BF2560739D7230EB95B65F10122FB5C0112C1CB7C05C1C79D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E84F Relevance: 3.0, APIs: 2, Instructions: 5
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 0040E853

Part of subcall function 0040E829: GetModuleHandleA.KERNEL32(mscoree.dll,0040E858,?,00410022,000000FF,0000001E,00000001,00000000,00000000,?,0041A0B3,?,00000001,004011BF,00418923,00000018), ref: 0040E82E
Part of subcall function 0040E829: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E83E

ExitProcess.KERNEL32 ref: 0040E85D

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: c99fffb33091608b68eb04bbeffa4fbd75a7cac399926fb7d07d96e1bfca17fa
Instruction ID: 84092ec04ffeb73ac9bf4ba95bc02b175235151204747064e0a005d6f4455081
Opcode Fuzzy Hash: c99fffb33091608b68eb04bbeffa4fbd75a7cac399926fb7d07d96e1bfca17fa
Instruction Fuzzy Hash: 1AB00231014100AFDA053B11ED1B41D7B61EF81715F10D93DF189550759B765C60BA45

Uniqueness

Uniqueness Score: -1.00%

Function 004089D0 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(00000000,00000000,00000000,?,004086C0), ref: 00408B80

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: FreeTask
String ID:
API String ID: 734271698-0
Opcode ID: 602ce7ae96e1ee1b33a3c6fed72873477825af2390adebc911da63e068b03c57
Instruction ID: 2e58224ea2bbb46c6feb435098ec1c0dc0d0842c0c36e679409760001a039c51
Opcode Fuzzy Hash: 602ce7ae96e1ee1b33a3c6fed72873477825af2390adebc911da63e068b03c57
Instruction Fuzzy Hash: E251ECB4900258EFDB24DF54DA90BEEB7B5AB48304F1080EEA585B7280CB786EC1DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA40 Relevance: 1.5, APIs: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040AA6C

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: InfoQuery
String ID:
API String ID: 1673771737-0
Opcode ID: 87e9eba54c0793c998f5e2383b24e2f0ffac91dc3e7552c7fd25b7072b457d6d
Instruction ID: 2c4f4003a32774d448bc98f7b3a0628eb3dd5901bea88227fc8d94065c539319
Opcode Fuzzy Hash: 87e9eba54c0793c998f5e2383b24e2f0ffac91dc3e7552c7fd25b7072b457d6d
Instruction Fuzzy Hash: 0AE0487075030CBBD714CE74DE41F6E77799744740F204175E905EA1C0DA749614D7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00404C80 Relevance: 1.5, APIs: 1, Instructions: 28registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,80000000,00000000,00000000,00000000,80000000,AppID), ref: 00404CA2

Part of subcall function 00404C40: RegCloseKey.ADVAPI32 ref: 00404C5E

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: cc62ff038b4ab9adf1b16fe774a57c9fd3040c30f9cb5b155c3041b8a622eafa
Instruction ID: a96cb6b796e6b63a3cdde5bdaf28bd46cebd3fa258b7e7cae9d2a889feaaaa48
Opcode Fuzzy Hash: cc62ff038b4ab9adf1b16fe774a57c9fd3040c30f9cb5b155c3041b8a622eafa
Instruction Fuzzy Hash: 97F0B2B5D0120CEFDB04DF95D895B9EBBB8EB88310F2081A9E904A7380D734AA44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBA3 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 0040EBAB

Part of subcall function 0040EAD5: __lock.LIBCMT ref: 0040EAE3
Part of subcall function 0040EAD5: __decode_pointer.LIBCMT ref: 0040EB12
Part of subcall function 0040EAD5: __decode_pointer.LIBCMT ref: 0040EB1F

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: __decode_pointer$__lock_doexit
String ID:
API String ID: 3276244213-0
Opcode ID: 44ea3af290a5c0fced421c48bee69f607f8ea4075bd654cc3defe53151bfea1d
Instruction ID: f0418e74825f5ced9a78712c1428e7afa1ec256cf104cae6e1c199ea29fd5574
Opcode Fuzzy Hash: 44ea3af290a5c0fced421c48bee69f607f8ea4075bd654cc3defe53151bfea1d
Instruction Fuzzy Hash: A2A02430F4430075F51011017C03F0433007740F30FF044347504340D051F55134440F

Uniqueness

Uniqueness Score: -1.00%

Function 0040CDA8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 0040CDB2

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 2944bcf569b94e2b44a73485ac56fc0f61e1c0f057e6f4bc3992d41405ae1331
Instruction ID: ab66410e7d4158dfcb82cafdda1d776de76ab444ce7f5993a10fbf0b8d40d6b5
Opcode Fuzzy Hash: 2944bcf569b94e2b44a73485ac56fc0f61e1c0f057e6f4bc3992d41405ae1331
Instruction Fuzzy Hash: 95B01275408200FEDA015741EC02B0D77517B80710F80C529B75C200A0923E8124960B

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1E0 Relevance: 1.4, APIs: 1, Instructions: 106stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,F0AA0F6A,000000FF,?,0040B023,?,00000000,00000000,004319B0,?,Module_Raw), ref: 0040B23B

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: c6ee9c59dea4a54b3ef14151f5338a8781b7720310070fefa74c0209edf11d08
Instruction ID: 735ab0c92dffca81a66d0e52864b0ca46bdcb012d54b4a3e1577fb3c71093649
Opcode Fuzzy Hash: c6ee9c59dea4a54b3ef14151f5338a8781b7720310070fefa74c0209edf11d08
Instruction Fuzzy Hash: 7641E6B1D00219DBCB04DFE5D885AEEB7B4FB48714F10462EE912B7281DB389905CB98

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042436C Relevance: 66.4, APIs: 44, Instructions: 431COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 004243A1
___getlocaleinfo.LIBCMT ref: 004243B6
___getlocaleinfo.LIBCMT ref: 004243CB
___getlocaleinfo.LIBCMT ref: 004243E0
___getlocaleinfo.LIBCMT ref: 004243F8
___getlocaleinfo.LIBCMT ref: 0042440D
___getlocaleinfo.LIBCMT ref: 0042441F
___getlocaleinfo.LIBCMT ref: 00424434
___getlocaleinfo.LIBCMT ref: 0042444C
___getlocaleinfo.LIBCMT ref: 00424461

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: b5b8e1ea38fe09f00adcc477a1572e083a0576349d2920f087e950a4e063d431
Instruction ID: ed8af7016d48c66a03100574b0488e20b87c433f707afc56213dc320bc5b529f
Opcode Fuzzy Hash: b5b8e1ea38fe09f00adcc477a1572e083a0576349d2920f087e950a4e063d431
Instruction Fuzzy Hash: 0FE1F3B290021DBEEF11EAE2CD41DFF77BDEF04748F04092AB215D2041EA74EA599B64

Uniqueness

Uniqueness Score: -1.00%

Function 00405FE0 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 95servicewindowCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00406009
EnterCriticalSection.KERNEL32(0043AA5C), ref: 0040601B
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00406064
MessageBoxA.USER32(00000000,00431878,?,00000000), ref: 00406086
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004060A1
CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,00000010,00000003,00000001,?,00000000,00000000,RPCSS,00000000,00000000), ref: 004060DE
CloseServiceHandle.ADVAPI32(00000000), ref: 004060F1
MessageBoxA.USER32(00000000,00431850,?,00000000), ref: 0040610A

Strings

RPCSS, xrefs: 004060AB
.\ServiceMinit.cpp, xrefs: 00406021
CServiceModule::Install(), xrefs: 00406035

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalMessageSectionService$CloseCreateEnterFileHandleInitializeManagerModuleNameOpen
String ID: .\ServiceMinit.cpp$CServiceModule::Install()$RPCSS
API String ID: 3876978789-4041271297
Opcode ID: fadeb88cde240594ff5b9b98ebae142850d51c25553bfa01df2920e72db14d72
Instruction ID: 80c6b10a79878e3c14f1b8978468697218ebc5510cea4c8bdf3df619a66d38d6
Opcode Fuzzy Hash: fadeb88cde240594ff5b9b98ebae142850d51c25553bfa01df2920e72db14d72
Instruction Fuzzy Hash: 7831A370A80308BBEB18DFA0EC5AFE97774AB48701F1051A9F206BA2D1C6B85954CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 004051C0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 347COMMON

Download Yara Rule

Strings

CLSID\, xrefs: 004054B3, 004055B6
\Required Categories, xrefs: 004054E4
\Implemented Categories, xrefs: 004055E7

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID:
String ID: CLSID\$\Implemented Categories$\Required Categories
API String ID: 0-4092563799
Opcode ID: 47c0e5efdab88fb166c96fc0da7e60ca50408bf61d984a3405d278b0dd1c4c94
Instruction ID: d05613de815c8c9fcef9da57b0fa30ebf9ed883adbc59b3692bfac4d47e7c64b
Opcode Fuzzy Hash: 47c0e5efdab88fb166c96fc0da7e60ca50408bf61d984a3405d278b0dd1c4c94
Instruction Fuzzy Hash: F9E135B1910218DBDB14EB90DC85BEEB3B4FF48304F5041AAE5097B291DB786A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406280 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,{F1D4E2A2-4B35-11D5-89B1-0001028D1A2A},00020019,80000000,AppID,00020019), ref: 00406299
EnterCriticalSection.KERNEL32(0043AA5C,{F1D4E2A2-4B35-11D5-89B1-0001028D1A2A},00020019,80000000,AppID,00020019), ref: 004062AB
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040631E
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00406351
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00406363

Strings

CServiceModule::Start(), xrefs: 004062C5
-> Run(), xrefs: 0040637D
.\ServiceMinit.cpp, xrefs: 004062B1, 00406369

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$CtrlDispatcherServiceStart
String ID: -> Run()$.\ServiceMinit.cpp$CServiceModule::Start()
API String ID: 4248115315-1383743213
Opcode ID: 024b455f1f994762bdcd995c1845fffcb6c64a2bc5722940d97e34fc99d7312a
Instruction ID: 8baf0524c9543601889b67de502b5be109eea69db8c9e573c7028e2b4df59659
Opcode Fuzzy Hash: 024b455f1f994762bdcd995c1845fffcb6c64a2bc5722940d97e34fc99d7312a
Instruction Fuzzy Hash: E821C1B05402459BDB00EF50EA1D7AA7BB0AB04309F14613ED4866A390D3BD4568CF5F

Uniqueness

Uniqueness Score: -1.00%

Function 0040D11E Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00416D52
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00416D67
UnhandledExceptionFilter.KERNEL32(004337C8), ref: 00416D72
GetCurrentProcess.KERNEL32(C0000409), ref: 00416D8E
TerminateProcess.KERNEL32(00000000), ref: 00416D95

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 08a1dfdd4275f9915c8067dfe823d8cfbfdec6fe87cb1177a2a9f27b46c50d56
Instruction ID: 17231240e9b6221994866eec9e6af3adda2d0ad79e98070ac29d8f15beedd55a
Opcode Fuzzy Hash: 08a1dfdd4275f9915c8067dfe823d8cfbfdec6fe87cb1177a2a9f27b46c50d56
Instruction Fuzzy Hash: 7021AEB4900309DFD700DF29FD497843BA4FB68325F10603AEA4997362E7B559849F9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041EB7F Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 0041EB8D

Part of subcall function 004195E3: TlsGetValue.KERNEL32(00000000,00419685,?,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 004195F0
Part of subcall function 004195E3: TlsGetValue.KERNEL32(00000005,?,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 00419607

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041EB94

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Value$ExceptionFilterUnhandled__decode_pointer
String ID:
API String ID: 1958600898-0
Opcode ID: 4f8aed0f2678d74c2c7f0dcca23eb3cb20104a97da73602769ae9de64918b359
Instruction ID: 6e17e5454bd1d775a17410ee8bf225bbcc124bc5ec854c384e0beb1a3e7e08ce
Opcode Fuzzy Hash: 4f8aed0f2678d74c2c7f0dcca23eb3cb20104a97da73602769ae9de64918b359
Instruction Fuzzy Hash: 7DC08C214182C00BCB23533A581C30E7A00E705300F80F4AFD10080042CF6D49888EA9

Uniqueness

Uniqueness Score: -1.00%

Function 004029E0 Relevance: 77.4, APIs: 23, Strings: 21, Instructions: 383COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00402A13

Part of subcall function 00403040: _getenv.LIBCMT ref: 00403052

EnterCriticalSection.KERNEL32(0043AA5C), ref: 00402A25
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00402A83
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00402A95
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00402AE2
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00402AF4
_fgets.LIBCMT ref: 00402B46
_strcat.LIBCMT ref: 00402C5B
_strcat.LIBCMT ref: 00402D0A
_strcat.LIBCMT ref: 00402D2C
_sprintf.LIBCMT ref: 00402D4E
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00402DA4
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00402DB6
__strdup.LIBCMT ref: 00402DF0
_sprintf.LIBCMT ref: 00402E76
__strdup.LIBCMT ref: 00402E85
__strdup.LIBCMT ref: 00402E9A
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00402ED3
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00402EE5
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00402F23
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00402F35
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00402F73
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00402F85

Strings

respawn, xrefs: 00402E2B
Sysinit, xrefs: 00402FC9
size is 0, xrefs: 00402A3F
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00402A9B
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00402AFA
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00402F3B
program '%s' not found, xrefs: 00402DD7
args : %s, xrefs: 00402F56
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00402DBC
-- proc : %s, xrefs: 00402F06
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00402F8B
Wait, xrefs: 00402FA8
.exe, xrefs: 00402D6B
bin dir is %s, xrefs: 00402B15
mode : %s, xrefs: 00402FE6
cannot open config file '%s', xrefs: 00402AB3
Respawn, xrefs: 00402FBD
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00402EEB
wait, xrefs: 00402E07
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00402A2B
%s\%s, xrefs: 00402D42

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$__strdup_strcat$_sprintf$_fgets_getenv
String ID: args : %s$ mode : %s$%s\%s$-- proc : %s$.exe$Respawn$Sysinit$Wait$bin dir is %s$cannot open config file '%s'$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$program '%s' not found$respawn$size is 0$wait
API String ID: 1607728339-398193112
Opcode ID: f77105157aadd3c1f2da1770ce5e4b8d5b21a54bdc0af3199c0623db70cb3b1c
Instruction ID: ed9f73959f831837aead98d028f9c5c61fcb245bf071a8bc5ec3f3340030049c
Opcode Fuzzy Hash: f77105157aadd3c1f2da1770ce5e4b8d5b21a54bdc0af3199c0623db70cb3b1c
Instruction Fuzzy Hash: 7FF114B09002189BCB10DF10DD99BAE7770BF09308F1491EEE849663C1E7B99A94CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004251D9 Relevance: 48.3, APIs: 32, Instructions: 264COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004251E0
_strlen.LIBCMT ref: 004251ED
_strlen.LIBCMT ref: 004251FE
_strlen.LIBCMT ref: 0042520D
_strlen.LIBCMT ref: 0042521C
__malloc_crt.LIBCMT ref: 0042522C

Part of subcall function 0041A0A6: _malloc.LIBCMT ref: 0041A0AE
Part of subcall function 0041A0A6: Sleep.KERNEL32(00000000,00000001,004011BF,00418923,00000018,004370F0,0000000C,004189B2,004011BF,?,?,0041872F,00000004,004370D0,0000000C,0041A0F9), ref: 0041A0C3

_strcpy_s.LIBCMT ref: 00425278
__invoke_watson.LIBCMT ref: 004253A5
_strlen.LIBCMT ref: 004253AE
_strcpy_s.LIBCMT ref: 004253CC
__invoke_watson.LIBCMT ref: 004253DF
_strlen.LIBCMT ref: 004253E8
_strcpy_s.LIBCMT ref: 00425406
__invoke_watson.LIBCMT ref: 00425419
_strlen.LIBCMT ref: 00425422
_strcpy_s.LIBCMT ref: 00425440
__invoke_watson.LIBCMT ref: 00425453
_strlen.LIBCMT ref: 0042545C
_strcpy_s.LIBCMT ref: 0042547A
__invoke_watson.LIBCMT ref: 0042528B

Part of subcall function 00413E36: _memset.LIBCMT ref: 00413EC2
Part of subcall function 00413E36: IsDebuggerPresent.KERNEL32(?,?,0041A543), ref: 00413EE0
Part of subcall function 00413E36: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,0041A543), ref: 00413EEA
Part of subcall function 00413E36: UnhandledExceptionFilter.KERNEL32(?,?,?,0041A543), ref: 00413EF4
Part of subcall function 00413E36: GetCurrentProcess.KERNEL32(C000000D,?,?,0041A543), ref: 00413F0F
Part of subcall function 00413E36: TerminateProcess.KERNEL32(00000000,?,?,0041A543), ref: 00413F16

_strlen.LIBCMT ref: 00425294
_strcpy_s.LIBCMT ref: 004252B1
__invoke_watson.LIBCMT ref: 004252C4
_strlen.LIBCMT ref: 004252CD
_strcpy_s.LIBCMT ref: 00425311
__invoke_watson.LIBCMT ref: 00425324
_strlen.LIBCMT ref: 0042532D
_strcpy_s.LIBCMT ref: 0042534A
__invoke_watson.LIBCMT ref: 0042535D
_strlen.LIBCMT ref: 00425366
_strcpy_s.LIBCMT ref: 00425392
__invoke_watson.LIBCMT ref: 0042548D

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: _strlen$__invoke_watson_strcpy_s$ExceptionFilterProcessUnhandled$CurrentDebuggerPresentSleepTerminate__malloc_crt_malloc_memset
String ID:
API String ID: 18894028-0
Opcode ID: 5f048efc3419fd48bf6455cf2e1626eb8d92070bdea55dfe8ab72c58e300a6a6
Instruction ID: 36b241dfad4cd016cf57d5ee5660d20591c2b25f24d3fcbaa48460f4de13a215
Opcode Fuzzy Hash: 5f048efc3419fd48bf6455cf2e1626eb8d92070bdea55dfe8ab72c58e300a6a6
Instruction Fuzzy Hash: DF8186B2A10304BFDB11AF79CC45AFFB7B9EF40318F45047AEC04A6242E739E6558A65

Uniqueness

Uniqueness Score: -1.00%

Function 00403600 Relevance: 47.4, APIs: 17, Strings: 10, Instructions: 159threadwindowCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,F0AA0F6A), ref: 00403638
EnterCriticalSection.KERNEL32(0043AA5C,F0AA0F6A), ref: 0040364A
GetCurrentThreadId.KERNEL32 ref: 00403671
CoInitialize.OLE32(00000000), ref: 0040367E
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000004,00000003,00000000,00000000,00000000,00000000,00000001), ref: 004036BB
InitializeCriticalSection.KERNEL32(0043AA5C,00000014,00000001), ref: 004036E5
EnterCriticalSection.KERNEL32(0043AA5C,00000014,00000001), ref: 004036F7
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00403772
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00403784
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004037B5
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004037CF
EnterCriticalSection.KERNEL32(0043AA5C), ref: 004037E1
TerminateThread.KERNEL32(000000FF,00000000), ref: 0040381D
DispatchMessageA.USER32(?), ref: 00403827
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00403842
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00403854
CoUninitialize.OLE32 ref: 00403885

Strings

.\ServiceMinit.cpp, xrefs: 0040378A
.\ServiceMinit.cpp, xrefs: 0040385A
.\ServiceMinit.cpp, xrefs: 004036FD
Out GetMessage Loop, xrefs: 0040386E
Service Started, xrefs: 00403711
.\ServiceMinit.cpp, xrefs: 00403650
In GetMessage Loop, xrefs: 0040379E
GetMessage %d, xrefs: 004037FF
CServiceModule::Run(), xrefs: 00403664
.\ServiceMinit.cpp, xrefs: 004037E7

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$Initialize$Enter$MessageThread$CurrentDispatchSecurityTerminateUninitialize
String ID: .\ServiceMinit.cpp$.\ServiceMinit.cpp$.\ServiceMinit.cpp$.\ServiceMinit.cpp$.\ServiceMinit.cpp$CServiceModule::Run()$GetMessage %d$In GetMessage Loop$Out GetMessage Loop$Service Started
API String ID: 1874840155-863530001
Opcode ID: fee855d3e1ef8f5cf425c9b2efe2c7b5102a55e0bc15b69c71e68baf3b32bdd9
Instruction ID: df218e8acf96de7610b80a39e02800dad7a40748879ba20d782f668c111cad61
Opcode Fuzzy Hash: fee855d3e1ef8f5cf425c9b2efe2c7b5102a55e0bc15b69c71e68baf3b32bdd9
Instruction Fuzzy Hash: EA61E4B1680304ABDB10EFA0ED5EB9D3B70AB18705F20A27EF581766E0D7B80514DB1E

Uniqueness

Uniqueness Score: -1.00%

Function 004031D0 Relevance: 43.9, APIs: 8, Strings: 17, Instructions: 152COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,00402629,00000000), ref: 004031F6
EnterCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,00402629,00000000), ref: 00403208
_perror.LIBCMT ref: 004032B2
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004032CA
EnterCriticalSection.KERNEL32(0043AA5C), ref: 004032DC

Strings

EINVAL, xrefs: 00403313
ENOMEM, xrefs: 00403339
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 0040320E
WAIT, xrefs: 0040322B
RESPAWN, xrefs: 0040323D
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 004033EF
spawn(%s) %s %s, xrefs: 00403265
E2BIG, xrefs: 00403300
ENOENT, xrefs: 00403326
spawn, xrefs: 004032AD
SYSINIT, xrefs: 00403246
spawn success. pid is %d, xrefs: 00403407
spawn fail. errno = [%d:%s], xrefs: 00403367
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 004032E2
)&@, xrefs: 004033BD, 00403299, 004033B7, 004033A8, 00403399, 00403390, 004032A3, 004033B4, 0040337D
UNKNOWN, xrefs: 00403342
)&@, xrefs: 004031D6, 00403222, 00403234, 00403253, 0040325A, 00403274, 0040327B

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$_perror
String ID: )&@$)&@$E2BIG$EINVAL$ENOENT$ENOMEM$RESPAWN$SYSINIT$UNKNOWN$WAIT$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$spawn$spawn fail. errno = [%d:%s]$spawn success. pid is %d$spawn(%s) %s %s
API String ID: 1749629038-1513654956
Opcode ID: 0a5311026cf8a21273fc59127828c2d19745ec74736c4dbb3715ebffdb865e54
Instruction ID: d4d8cce7bdfb38d4e600edb14782059d750ac4b71f0814b96284d46dcb5b8dcd
Opcode Fuzzy Hash: 0a5311026cf8a21273fc59127828c2d19745ec74736c4dbb3715ebffdb865e54
Instruction Fuzzy Hash: EE61C2B0900205DFDB04EF91D855A6E7BB4BF08309F10E26EE8856B391C7799A45CF9E

Uniqueness

Uniqueness Score: -1.00%

Function 004199CF Relevance: 42.1, APIs: 19, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,0041384B), ref: 004199D5
__mtterm.LIBCMT ref: 004199E1

Part of subcall function 004196AD: __decode_pointer.LIBCMT ref: 004196BE
Part of subcall function 004196AD: TlsFree.KERNEL32(00000003,00419B4E), ref: 004196D8

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004199F7
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00419A04
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00419A11
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00419A1E
TlsAlloc.KERNEL32 ref: 00419A6E
TlsSetValue.KERNEL32(00000000), ref: 00419A89
__init_pointers.LIBCMT ref: 00419A93
__encode_pointer.LIBCMT ref: 00419A9E
__encode_pointer.LIBCMT ref: 00419AAE
__encode_pointer.LIBCMT ref: 00419ABE
__encode_pointer.LIBCMT ref: 00419ACE
__decode_pointer.LIBCMT ref: 00419AEF
__calloc_crt.LIBCMT ref: 00419B08
__decode_pointer.LIBCMT ref: 00419B22
__initptd.LIBCMT ref: 00419B31
GetCurrentThreadId.KERNEL32 ref: 00419B38

Strings

FlsSetValue, xrefs: 00419A06
FlsAlloc, xrefs: 004199F1
FlsGetValue, xrefs: 004199F9
KERNEL32.DLL, xrefs: 004199D0
FlsFree, xrefs: 00419A13

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: AddressProc__encode_pointer$__decode_pointer$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__initptd__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 2657569430-3819984048
Opcode ID: f507bffcd4d033f7d3c592514c7fc6faebbfd4e5748146557a680d1d709624ee
Instruction ID: ac640c6f97835535c44ac35d2d98889fdd24938cac5fdbc259ea592f4e104e6c
Opcode Fuzzy Hash: f507bffcd4d033f7d3c592514c7fc6faebbfd4e5748146557a680d1d709624ee
Instruction Fuzzy Hash: E131ADB19042019ACB1A7F75FC25B96BBE9FF04710B14253FE650932A1DB799980CBEC

Uniqueness

Uniqueness Score: -1.00%

Function 00401770 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 124COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0043AA5C,00000004,?,00404091), ref: 00401779
InitializeCriticalSection.KERNEL32(0043AA5C,?,00404091), ref: 0040178F
EnterCriticalSection.KERNEL32(0043AA5C,?,00404091), ref: 004017A1
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004017F9
EnterCriticalSection.KERNEL32(0043AA5C), ref: 0040180B
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 0040184F
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00401861
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004018A5
EnterCriticalSection.KERNEL32(0043AA5C), ref: 004018B7

Strings

-- proc : %s, xrefs: 00401832
kill_child_processes, xrefs: 004017BB
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 004017A7
pid : %d, xrefs: 00401888
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00401811
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 004018BD
kill %s, xrefs: 0040197C
done : %d, xrefs: 004018DE
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 0040195B
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00401867

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$Enter$Initialize
String ID: done : %d$ pid : %d$ -- proc : %s$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$kill %s$kill_child_processes
API String ID: 1229453151-3363547746
Opcode ID: 17ed9041b5f4fbdd92ee795e6efad9f07a8f3e164348c06fcf2265d071054515
Instruction ID: 7f43119c2876006f4be0bf0cc9f1285dc3da217b0bf70f1a8651917c78e99f26
Opcode Fuzzy Hash: 17ed9041b5f4fbdd92ee795e6efad9f07a8f3e164348c06fcf2265d071054515
Instruction Fuzzy Hash: 4651E472680204EBDB04EF50EA5DB297B71A764308F24B17EE4C56A2A1D3B84524EF5F

Uniqueness

Uniqueness Score: -1.00%

Function 00403F60 Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 96threadwindowCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,00401763,?), ref: 00403F79
EnterCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,00401763,?), ref: 00403F8B
InitializeCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,00401763,?), ref: 00403FC2
EnterCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,00401763,?), ref: 00403FD4
PostThreadMessageA.USER32(?,00000012,00000000,00000000), ref: 004040AB

Strings

SERVICE_CONTROL_SHUTDOWN, xrefs: 00404030
Bad service request, xrefs: 004040BB
Unknown, xrefs: 00404039
SERVICE_CONTROL_INTERROGATE, xrefs: 00404021
SERVICE_CONTROL_STOP, xrefs: 00403FF4, 00404003
.\ServiceMinit.cpp, xrefs: 00403F91, 00403FDA
code : [%d:%s], xrefs: 00404060
SERVICE_CONTROL_CONTINUE, xrefs: 00404012
CServiceModule::Handler(), xrefs: 00403FA5

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$MessagePostThread
String ID: code : [%d:%s]$.\ServiceMinit.cpp$Bad service request$CServiceModule::Handler()$SERVICE_CONTROL_CONTINUE$SERVICE_CONTROL_INTERROGATE$SERVICE_CONTROL_SHUTDOWN$SERVICE_CONTROL_STOP$Unknown
API String ID: 2620819968-2515691290
Opcode ID: f60a2e291c48767d9d345a270c19a9c0da25ddba17d9d0cb7e173b4b9f5e7edc
Instruction ID: d231be8befeefc182e9450ab593ad7065785ee4ace9b41cd0e1b140dd3a102d9
Opcode Fuzzy Hash: f60a2e291c48767d9d345a270c19a9c0da25ddba17d9d0cb7e173b4b9f5e7edc
Instruction Fuzzy Hash: DB41B2B0D40209EBCF10DF91D9496AE7BB0AB88305F20913BE64677390D3785A54DF9E

Uniqueness

Uniqueness Score: -1.00%

Function 0042909B Relevance: 24.1, APIs: 16, Instructions: 128COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 004290D2
DName::operator+.LIBCMT ref: 004290D9
DName::operator+.LIBCMT ref: 004290E0
UnDecorator::getBasicDataType.LIBCMT ref: 004290E9
DName::operator+=.LIBCMT ref: 00429113
UnDecorator::getDimension.LIBCMT ref: 00429125
operator+.LIBCMT ref: 00429131
DName::operator+.LIBCMT ref: 0042913B
DName::operator+=.LIBCMT ref: 00429144
operator+.LIBCMT ref: 00429173
DName::operator+.LIBCMT ref: 0042917D
DName::operator+.LIBCMT ref: 00429184
UnDecorator::getPrimaryDataType.LIBCMT ref: 0042919A
DName::DName.LIBCMT ref: 004291AF
operator+.LIBCMT ref: 004291E6
DName::operator+.LIBCMT ref: 004291F0

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Name::operator+$Decorator::getoperator+$DataNameName::Name::operator+=Type$BasicDimensionPrimary
String ID:
API String ID: 563633363-0
Opcode ID: f82391e6b20822cc3f47970b8fb022319fc102f83b43c58903be97b1af3c75f2
Instruction ID: 93c0ecda68de269ba6b4cc37ff80a11c66599e91427d7c6e137aaf4660e73ef0
Opcode Fuzzy Hash: f82391e6b20822cc3f47970b8fb022319fc102f83b43c58903be97b1af3c75f2
Instruction Fuzzy Hash: 834181B2B002296ADB11E6A1EC46FFF77AC9F54314F84452FF501A71C1EF38AA458768

Uniqueness

Uniqueness Score: -1.00%

Function 00402702 Relevance: 24.1, APIs: 8, Strings: 8, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 00403420: InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00403474
Part of subcall function 00403420: EnterCriticalSection.KERNEL32(0043AA5C), ref: 00403486

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004020DC
EnterCriticalSection.KERNEL32(0043AA5C), ref: 004020EE
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 0040213A
EnterCriticalSection.KERNEL32(0043AA5C), ref: 0040214C
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 0040219A
EnterCriticalSection.KERNEL32(0043AA5C), ref: 004021AC
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004027EC
EnterCriticalSection.KERNEL32(0043AA5C), ref: 004027FE

Strings

wait enter ..., xrefs: 00402108
wait exit. pid=%d, status=%d, xrefs: 00402174
sigterm_catched !!, xrefs: 004021C6
ServiceMinit is finish...., xrefs: 00402818
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00402152
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 004020F4
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00402804
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 004021B2

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize
String ID: ServiceMinit is finish....$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$sigterm_catched !!$wait enter ...$wait exit. pid=%d, status=%d
API String ID: 2028075725-2181195844
Opcode ID: 3b4aa31b0a76a69524425cae1e85fbeeae306587072873001aab546c5a7de216
Instruction ID: 68a1dc65692af026e0b4eb350238aa1b48cfb1931d21113e332e70c5887d82cd
Opcode Fuzzy Hash: 3b4aa31b0a76a69524425cae1e85fbeeae306587072873001aab546c5a7de216
Instruction Fuzzy Hash: 1931CEB61802419ACB11AB61AE1E7193AA06718308F14B17FF4C5A16E1E7BC4168EF1F

Uniqueness

Uniqueness Score: -1.00%

Function 00403DB0 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 88registryCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,0043AAB8,?,004016AE,?,?), ref: 00403DC7

Part of subcall function 004019D0: SetServiceStatus.ADVAPI32(00000000,?,?,?,00403EA7,00000002), ref: 004019F7

Part of subcall function 00403600: InitializeCriticalSection.KERNEL32(0043AA5C,F0AA0F6A), ref: 00403638
Part of subcall function 00403600: EnterCriticalSection.KERNEL32(0043AA5C,F0AA0F6A), ref: 0040364A
Part of subcall function 00403600: GetCurrentThreadId.KERNEL32 ref: 00403671
Part of subcall function 00403600: CoInitialize.OLE32(00000000), ref: 0040367E
Part of subcall function 00403600: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000004,00000003,00000000,00000000,00000000,00000000,00000001), ref: 004036BB
Part of subcall function 00403600: InitializeCriticalSection.KERNEL32(0043AA5C,00000014,00000001), ref: 004036E5
Part of subcall function 00403600: EnterCriticalSection.KERNEL32(0043AA5C,00000014,00000001), ref: 004036F7

EnterCriticalSection.KERNEL32(0043AA5C,0043AAB8,?,004016AE,?,?), ref: 00403DD9
RegisterServiceCtrlHandlerA.ADVAPI32(?,004016C0), ref: 00403E23
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00403E4E
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00403E60
InitializeCriticalSection.KERNEL32(0043AA5C,00000001,?,?,?,00000002), ref: 00403F01
EnterCriticalSection.KERNEL32(0043AA5C,00000001,?,?,?,00000002), ref: 00403F13

Strings

Handler not installed(), xrefs: 00403E7A
CServiceModule::ServiceMain(), xrefs: 00403DF3
Handler not installed, xrefs: 00403E87
Service stopped, xrefs: 00403F3A
Service Stopped, xrefs: 00403F2D
.\ServiceMinit.cpp, xrefs: 00403DDF, 00403E66, 00403F19

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$Initialize$Enter$Service$CtrlCurrentHandlerRegisterSecurityStatusThread
String ID: Handler not installed()$.\ServiceMinit.cpp$CServiceModule::ServiceMain()$Handler not installed$Service Stopped$Service stopped
API String ID: 3816499838-4266900008
Opcode ID: 16bf35986f9ccad765f86e71c8f826731e256d289e3bab67b48f0dcb01127e95
Instruction ID: 73783b8433408c8050249ab72eea3a712e9641fa975675cf6ef83068319a06dd
Opcode Fuzzy Hash: 16bf35986f9ccad765f86e71c8f826731e256d289e3bab67b48f0dcb01127e95
Instruction Fuzzy Hash: 88411370680204EBCB00EF51ED9AB8D7BB0AB18308F24617EF485263E1D7B94A14DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004049C0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00404A11
GetLastError.KERNEL32 ref: 00404A17
_malloc.LIBCMT ref: 00404A2A
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00404A4D
_HRESULT_FROM_WIN32.LIBCMTD ref: 00404A98

Part of subcall function 0040FDCF: __lock.LIBCMT ref: 0040FDED
Part of subcall function 0040FDCF: ___sbh_find_block.LIBCMT ref: 0040FDF8
Part of subcall function 0040FDCF: ___sbh_free_block.LIBCMT ref: 0040FE07
Part of subcall function 0040FDCF: HeapFree.KERNEL32(00000000,004011BF,00436E30,Function_0000FDCF,0041897A,00000000,004370F0,0000000C,004189B2,004011BF,?,?,0041872F,00000004,004370D0,0000000C), ref: 0040FE37
Part of subcall function 0040FDCF: GetLastError.KERNEL32(?,0041872F,00000004,004370D0,0000000C,0041A0F9,?,?,00000000,00000000,00000000,004197D3,00000001,00000214), ref: 0040FE48

GetTokenInformation.ADVAPI32(00000000,00000005(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00404ACC
GetLastError.KERNEL32 ref: 00404AD2
_malloc.LIBCMT ref: 00404AE5
GetTokenInformation.ADVAPI32(00000000,00000005(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00404B08

Part of subcall function 00404640: GetLastError.KERNEL32(?,00404604,?,?,?,?,?,?,?,00000000,0042EF70,000000FF), ref: 00404646

Strings

z, xrefs: 00404A20
z, xrefs: 00404ADB

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: ErrorInformationLastToken$_malloc$FreeHeap___sbh_find_block___sbh_free_block__lock
String ID: z$z
API String ID: 1750464754-3877588240
Opcode ID: f8cf6caf0596041c85158808649e5a9a83e0b6d36ecbe899a08f8f3d8715a670
Instruction ID: 671c4058592234a14e0305f99bab17154abcbf6ab2c62eeb642ea106794aaf92
Opcode Fuzzy Hash: f8cf6caf0596041c85158808649e5a9a83e0b6d36ecbe899a08f8f3d8715a670
Instruction Fuzzy Hash: 26511DF5D00209EFDB14DFA4D845BAEB7B4AF84304F10857AEA056B2C0D779AA44CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004028D0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_getenv.LIBCMT ref: 004028F5
_getenv.LIBCMT ref: 00402923
_sprintf.LIBCMT ref: 0040294D
__strdup.LIBCMT ref: 0040295C
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00402985
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00402997

Strings

HG_ETC_DIR, xrefs: 004028F0
%s\etc, xrefs: 00402941
etc dir is %s, xrefs: 004029B8
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 0040299D
HG_TOP_DIR, xrefs: 0040291E

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection_getenv$EnterInitialize__strdup_sprintf
String ID: %s\etc$HG_ETC_DIR$HG_TOP_DIR$e:\scada_win\app\serviceminit\minit.cxx$etc dir is %s
API String ID: 176128563-2965304638
Opcode ID: 6e354f5eae1ececb364fc2300ad5d31bebfa709c00886d2f7740436b443f06f7
Instruction ID: a0ebdeba76d7a7274be06188f584f64d63e9db972d5ecc1f552ffe66a95d3fb4
Opcode Fuzzy Hash: 6e354f5eae1ececb364fc2300ad5d31bebfa709c00886d2f7740436b443f06f7
Instruction Fuzzy Hash: 242180F0A003049FC714EF61AD8E75A3370E758304F6061BAE85D662D1E7B85998CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00404E50 Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,F0AA0F6A,?,00000000,0042EFA0,000000FF,?,00403A9C,00000001,00000001), ref: 00404E88

Part of subcall function 00406140: InitializeCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,?,?,?,?,00405AE4), ref: 00406159
Part of subcall function 00406140: EnterCriticalSection.KERNEL32(0043AA5C,?,?,?,?,?,?,?,?,?,?,00405AE4), ref: 0040616B

Part of subcall function 00404C80: RegOpenKeyExA.KERNELBASE(?,80000000,00000000,00000000,00000000,80000000,AppID), ref: 00404CA2

EnterCriticalSection.KERNEL32(0043AA5C,F0AA0F6A,?,00000000,0042EFA0,000000FF,?,00403A9C,00000001,00000001), ref: 00404E9A
CoInitialize.OLE32(00000000), ref: 00404EC3

Strings

ServiceMinit, xrefs: 00404FB7
AppID, xrefs: 00404F0A
LocalService, xrefs: 00404F9B, 00404FB2
{F1D4E2A2-4B35-11D5-89B1-0001028D1A2A}, xrefs: 00404F53
CServiceModule::RegisterServer(), xrefs: 00404EB4
.\ServiceMinit.cpp, xrefs: 00404EA0
-Service, xrefs: 00404FCD
ServiceParameters, xrefs: 00404FC8

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$Initialize$Enter$Open
String ID: -Service$.\ServiceMinit.cpp$AppID$CServiceModule::RegisterServer()$LocalService$ServiceMinit$ServiceParameters${F1D4E2A2-4B35-11D5-89B1-0001028D1A2A}
API String ID: 1527650992-399234584
Opcode ID: cde3df9ca176edff90e8b2111acaadd64d832174564070c2289376f018b47a64
Instruction ID: 2cf2bd8d49d24acf26be2acd995b8cedb1a7a1f0966c4c70bf3400f13da8a339
Opcode Fuzzy Hash: cde3df9ca176edff90e8b2111acaadd64d832174564070c2289376f018b47a64
Instruction Fuzzy Hash: 77519E70944209DBDB04EFA5DC56BEEB770AB48314F20812EF511772E1DB786A44CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004017D1 Relevance: 18.1, APIs: 6, Strings: 6, Instructions: 58COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004017F9
EnterCriticalSection.KERNEL32(0043AA5C), ref: 0040180B
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 0040184F
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00401861
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004018A5
EnterCriticalSection.KERNEL32(0043AA5C), ref: 004018B7
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00401943
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00401955
TerminateProcess.KERNEL32(00000000,0000000F), ref: 00401998
LeaveCriticalSection.KERNEL32(0043AA5C), ref: 004019B8

Strings

-- proc : %s, xrefs: 00401832
pid : %d, xrefs: 00401888
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00401811
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 004018BD
done : %d, xrefs: 004018DE
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 00401867

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$LeaveProcessTerminate
String ID: done : %d$ pid : %d$ -- proc : %s$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx$e:\scada_win\app\serviceminit\minit.cxx
API String ID: 1984918317-4009743649
Opcode ID: ea8a8c48e6bff28e711c113b430dd649b364c9a016c4db36b059ce8049a1de83
Instruction ID: becae717d698fff35acd52f7cfc5301566d51aa71ece6a56d23c7c002473a228
Opcode Fuzzy Hash: ea8a8c48e6bff28e711c113b430dd649b364c9a016c4db36b059ce8049a1de83
Instruction Fuzzy Hash: AF21D672280200EBD704EF50EE6DA2D3B71A768308F24B17EE4C5666A1D3B90524EF5F

Uniqueness

Uniqueness Score: -1.00%

Function 00407540 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 338COMMON

Download Yara Rule

APIs

Concurrency::details::stl_critical_section_concrt::stl_critical_section_concrt.LIBCPMTD ref: 00407559

Strings

z, xrefs: 00407690
Module, xrefs: 0040789E, 004078BE
", xrefs: 0040787D
Module_Raw, xrefs: 00407912

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Concurrency::details::stl_critical_section_concrt::stl_critical_section_concrt
String ID: "$Module$Module_Raw$z
API String ID: 2239783310-2838227397
Opcode ID: 7208b57a5fb0d507581d204c6dc63b6cc1895e4589eeba6d0a524a9c13047722
Instruction ID: f19a1c6c07654fe3355daefcd57cbf2250b9d8eb44eaba27c7be9adb7dd8b9b3
Opcode Fuzzy Hash: 7208b57a5fb0d507581d204c6dc63b6cc1895e4589eeba6d0a524a9c13047722
Instruction Fuzzy Hash: F6F1F771D052289BDB24EF55DC45BEEB3B4AF48304F0041EAE50977282DB386E95CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0D0 Relevance: 15.4, APIs: 10, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd2310aa2900d16a0b922388052ccfa1e63fdb8627d5783e795ecd917c68af2
Instruction ID: 3c21e8295e12f8ca6467edcc1831c545d28d3913ab09008484d740b2ac913533
Opcode Fuzzy Hash: bbd2310aa2900d16a0b922388052ccfa1e63fdb8627d5783e795ecd917c68af2
Instruction Fuzzy Hash: EF023A74D01268CBCB28DF65CC94AEEB7B4AF48304F1041EAE619B7281D7385E95CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0B2 Relevance: 15.1, APIs: 10, Instructions: 91COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0041C0C8

Part of subcall function 0041A0E6: __calloc_impl.LIBCMT ref: 0041A0F4
Part of subcall function 0041A0E6: Sleep.KERNEL32(00000000,?,004011BF,CServiceModule::IsInstalled()), ref: 0041A10B

__calloc_crt.LIBCMT ref: 0041C0EB
__calloc_crt.LIBCMT ref: 0041C107
__copytlocinfo_nolock.LIBCMT ref: 0041C12C
__setlocale_nolock.LIBCMT ref: 0041C13B
___removelocaleref.LIBCMT ref: 0041C147
___freetlocinfo.LIBCMT ref: 0041C14E
__setmbcp_nolock.LIBCMT ref: 0041C166
___removelocaleref.LIBCMT ref: 0041C17B
___freetlocinfo.LIBCMT ref: 0041C182

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: __calloc_crt$___freetlocinfo___removelocaleref$Sleep__calloc_impl__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2969281212-0
Opcode ID: 98c141443e9100d4e122e93454bdba12d8dc67b702d4c75a0fac81fdc3cc4ae3
Instruction ID: 3b0b3aaa604d0e947d74211c93b600cc0e969492ce3a1846128c9d8ea9a841cf
Opcode Fuzzy Hash: 98c141443e9100d4e122e93454bdba12d8dc67b702d4c75a0fac81fdc3cc4ae3
Instruction Fuzzy Hash: B621BA35284201EBD7327F66DC4299B7BD1DF84754F20843FF48192296EB3D8C90969D

Uniqueness

Uniqueness Score: -1.00%

Function 00401540 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00401563
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00401575
RegisterEventSourceA.ADVAPI32(00000000,?), ref: 004015EA
ReportEventA.ADVAPI32(00000000,00000004,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00401612
DeregisterEventSource.ADVAPI32(00000000), ref: 0040161C
_puts.LIBCMT ref: 0040162B

Strings

CServiceModule::LogEvent(), xrefs: 0040158F
.\ServiceMinit.cpp, xrefs: 0040157B

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Event$CriticalSectionSource$DeregisterEnterInitializeRegisterReport_puts
String ID: .\ServiceMinit.cpp$CServiceModule::LogEvent()
API String ID: 2785557927-1947590341
Opcode ID: fd23d8b69f4f364c39052b87b6fff3726e73f8f7e7d59f102071f89ea58096d5
Instruction ID: 1cdedd3075cf69a26fb8dd841e19523c7fdd883a225bcf63bdd23dc22dabe111
Opcode Fuzzy Hash: fd23d8b69f4f364c39052b87b6fff3726e73f8f7e7d59f102071f89ea58096d5
Instruction Fuzzy Hash: CE21C4B0940308EBDB14DF50DC5ABDD77B4AB58304F0055A9F6456B2D0DBB85A88CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 004016C0 Relevance: 12.0, APIs: 4, Strings: 4, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004016D3
EnterCriticalSection.KERNEL32(0043AA5C), ref: 004016E5
InitializeCriticalSection.KERNEL32(0043AA5C), ref: 0040171C
EnterCriticalSection.KERNEL32(0043AA5C), ref: 0040172E

Strings

.\ServiceMinit.cpp, xrefs: 00401734
CServiceModule::_Handler(), xrefs: 00401748
============================================, xrefs: 004016FF
.\ServiceMinit.cpp, xrefs: 004016EB

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize
String ID: .\ServiceMinit.cpp$.\ServiceMinit.cpp$============================================$CServiceModule::_Handler()
API String ID: 2028075725-2526023961
Opcode ID: b47dde72aece9cc95905bffb37a5fdf8300d2c2f40e29f215cde4e763aed717c
Instruction ID: bb4fb74c83d33171bc7bd2c38cfa0f3f7eee1bb89733e43d571d5f318248cd59
Opcode Fuzzy Hash: b47dde72aece9cc95905bffb37a5fdf8300d2c2f40e29f215cde4e763aed717c
Instruction Fuzzy Hash: 79018FB21802819ACB05BB91BE5A6193A70571C708F14B03BF4C561AA1D7B90068DB2F

Uniqueness

Uniqueness Score: -1.00%

Function 004034C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,0000EA60), ref: 0040355E
__cwait.LIBCMT ref: 00403599
__cwait.LIBCMT ref: 004035D1

Part of subcall function 0040F6E4: WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,004035D6,00000000,?,00000000), ref: 0040F6F9
Part of subcall function 0040F6E4: GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 0040F708
Part of subcall function 0040F6E4: CloseHandle.KERNEL32(00000000,?,?,?,004035D6,00000000,?,00000000), ref: 0040F74B

_perror.LIBCMT ref: 004035E0

Strings

wait for multiple object, xrefs: 004035DB
6(@, xrefs: 004034D0

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Wait__cwait$CloseCodeExitHandleMultipleObjectObjectsProcessSingle_perror
String ID: 6(@$wait for multiple object
API String ID: 1421345423-2511187733
Opcode ID: 5a4e3ed5b7f53a2e2a31e10908ce36fa9bac27cd0d0d153ae4605f00636dffc2
Instruction ID: c0056e94f39cbfebdf3f9ec2a1bd320a36bb117e7a0af5d454562b44d9c35dc8
Opcode Fuzzy Hash: 5a4e3ed5b7f53a2e2a31e10908ce36fa9bac27cd0d0d153ae4605f00636dffc2
Instruction Fuzzy Hash: 84419C74E00108EFDB18CF84D984BADBBB9FB54305F2085AAD4166B3D0C779AB45CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8BD Relevance: 10.6, APIs: 7, Instructions: 73threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0040F8F0
__calloc_crt.LIBCMT ref: 0040F8FC
__initptd.LIBCMT ref: 0040F912
CreateThread.KERNEL32(00000000,?,0040F849,00000000,00000004,00000000), ref: 0040F92F
ResumeThread.KERNEL32(00000000,?,?,?,?,?,00403742,00401A10,00000000,00000000), ref: 0040F93F
GetLastError.KERNEL32(?,?,?,?,?,00403742,00401A10,00000000,00000000), ref: 0040F94A
__dosmaperr.LIBCMT ref: 0040F962

Part of subcall function 0040DFE0: __getptd_noexit.LIBCMT ref: 0040DFE0

Part of subcall function 00413F6A: __decode_pointer.LIBCMT ref: 00413F73

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd_noexit__initptd
String ID:
API String ID: 2530220690-0
Opcode ID: 04d9b10834cc21ff653f5b9c9131b61931d2e2934bc2b665f1b7fafca47865bf
Instruction ID: 912f782110616dafb4f0ec0ab6a366e0d19dcce8f28352a1fb84b5b9e940f87d
Opcode Fuzzy Hash: 04d9b10834cc21ff653f5b9c9131b61931d2e2934bc2b665f1b7fafca47865bf
Instruction Fuzzy Hash: 3A11E2B2901200BEDB207F7A9C46A9EBBA4EF05338B20423FF111B26D1DB7959449669

Uniqueness

Uniqueness Score: -1.00%

Function 004038B0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C,?,00403817), ref: 004038C6
EnterCriticalSection.KERNEL32(0043AA5C,?,00403817), ref: 004038D8
TerminateProcess.KERNEL32(00000000,0000000F), ref: 0040393A
_memset.LIBCMT ref: 00403953

Strings

kill_all_processes, xrefs: 004038F2
.\ServiceMinit.cpp, xrefs: 004038DE

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitializeProcessTerminate_memset
String ID: .\ServiceMinit.cpp$kill_all_processes
API String ID: 343617928-1570544933
Opcode ID: 3a19bba7baca3ec7dd61654cd413ddb857ed5960f587b634b56d702ca8789433
Instruction ID: 8becaf280632a0a3ff17b634fb9dbf19b54c3515a9ce666be4329a532c2dbf35
Opcode Fuzzy Hash: 3a19bba7baca3ec7dd61654cd413ddb857ed5960f587b634b56d702ca8789433
Instruction Fuzzy Hash: ED110A75640204EBD704EF50EE5A71D7BB5A724305F10607AE485BA2D1D3B85724DB0F

Uniqueness

Uniqueness Score: -1.00%

Function 0041D00D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

___TypeMatch.LIBCMT ref: 0041D0B3
___BuildCatchObject.LIBCMT ref: 0041D0E6

Strings

csm, xrefs: 0041D0F0
MOC, xrefs: 0041D024
csm, xrefs: 0041D038

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: BuildCatchMatchObjectType
String ID: MOC$csm$csm
API String ID: 2881012654-2232927589
Opcode ID: ab760937f1b20fd77a9924a1092fbf6872aab60ecf5ced168a1070578684eec1
Instruction ID: c1a56251bc77bbebe907f07d737615ca47c6c74997cc5e21ea6beea210543ee6
Opcode Fuzzy Hash: ab760937f1b20fd77a9924a1092fbf6872aab60ecf5ced168a1070578684eec1
Instruction Fuzzy Hash: 97317EB5C00200AFDB309E69C8847EA77B9BF19319FA8485BD44587311D738E9C6CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00418DC0 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,?,00437158,0000000C), ref: 00418DF3
GetLastError.KERNEL32(?,?,00437158,0000000C), ref: 00418DFD
__dosmaperr.LIBCMT ref: 00418E04
__alloc_osfhnd.LIBCMT ref: 00418E25
__set_osfhnd.LIBCMT ref: 00418E4F

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: ErrorFileLastType__alloc_osfhnd__dosmaperr__set_osfhnd
String ID:
API String ID: 43408053-0
Opcode ID: 7e24268851eb4119000948362b2353c0f6dc2b79362ee1b0ce904de55f2e14dc
Instruction ID: 4f3a6c1fe7ba61fe2d2ef8c73c2369b0029cc77993f59b43a3ebd5f932ec529f
Opcode Fuzzy Hash: 7e24268851eb4119000948362b2353c0f6dc2b79362ee1b0ce904de55f2e14dc
Instruction Fuzzy Hash: 3221F4316013059ACB119F69C8013DA7B60AF45328F28875FE4648B2D2CF7D85C1DF8C

Uniqueness

Uniqueness Score: -1.00%

Function 0040FDCF Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040FDED

Part of subcall function 00418999: __mtinitlocknum.LIBCMT ref: 004189AD
Part of subcall function 00418999: __amsg_exit.LIBCMT ref: 004189B9
Part of subcall function 00418999: EnterCriticalSection.KERNEL32(?,?,?,0041872F,00000004,004370D0,0000000C,0041A0F9,?,?,00000000,00000000,00000000,004197D3,00000001,00000214), ref: 004189C1

___sbh_find_block.LIBCMT ref: 0040FDF8
___sbh_free_block.LIBCMT ref: 0040FE07
HeapFree.KERNEL32(00000000,004011BF,00436E30,Function_0000FDCF,0041897A,00000000,004370F0,0000000C,004189B2,004011BF,?,?,0041872F,00000004,004370D0,0000000C), ref: 0040FE37
GetLastError.KERNEL32(?,0041872F,00000004,004370D0,0000000C,0041A0F9,?,?,00000000,00000000,00000000,004197D3,00000001,00000214), ref: 0040FE48

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 99583a4b5d0315750c4309ed014c9255a41a5303f428dafd6e1f724967448937
Instruction ID: 041529d8c119479831ecfd19b10828b34848f6675595699d38cac91702d059a2
Opcode Fuzzy Hash: 99583a4b5d0315750c4309ed014c9255a41a5303f428dafd6e1f724967448937
Instruction Fuzzy Hash: 510171B1800306AADB346BA2D80679F37609B00B15F20513FF104765E2DB7C85848ADC

Uniqueness

Uniqueness Score: -1.00%

Function 00403040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

_getenv.LIBCMT ref: 00403052
_strncpy.LIBCMT ref: 0040307B
_strlen.LIBCMT ref: 004030B9

Strings

HG_TOP_DIR, xrefs: 0040304D

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: _getenv_strlen_strncpy
String ID: HG_TOP_DIR
API String ID: 3888170341-162980908
Opcode ID: 2fdf4c3e2f7890a8be98569dda38f4240f0105811f4f09c56aa9c175077dce96
Instruction ID: 48ab8f9f46f77439d62e6bd6fd47067b6f6f575b3cb9a11fb51264529897c3a8
Opcode Fuzzy Hash: 2fdf4c3e2f7890a8be98569dda38f4240f0105811f4f09c56aa9c175077dce96
Instruction Fuzzy Hash: 6C317370E04248AFCB14CF98C89176EBFB1EF45305F2480AAD4117B786D3796B80DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00415CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 00415D65

Part of subcall function 004195E3: TlsGetValue.KERNEL32(00000000,00419685,?,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 004195F0
Part of subcall function 004195E3: TlsGetValue.KERNEL32(00000005,?,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 00419607

__decode_pointer.LIBCMT ref: 00415D90

Part of subcall function 004195E3: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 0041961C
Part of subcall function 004195E3: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0041962C

__decode_pointer.LIBCMT ref: 00415DB1

Strings

g, xrefs: 00415D9A

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: __decode_pointer$Value$AddressHandleModuleProc
String ID: g
API String ID: 3610270016-30677878
Opcode ID: 6041c4c03c4e93a370b25ee82bf9898ed6733f78a047f851f8b1351f9c42f8d6
Instruction ID: 64d54c9cdd5d8fd46253627c80f15ba6a1dfed7a9986ef793257ab8ab88765c1
Opcode Fuzzy Hash: 6041c4c03c4e93a370b25ee82bf9898ed6733f78a047f851f8b1351f9c42f8d6
Instruction Fuzzy Hash: E811EC72404949EFDF26DFA4ED44AED3BA6FB44310F20811AFC6486172D73ADE949B18

Uniqueness

Uniqueness Score: -1.00%

Function 00415D2B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 00415D65

Part of subcall function 004195E3: TlsGetValue.KERNEL32(00000000,00419685,?,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 004195F0
Part of subcall function 004195E3: TlsGetValue.KERNEL32(00000005,?,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 00419607

__decode_pointer.LIBCMT ref: 00415D90

Part of subcall function 004195E3: GetModuleHandleA.KERNEL32(KERNEL32.DLL,?,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 0041961C
Part of subcall function 004195E3: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 0041962C

__decode_pointer.LIBCMT ref: 00415DB1

Strings

g, xrefs: 00415D9A

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: __decode_pointer$Value$AddressHandleModuleProc
String ID: g
API String ID: 3610270016-30677878
Opcode ID: e38f14334b3b969e50ca3985b2d36a7bf1667041895529fd966efb8e1093d8b2
Instruction ID: 6d170daca5a07f2a57e5ec81311a26cae8bacdc48f5bc57a06a231949b2e27cb
Opcode Fuzzy Hash: e38f14334b3b969e50ca3985b2d36a7bf1667041895529fd966efb8e1093d8b2
Instruction Fuzzy Hash: A4111C72404548EFEF26DFA4DD44AED3BA6FB44310F20411AFC1486162D73ADE94DB48

Uniqueness

Uniqueness Score: -1.00%

Function 00401500 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_getenv.LIBCMT ref: 00401509
_sprintf.LIBCMT ref: 0040152F

Strings

%s\tmp, xrefs: 00401525
HG_TOP_DIR, xrefs: 00401504

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: _getenv_sprintf
String ID: %s\tmp$HG_TOP_DIR
API String ID: 2399524111-1812927091
Opcode ID: 0debb074570f87c8bd31008ebd84152334898afead533a3172abd8f28a42d7a5
Instruction ID: 3d56d919e3a971802c41bbafce8d72b1b5a6966fe1f1e369a8f770737cc79ce7
Opcode Fuzzy Hash: 0debb074570f87c8bd31008ebd84152334898afead533a3172abd8f28a42d7a5
Instruction Fuzzy Hash: 50E08661E40208B7C70096945C0261D7214D759304F607277F9056B2C0E17D9F14575F

Uniqueness

Uniqueness Score: -1.00%

Function 00408CB0 Relevance: 6.4, APIs: 5, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 00408C10: CharNextA.USER32(?,?,00408A4F,?,00408CC1,00408A4F,?,00000000,00000000,?,004086C0), ref: 00408C31

CharNextA.USER32(?,00408A4F,?,00000000,00000000,?,004086C0), ref: 00408CFC
CharNextA.USER32(00000000,?,00408A4F,?,00000000,00000000), ref: 00408D3A
CharNextA.USER32(00408A4F,?,00408A4F,?,00000000,00000000,?,004086C0), ref: 00408D53

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: b60d6d9e2a5f99060c83255c1f033a2b1ad7bb04c622636a24d8f49a85aa97d7
Instruction ID: 9557b391400eb6962f2cc6271cb15414c5a8e18cca31089792725f627d0c63ec
Opcode Fuzzy Hash: b60d6d9e2a5f99060c83255c1f033a2b1ad7bb04c622636a24d8f49a85aa97d7
Instruction Fuzzy Hash: 4671FF74A05219DFCF04DFA4C9909AEBBB2BF89304F20816DD855BB395CB38A941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004239C6 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004239F6
__isleadbyte_l.LIBCMT ref: 00423A2A
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,A045FF98,?,00000000,?,?,?,00419096,?,?,00000002), ref: 00423A5B
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,?,00000000,?,?,?,00419096,?,?,00000002), ref: 00423AC9

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2e7d1b157371ff90d0e1bd9d39d5f1dda7986cda160315ac29e96f7c701d5574
Instruction ID: f83c0012dd0e5109aefc9328cc6263703439a26e42a585a7cb0794a334e92ccc
Opcode Fuzzy Hash: 2e7d1b157371ff90d0e1bd9d39d5f1dda7986cda160315ac29e96f7c701d5574
Instruction Fuzzy Hash: 8231C331700266EFDB20CF64E8859AB3BB4AF01312B54857BE4919B291D379DE80CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00404740 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14f0954eb2d9cf804cf8b8b49e0d795571581d1a0f76fb1385838aaf2400320
Instruction ID: 163ebede55f0f19666e9a4c0fc65819d1782817f96851cfbafff2c0c7882e284
Opcode Fuzzy Hash: e14f0954eb2d9cf804cf8b8b49e0d795571581d1a0f76fb1385838aaf2400320
Instruction Fuzzy Hash: E62130B8600248EFCB10DF64D884B5E77B5AB85314F20817AF9099F380D73DDA80DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD00 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00419821: __getptd_noexit.LIBCMT ref: 00419822
Part of subcall function 00419821: __amsg_exit.LIBCMT ref: 0041982F

__amsg_exit.LIBCMT ref: 0041AD2C
__lock.LIBCMT ref: 0041AD3C
InterlockedDecrement.KERNEL32(?), ref: 0041AD59
InterlockedIncrement.KERNEL32(006013F8), ref: 0041AD84

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd_noexit__lock
String ID:
API String ID: 2880340415-0
Opcode ID: 70e6f35d70f2c02dc6a5fd5238be7b649bef5c3837bab0c9be67092c2ede24c1
Instruction ID: e665a8067840ecceeed5e6fb91df35e506f400d98cd64ab42c247441dde30e50
Opcode Fuzzy Hash: 70e6f35d70f2c02dc6a5fd5238be7b649bef5c3837bab0c9be67092c2ede24c1
Instruction Fuzzy Hash: 4C01E172D02A119BC720AB65A4067CA7761AF0072AF14502BE800636D0C7BC5DD1CFDF

Uniqueness

Uniqueness Score: -1.00%

Function 0040FF75 Relevance: 6.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 0040FF7D

Part of subcall function 0041A5A1: __NMSG_WRITE.LIBCMT ref: 0041A5C8
Part of subcall function 0041A5A1: __NMSG_WRITE.LIBCMT ref: 0041A5D2

__NMSG_WRITE.LIBCMT ref: 0040FF84

Part of subcall function 0041A3E1: _strcpy_s.LIBCMT ref: 0041A44D
Part of subcall function 0041A3E1: __invoke_watson.LIBCMT ref: 0041A45E
Part of subcall function 0041A3E1: GetModuleFileNameA.KERNEL32(00000000,0043B8F9,00000104,?,004011BF,CServiceModule::IsInstalled()), ref: 0041A47A
Part of subcall function 0041A3E1: _strcpy_s.LIBCMT ref: 0041A48F
Part of subcall function 0041A3E1: __invoke_watson.LIBCMT ref: 0041A4A2
Part of subcall function 0041A3E1: _strlen.LIBCMT ref: 0041A4AB
Part of subcall function 0041A3E1: _strlen.LIBCMT ref: 0041A4B8
Part of subcall function 0041A3E1: __invoke_watson.LIBCMT ref: 0041A4E5

Part of subcall function 0040E84F: ___crtCorExitProcess.LIBCMT ref: 0040E853
Part of subcall function 0040E84F: ExitProcess.KERNEL32 ref: 0040E85D

HeapAlloc.KERNEL32(00000000,?), ref: 0040FFB1
HeapAlloc.KERNEL32(00000000,?), ref: 0040FFE1

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: __invoke_watson$AllocExitHeapProcess_strcpy_s_strlen$FileModuleName___crt
String ID:
API String ID: 2259262434-0
Opcode ID: 761ea5e8b47d6fcd93f54cd72b2c77e59199a80f92e11be54c5c251163232364
Instruction ID: 14e8e55b641a901c0fef0c7409b9c747e7e1561dbc6498e044053ab2f0771555
Opcode Fuzzy Hash: 761ea5e8b47d6fcd93f54cd72b2c77e59199a80f92e11be54c5c251163232364
Instruction Fuzzy Hash: ACF0CD3260A2222ADE316725AC41B9B3648EB12320F24603BF900F62E1DB789C4482CD

Uniqueness

Uniqueness Score: -1.00%

Function 00403420 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00403474
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00403486

Strings

get_num_child. count=%d, xrefs: 004034A4
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 0040348C

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize
String ID: e:\scada_win\app\serviceminit\minit.cxx$get_num_child. count=%d
API String ID: 2028075725-2975629567
Opcode ID: a956a4226a8c687a5c7d40438d30584310b704d55eedfa0474a12d76ed91d528
Instruction ID: 560f05025681c3f6b1e0e844718a48e12af49ef0668edb0a484ebfb3870c91e9
Opcode Fuzzy Hash: a956a4226a8c687a5c7d40438d30584310b704d55eedfa0474a12d76ed91d528
Instruction Fuzzy Hash: 8201D271940108EFDB00DF94D99975CBFB0BB04309F20A1AAD4806B780C3780A68DF0F

Uniqueness

Uniqueness Score: -1.00%

Function 0040F83D Relevance: 6.0, APIs: 4, Instructions: 38threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040EBB4: _doexit.LIBCMT ref: 0040EBBC

___set_flsgetvalue.LIBCMT ref: 0040F849

Part of subcall function 0041966A: TlsGetValue.KERNEL32(004197AD,?,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 00419670
Part of subcall function 0041966A: __decode_pointer.LIBCMT ref: 00419680
Part of subcall function 0041966A: TlsSetValue.KERNEL32(00000000,?,0040123C,?,004011BF,CServiceModule::IsInstalled()), ref: 0041968D

Part of subcall function 0041964F: TlsGetValue.KERNEL32(?,0040F859,00000000,?), ref: 00419659

__freefls@4.LIBCMT ref: 0040F894

Part of subcall function 00419694: __decode_pointer.LIBCMT ref: 004196A2

GetLastError.KERNEL32(00000000,?,00000000,?), ref: 0040F870
ExitThread.KERNEL32 ref: 0040F877

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: Value$__decode_pointer$ErrorExitLastThread___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 297350007-0
Opcode ID: a7f4e0e417c571a1ff23461d911e23802ba1fdb64609b92f6f302fcc39841b15
Instruction ID: c6a5fbc05daaf0c9f58f0f2e86359f62c22be9e0238c3df76128c5f16aa842a3
Opcode Fuzzy Hash: a7f4e0e417c571a1ff23461d911e23802ba1fdb64609b92f6f302fcc39841b15
Instruction Fuzzy Hash: 2D0162315003009BD714BBB2D95999E77A9AF48708F10C43EF844A26A2D73DCC95CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401A10 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00401A23
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00401A35

Strings

CServiceModule::ServiceMinit(), xrefs: 00401A4F
.\ServiceMinit.cpp, xrefs: 00401A3B

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize
String ID: .\ServiceMinit.cpp$CServiceModule::ServiceMinit()
API String ID: 2028075725-1234673413
Opcode ID: 54856f421fb916c83c3a45df1b973c11cd44b053d8a809807075efa54278d12f
Instruction ID: 47460eb022e1316bbeafb88790dc6490f941b409b8538a26d2faa4177699af50
Opcode Fuzzy Hash: 54856f421fb916c83c3a45df1b973c11cd44b053d8a809807075efa54278d12f
Instruction Fuzzy Hash: D2F082722C02849BC700BB91BE4971537B56318708F10703AF4C551AB1D3BD54A8DF1F

Uniqueness

Uniqueness Score: -1.00%

Function 0040F7C0 Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 0040F7DE
CloseHandle.KERNEL32(?), ref: 0040F7F2
__freeptd.LIBCMT ref: 0040F7F9
ExitThread.KERNEL32 ref: 0040F801

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CloseExitHandleThread__freeptd__getptd_noexit
String ID:
API String ID: 1217956143-0
Opcode ID: cdc35e4d0b79643a97ee4cc99639e193bec2bdfeb99ac71bf24bfecc8f3f6dd7
Instruction ID: 8db6b2e349af711b4aa40c5178ab46e092a7c9e2b34bee4cb0c150b09ccb4caf
Opcode Fuzzy Hash: cdc35e4d0b79643a97ee4cc99639e193bec2bdfeb99ac71bf24bfecc8f3f6dd7
Instruction Fuzzy Hash: EFE0DF32005A015FE3322B746C9964E3A669F06731B24173FF414F65D1DB28CC89C3AE

Uniqueness

Uniqueness Score: -1.00%

Function 00401650 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 00401663
EnterCriticalSection.KERNEL32(0043AA5C), ref: 00401675

Strings

.\ServiceMinit.cpp, xrefs: 0040167B
CServiceModule::_ServiceMain(), xrefs: 0040168F

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize
String ID: .\ServiceMinit.cpp$CServiceModule::_ServiceMain()
API String ID: 2028075725-2060293115
Opcode ID: f78be0c0d9a887e08093604bc5698cc944fc4533b881d15d3764718530ac8833
Instruction ID: ed0b46dba125d02943cee9d83eef4b6cf3e7400746c103ed76934b137692e10c
Opcode Fuzzy Hash: f78be0c0d9a887e08093604bc5698cc944fc4533b881d15d3764718530ac8833
Instruction Fuzzy Hash: 1AE0E57618024497C700BF95AE0AA4A3BA4571C704F04B03AF4C4526A0D77890A8DB2F

Uniqueness

Uniqueness Score: -1.00%

Function 0040337B Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0043AA5C), ref: 004033D7
EnterCriticalSection.KERNEL32(0043AA5C), ref: 004033E9

Strings

spawn success. pid is %d, xrefs: 00403407
e:\scada_win\app\serviceminit\minit.cxx, xrefs: 004033EF

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CriticalSection$EnterInitialize
String ID: e:\scada_win\app\serviceminit\minit.cxx$spawn success. pid is %d
API String ID: 2028075725-2531702437
Opcode ID: fd069e1a6476a274828a6d8426c90d9b9711a717088cc0da41dcd899bd410830
Instruction ID: cbffede9149f936e7e1e5037bcdafc11cde24cb4e43064765f877319e2f3e144
Opcode Fuzzy Hash: fd069e1a6476a274828a6d8426c90d9b9711a717088cc0da41dcd899bd410830
Instruction Fuzzy Hash: 44E092715802445BD701AF40AD597183B619719309F1471AAFCC461691D7B90524DF1F

Uniqueness

Uniqueness Score: -1.00%

Function 0042CB3D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

*GC, xrefs: 0042CB59

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID:
String ID: *GC
API String ID: 0-2591478732
Opcode ID: 899f2fd770ecda5790780b15f756a49389b44eb40c263f7b4bcaf768877d6680
Instruction ID: 449fc62e2e3f996e6d88959a5192dfebc085f3dc8bc716bab64d3aebb726cd7a
Opcode Fuzzy Hash: 899f2fd770ecda5790780b15f756a49389b44eb40c263f7b4bcaf768877d6680
Instruction Fuzzy Hash: 96F0C271A00218FADF009F10FC82BB93B74A708758F508016FA45C80D1E2F5D6E4D798

Uniqueness

Uniqueness Score: -1.00%

Function 0040EFB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13COMMON

Download Yara Rule

APIs

__isspace_l.LIBCMT ref: 0040EFD4

Strings

,@, xrefs: 0040EFD0
(EC, xrefs: 0040EFC0

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: __isspace_l
String ID: (EC$,@
API String ID: 1989754883-981309927
Opcode ID: 70c465e7f1e0e3bff1becb53d6bb05b14e292cae5bb090d8b2b437d6954634e8
Instruction ID: a7fc81e703caa7090f2c6d5c096ca2fd5875f3a0f576a76e3b6c180d889ac8e2
Opcode Fuzzy Hash: 70c465e7f1e0e3bff1becb53d6bb05b14e292cae5bb090d8b2b437d6954634e8
Instruction Fuzzy Hash: 8ED0A931008200AECA259B16EC4172437A0AB80726F24686EF084092F0CF3E98B4EA09

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMTD ref: 0040AB8A

Strings

^u@, xrefs: 0040AB87, 0040AB8F
^u@, xrefs: 0040AB83

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: std::exception::exception
String ID: ^u@$^u@
API String ID: 2807920213-2155642463
Opcode ID: 82cee07db4e1ed6a6c516daf18cef7e0c36fb099f36d18b2374f95c4850e8236
Instruction ID: b76e22428f4f64538be8f71ae1e36aa5bd2ee2e88b086aee79604f42fd5199d4
Opcode Fuzzy Hash: 82cee07db4e1ed6a6c516daf18cef7e0c36fb099f36d18b2374f95c4850e8236
Instruction Fuzzy Hash: 73C04C7091910CFBCB04DB89E94285DB7F9DB45314B1001EDB80863341DA316F1096D9

Uniqueness

Uniqueness Score: -1.00%

Function 00408F20 Relevance: 5.2, APIs: 4, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,F0AA0F6A,?,?,?,?,?,?,?,?,?,00000000,0042F128,000000FF,?,00408A0E), ref: 00408F6E
CharNextA.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0042F128,000000FF), ref: 00408FE6

Part of subcall function 004092C0: CharNextA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,0042F128,000000FF), ref: 004092CD

CharNextA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,0042F128,000000FF), ref: 0040910E

Memory Dump Source

Source File: 00000006.00000002.1852964732.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1852938784.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853005194.0000000000430000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853031966.0000000000439000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1853055527.000000000043D000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_ServiceMinit.jbxd

Similarity

API ID: CharNext$lstrlen
String ID:
API String ID: 2675299387-0
Opcode ID: 0b18a32e85f074cdad813391665cc51a753f210a69f9d5e7238c3116c3cd8488
Instruction ID: 670d16859cf8b28671a42e11e53c5edc38fd4b113d9175807d0520915eef3cab
Opcode Fuzzy Hash: 0b18a32e85f074cdad813391665cc51a753f210a69f9d5e7238c3116c3cd8488
Instruction Fuzzy Hash: BF71EB74E04109DFDB14DFE4C894AAEB7B1EF49304F20816AE822BB396D7395D46CB58

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report view_01-64.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\FURUNO\VR-7000\CreateService.bat (copy)

C:\Program Files (x86)\FURUNO\VR-7000\CreateSeverEnvironment.bat (copy)

C:\Program Files (x86)\FURUNO\VR-7000\DeleteService.bat (copy)

C:\Program Files (x86)\FURUNO\VR-7000\DeleteSeverEnvironment.bat (copy)

C:\Program Files (x86)\FURUNO\VR-7000\InstSeverEnvironment.vbs (copy)

C:\Program Files (x86)\FURUNO\VR-7000\ServiceMinit.log

C:\Program Files (x86)\FURUNO\VR-7000\UninstSeverEnvironment.vbs (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\CreateLatestBackup.bat (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\DeleteLatestBackup.bat (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOfFatalError_LPV5.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOfFatalError_VMV.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOfInvalidJREVersion_LPV5.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOfInvalidJREVersion_VMV.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOnStartingUp_LPV5.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ErrorMessageOnStartingUp_VMV.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ShowErrorDialog.vbs (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message23.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message24ab.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message25.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message26.txt (copy)

C:\Program Files (x86)\FURUNO\VR-7000\Viewer\ais_decoder\VDM_message27.txt (copy)

Windows Analysis Report
view_01-64.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre