Edit tour

Windows Analysis Report
starwindconverter.exe

Overview

General Information

Sample name:	starwindconverter.exe
Analysis ID:	1432220
MD5:	f9545db50cc40988b62b49ffce2874be
SHA1:	12af954da045061b75c15322fa6f761bab09a787
SHA256:	3018ec56677e92e472fad392c390b606b9e8c93927766a900ab808e9e791882a
Infos:

Detection

Score:	11
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	53
Range:	0 - 100

Signatures

Checks for available system drives (often done to infect USB drives)

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: New Kernel Driver Via SC.EXE

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample may be VM or Sandbox-aware, try analysis on a native machine

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

starwindconverter.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\starwindconverter.exe" MD5: F9545DB50CC40988B62B49FFCE2874BE)

starwindconverter.tmp (PID: 5944 cmdline: "C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp" /SL5="$10446,40015629,338944,C:\Users\user\Desktop\starwindconverter.exe" MD5: 2356F5F81D797DFA2A9C35E973358693)

cmd.exe (PID: 6804 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2install.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 2844 cmdline: wmic OS get OSArchitecture MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

findstr.exe (PID: 6644 cmdline: findstr 64 MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

sc.exe (PID: 2516 cmdline: sc query vstor2-mntapi20-shared MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 692 cmdline: sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 2300 cmdline: sc start vstor2-mntapi20-shared MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

vc_redist.x64.130.exe (PID: 4116 cmdline: "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe" /quiet MD5: 96B61B8E069832E6B809F24EA74567BA)

vc_redist.x64.130.exe (PID: 5808 cmdline: "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe" /quiet -burn.unelevated BurnPipe.{D7692551-F3D1-4F96-B98C-6EA8EBCE2C29} {99F278BD-B402-4D45-B367-3A71E4C78909} 4116 MD5: 96B61B8E069832E6B809F24EA74567BA)

vc_redist.x64.140.exe (PID: 3452 cmdline: "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe" /quiet MD5: 27B141AACC2777A82BB3FA9F6E5E5C1C)

vc_redist.x64.140.exe (PID: 2536 cmdline: "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe" /quiet -burn.unelevated BurnPipe.{621695C5-B52A-43D6-BAAE-CEAD8A9F5342} {3E01C30D-E9A5-4BF9-AFE0-A4D60C443091} 3452 MD5: 27B141AACC2777A82BB3FA9F6E5E5C1C)

svchost.exe (PID: 3756 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

VSSVC.exe (PID: 5292 cmdline: C:\Windows\system32\vssvc.exe MD5: 875046AD4755396636A68F4A9EDB22A4)

svchost.exe (PID: 5824 cmdline: C:\Windows\System32\svchost.exe -k swprv MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SrTasks.exe (PID: 3624 cmdline: C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1 MD5: 2694D2D28C368B921686FE567BD319EB)

conhost.exe (PID: 3484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 4820 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

chrome.exe (PID: 6416 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:/// MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1904,i,7260468871230898073,3398952734327397412,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 6964 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

vcredist_x64.exe (PID: 8 cmdline: "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" /burn.runonce MD5: E16E6D68CE1949C9721656390F47CE07)

vcredist_x64.exe (PID: 1992 cmdline: "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" MD5: E16E6D68CE1949C9721656390F47CE07)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: New Kernel Driver Via SC.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System, CommandLine: sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2install.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6804, ParentProcessName: cmd.exe, ProcessCommandLine: sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System, ProcessId: 692, ProcessName: sc.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" /burn.runonce, EventID: 13, EventType: SetValue, Image: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe, ProcessId: 4116, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{050d4fc8-5d48-4b8f-8972-47c82c46020f}

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System, CommandLine: sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2install.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6804, ParentProcessName: cmd.exe, ProcessCommandLine: sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System, ProcessId: 692, ProcessName: sc.exe

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query vstor2-mntapi20-shared, CommandLine: sc query vstor2-mntapi20-shared, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2install.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6804, ParentProcessName: cmd.exe, ProcessCommandLine: sc query vstor2-mntapi20-shared, ProcessId: 2516, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 3756, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007F7378 _memset,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,ReadFile,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,GetLastError,CryptDestroyHash,CryptReleaseContext,	14_2_007F7378
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007D8101 CryptHashPublicKeyInfo,GetLastError,	14_2_007D8101
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007D8386 DecryptFileW,	14_2_007D8386
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007D7E2A _memset,CryptCATAdminCalcHashFromFileHandle,GetLastError,GetLastError,CryptCATAdminCalcHashFromFileHandle,GetLastError,WinVerifyTrust,WinVerifyTrust,WinVerifyTrust,	14_2_007D7E2A
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A88386 DecryptFileW,	26_2_00A88386
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A88101 CryptHashPublicKeyInfo,GetLastError,	26_2_00A88101
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00AA7378 _memset,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,ReadFile,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,GetLastError,CryptDestroyHash,CryptReleaseContext,	26_2_00AA7378
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A87E2A _memset,CryptCATAdminCalcHashFromFileHandle,GetLastError,GetLastError,CryptCATAdminCalcHashFromFileHandle,GetLastError,WinVerifyTrust,WinVerifyTrust,WinVerifyTrust,	26_2_00A87E2A
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DC8281 _memset,CryptCATAdminCalcHashFromFileHandle,GetLastError,GetLastError,CryptCATAdminCalcHashFromFileHandle,GetLastError,WinVerifyTrust,WinVerifyTrust,WinVerifyTrust,	28_2_00DC8281
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DE7C27 _memset,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,ReadFile,CryptHashData,ReadFile,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,GetLastError,CryptDestroyHash,CryptReleaseContext,	28_2_00DE7C27
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DC8558 CryptHashPublicKeyInfo,GetLastError,	28_2_00DC8558
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DC86D9 DecryptFileW,	28_2_00DC86D9

Compliance

Uses 32bit PE files

Source: starwindconverter.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Licensee is subject to the terms and conditions of this Agreement whether Licensee accesses or obtains Free Software directly from https://www.starwindsoftware.com/ or through any other source. By Using installing and/or Operating Free Software Licensee agrees to be bound by the terms of this Agreement. LICENSEE WILL HAVE THE OPPORTUNITY TO ACCEPT THIS OFFER OF AGREEMENT THROUGH A CLICK-THROUGH PROCEDURE. IF LICENSEE DOES NOT WISH TO ACCEPT THE TERMS OF THIS AGREEMENT AND/OR TO DECLINE THIS AGREEMENT LICENSEE SHALL NOT USE INSTALL OR OPERATE THE FREE SOFTWARE. IF LICENSEE CHOOSES TO ACCEPT THE TERMS OF THIS AGREEMENT LICENSEE MAY DO SO BY CHECKING I AGREE USING THE DESIGNATED CHECK BOX LICENSEES CLICK OF THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON IS A SYMBOL OF LICENSEES SIGNATURE AND BY CLICKING ON THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON LICENSEE CONSENTS TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT AND AGREES THAT THIS AGREEMENT IS ENFORCEABLE AGAINST LICENSEE PURSUANT TO ITS TERMS TO THE SAME EXTENT AS ANY WRITTEN NEGOTIATED AGREEMENT SIGNED BY LICENSEE. IF LICENSEE DOES NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT THEN LICENSEE SHOULD NOT OPERATE THE FREE SOFTWARE AND LICENSEE WILL NOT BE ALLOWED TO USE INSTALL OR OPERATE THE FREE SOFTWARE. FOR AVOIDANCE OF DOUBT AND NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN STARWIND RESERVES THE RIGHT TO REFUSE ACCEPTING THIS AGREEMENT AND NOT TO PROVIDE LICENSEE WITH THE RIGHT TO USE INSTALL OR OPERATE THE FREE SOFTWARE AS CONTEMPLATED HEREUNDER FOR ANY REASON OR NO REASON.Definitions. Each of the expressions indicated below will have in this Agreement the meaning assigned to it namely:Affiliate shall mean with respect to a given Person any person or entity which directly or indirectly controls is controlled by or is under common control with the given Person; control (including with its correlative meanings controlled by and under common control with) means possession directly or indirectly of the power to direct or cause the direction of management or policies (whether through ownership of securities or partnership or other ownership interests by contract or otherwise).Confidential Information shall mean any information Free Software document or other material of any nature relating to or concerning StarWind or Licensee and/or their Affiliates that is provided or made available to receiving Party either before or after the Effective Date directly or indirectly in any form whatsoever including in writing orally and machine readable and including but not be limited to any correspondence memoranda notes e-mails formulas samples equipment compilations blueprints business information technical information know-how information regarding patents patent applicati
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Licensee is subject to the terms and conditions of this Agreement whether Licensee accesses or obtains Free Software directly from https://www.starwindsoftware.com/ or through any other source. By Using installing and/or Operating Free Software Licensee agrees to be bound by the terms of this Agreement. LICENSEE WILL HAVE THE OPPORTUNITY TO ACCEPT THIS OFFER OF AGREEMENT THROUGH A CLICK-THROUGH PROCEDURE. IF LICENSEE DOES NOT WISH TO ACCEPT THE TERMS OF THIS AGREEMENT AND/OR TO DECLINE THIS AGREEMENT LICENSEE SHALL NOT USE INSTALL OR OPERATE THE FREE SOFTWARE. IF LICENSEE CHOOSES TO ACCEPT THE TERMS OF THIS AGREEMENT LICENSEE MAY DO SO BY CHECKING I AGREE USING THE DESIGNATED CHECK BOX LICENSEES CLICK OF THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON IS A SYMBOL OF LICENSEES SIGNATURE AND BY CLICKING ON THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON LICENSEE CONSENTS TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT AND AGREES THAT THIS AGREEMENT IS ENFORCEABLE AGAINST LICENSEE PURSUANT TO ITS TERMS TO THE SAME EXTENT AS ANY WRITTEN NEGOTIATED AGREEMENT SIGNED BY LICENSEE. IF LICENSEE DOES NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT THEN LICENSEE SHOULD NOT OPERATE THE FREE SOFTWARE AND LICENSEE WILL NOT BE ALLOWED TO USE INSTALL OR OPERATE THE FREE SOFTWARE. FOR AVOIDANCE OF DOUBT AND NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN STARWIND RESERVES THE RIGHT TO REFUSE ACCEPTING THIS AGREEMENT AND NOT TO PROVIDE LICENSEE WITH THE RIGHT TO USE INSTALL OR OPERATE THE FREE SOFTWARE AS CONTEMPLATED HEREUNDER FOR ANY REASON OR NO REASON.Definitions. Each of the expressions indicated below will have in this Agreement the meaning assigned to it namely:Affiliate shall mean with respect to a given Person any person or entity which directly or indirectly controls is controlled by or is under common control with the given Person; control (including with its correlative meanings controlled by and under common control with) means possession directly or indirectly of the power to direct or cause the direction of management or policies (whether through ownership of securities or partnership or other ownership interests by contract or otherwise).Confidential Information shall mean any information Free Software document or other material of any nature relating to or concerning StarWind or Licensee and/or their Affiliates that is provided or made available to receiving Party either before or after the Effective Date directly or indirectly in any form whatsoever including in writing orally and machine readable and including but not be limited to any correspondence memoranda notes e-mails formulas samples equipment compilations blueprints business information technical information know-how information regarding patents patent applicati
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Licensee is subject to the terms and conditions of this Agreement whether Licensee accesses or obtains Free Software directly from https://www.starwindsoftware.com/ or through any other source. By Using installing and/or Operating Free Software Licensee agrees to be bound by the terms of this Agreement. LICENSEE WILL HAVE THE OPPORTUNITY TO ACCEPT THIS OFFER OF AGREEMENT THROUGH A CLICK-THROUGH PROCEDURE. IF LICENSEE DOES NOT WISH TO ACCEPT THE TERMS OF THIS AGREEMENT AND/OR TO DECLINE THIS AGREEMENT LICENSEE SHALL NOT USE INSTALL OR OPERATE THE FREE SOFTWARE. IF LICENSEE CHOOSES TO ACCEPT THE TERMS OF THIS AGREEMENT LICENSEE MAY DO SO BY CHECKING I AGREE USING THE DESIGNATED CHECK BOX LICENSEES CLICK OF THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON IS A SYMBOL OF LICENSEES SIGNATURE AND BY CLICKING ON THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON LICENSEE CONSENTS TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT AND AGREES THAT THIS AGREEMENT IS ENFORCEABLE AGAINST LICENSEE PURSUANT TO ITS TERMS TO THE SAME EXTENT AS ANY WRITTEN NEGOTIATED AGREEMENT SIGNED BY LICENSEE. IF LICENSEE DOES NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT THEN LICENSEE SHOULD NOT OPERATE THE FREE SOFTWARE AND LICENSEE WILL NOT BE ALLOWED TO USE INSTALL OR OPERATE THE FREE SOFTWARE. FOR AVOIDANCE OF DOUBT AND NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN STARWIND RESERVES THE RIGHT TO REFUSE ACCEPTING THIS AGREEMENT AND NOT TO PROVIDE LICENSEE WITH THE RIGHT TO USE INSTALL OR OPERATE THE FREE SOFTWARE AS CONTEMPLATED HEREUNDER FOR ANY REASON OR NO REASON.Definitions. Each of the expressions indicated below will have in this Agreement the meaning assigned to it namely:Affiliate shall mean with respect to a given Person any person or entity which directly or indirectly controls is controlled by or is under common control with the given Person; control (including with its correlative meanings controlled by and under common control with) means possession directly or indirectly of the power to direct or cause the direction of management or policies (whether through ownership of securities or partnership or other ownership interests by contract or otherwise).Confidential Information shall mean any information Free Software document or other material of any nature relating to or concerning StarWind or Licensee and/or their Affiliates that is provided or made available to receiving Party either before or after the Effective Date directly or indirectly in any form whatsoever including in writing orally and machine readable and including but not be limited to any correspondence memoranda notes e-mails formulas samples equipment compilations blueprints business information technical information know-how information regarding patents patent applicati

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-OCNA5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-DOD6O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-LA1DS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-DMGAR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-RRJPS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-2T9SC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-NDNT1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-C445H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-PM8AC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-0U75Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-NJRVA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-JTGFU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-9PTPC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-239NR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-UHSSF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-3DPGP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QT18L.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QMAR7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-VPH09.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QH72R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QVHTU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-HKUCL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QJJQG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-SRQKS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-OCF30.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-JNOSU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-043UQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-ED59I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6S65I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-QULGP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-U7152.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-80TNO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-S80ND.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-BHS0U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-MMA8U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-9CMA4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-VUIE8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-G86Q6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I8RA6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-LQIVE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-H973S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-728T9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6QBCJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-HGVAF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-FIGM0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-OAJUU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-GCANT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-SN4HU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-NTL6D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-PAU7U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-4G0NR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I6VGK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-JUSQQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-468L0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-F99S5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-MRML8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-T4VT0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-M84MS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-HQLOK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-FDG2J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\is-03KQM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\is-EOQIC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\unins000.msg	Jump to behavior

Creates a software restore point

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore SRInitDone

Jump to behavior

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}

Creates license or readme file

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File created: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf	Jump to behavior
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1028\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1029\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1031\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1036\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1040\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1041\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1042\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1045\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1046\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1049\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1055\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\2052\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\3082\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\license.rtf

PE / OLE file has a valid certificate

Source: starwindconverter.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49738 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: starwindconverter.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: d:\build\ob\bora-4938387\bora\build\release\p2v\modules\vstor2\amd64\vstor2.pdb source: vstor2-mntapi20-shared.sys.6.dr
Source:	Binary string: D:\build\ob\bora-13861102\bora\build\scons\build\LIBRARIES\vmacore\win64\release\vmacore.pdb source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdbH source: vcredist_x64.exe, 0000001B.00000002.3025002722.000000006C6D5000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\build\ob\bora-6437881\cayman_pcre\build\release\win64_vc120\pcre\build\Release\pcre.pdb source: is-728T9.tmp.1.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixDepCA.pdb source: vc_redist.x64.130.exe, 0000000E.00000003.2567281053.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.130.exe, 0000000E.00000003.2569148419.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, 64f25b.msi.22.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: vc_redist.x64.130.exe, 0000000E.00000003.2566575331.0000000000A57000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.130.exe, 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000E.00000000.2310506729.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000F.00000002.2695158245.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000F.00000000.2312377149.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vcredist_x64.exe, 0000001A.00000002.2706467527.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001A.00000000.2695000937.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001B.00000002.3017994106.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001B.00000000.2699885293.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vc_redist.x64.140.exe, 0000001C.00000000.2700767939.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001C.00000002.2739200058.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001D.00000000.2705924171.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001D.00000002.2741446991.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, is-03KQM.tmp.1.dr
Source:	Binary string: D:\build\ob\bora-6437881\cayman_pcre\build\release\win64_vc120\pcre\build\Release\pcre.pdb"" source: is-728T9.tmp.1.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@E source: vc_redist.x64.130.exe, 0000000E.00000003.2566575331.0000000000A57000.00000004.00000020.00020000.00000000.sdmp, is-03KQM.tmp.1.dr
Source:	Binary string: d:\build\ob\bora-13861102\bora\build\release-x64\apps\vmware-vdiskmanager\vmware-vdiskmanager.pdb source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-13861102\bora\build\scons\build\LIBRARIES\vmomi\win64\release\vmomi.pdb source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-13861102\bora\build\release-x64\apps\vmware-vdiskmanager\vmware-vdiskmanager.pdb source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdb source: vcredist_x64.exe, 0000001B.00000002.3025002722.000000006C6D5000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\build\ob\bora-12677144\cayman_openssl\build\release\win64_vc90sp1\openssl\build\out32dll\libeay32.pdb source: is-VUIE8.tmp.1.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@ source: vc_redist.x64.130.exe, 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000E.00000000.2310506729.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000F.00000002.2695158245.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000F.00000000.2312377149.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vcredist_x64.exe, 0000001A.00000002.2706467527.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001A.00000000.2695000937.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001B.00000002.3017994106.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001B.00000000.2699885293.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb` source: vc_redist.x64.140.exe, 0000001C.00000000.2700767939.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001C.00000002.2739200058.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001D.00000000.2705924171.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001D.00000002.2741446991.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Projects\aws\sdk_build\bin\Release\aws-cpp-sdk-s3.pdb source: is-9PTPC.tmp.1.dr

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Windows\System32\svchost.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00476120 FindFirstFileA,FindNextFileA,FindClose,	1_2_00476120
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004531A4 FindFirstFileA,GetLastError,	1_2_004531A4
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004648D0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004648D0
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00464D4C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464D4C
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00463344 FindFirstFileA,FindNextFileA,FindClose,	1_2_00463344
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0049998C FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0049998C
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007D8BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	14_2_007D8BE8
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007F66A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	14_2_007F66A3
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007F5710 _memset,FindFirstFileW,FindClose,	14_2_007F5710
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00AA66A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	26_2_00AA66A3
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A88BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	26_2_00A88BE8
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00AA5710 _memset,FindFirstFileW,FindClose,	26_2_00AA5710
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 27_2_6C6CA685 _memset,FindFirstFileW,FindClose,	27_2_6C6CA685
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DE6D15 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	28_2_00DE6D15
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DE5D81 _memset,FindFirstFileW,FindClose,	28_2_00DE5D81
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DC8E6E _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	28_2_00DC8E6E

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\NULL	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\vcRuntimeAdditional_amd64	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\NULL	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\NULL	Jump to behavior

Networking

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Code function: 14_2_007E6994 InternetReadFile,WriteFile,WriteFile,GetLastError,GetLastError,

14_2_007E6994

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BreXLoZztbAKvXo&MD=CkxPD1Rx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BreXLoZztbAKvXo&MD=CkxPD1Rx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGM-ar7EGIjDPDwLUDTsFOtyhKJAT5DyNT4-JYGy8AQvI_i61IsKnO-HCW4ZF9DcmjkgW5xqtABsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-15; NID=513=kE4w8jVXQIKRBgnq2rSSuaeuj3V2oSTKpqDMdDROtfpQ8ynJq8dNWPI6cgFo4Z4M0m5JoqPofUAZ9lJDVPiOjdefNwcwKWrDPalqZGUDc-424T0yhgswfw6_8_P82oXXUD2LaGrnzZFPtUD6RmGvm8o3nBadhzqNR5DdgtcTsGI
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGM-ar7EGIjAqkOFqfrWsUuYYc-cHY4mS2DMqZX8MiAbTgaXolWeyzV_Jwf75R-0hkajKDO7EEd0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2024-04-26-15; NID=513=kE4w8jVXQIKRBgnq2rSSuaeuj3V2oSTKpqDMdDROtfpQ8ynJq8dNWPI6cgFo4Z4M0m5JoqPofUAZ9lJDVPiOjdefNwcwKWrDPalqZGUDc-424T0yhgswfw6_8_P82oXXUD2LaGrnzZFPtUD6RmGvm8o3nBadhzqNR5DdgtcTsGI

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A4109000CC6X-BM-CBT: 1696420817X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 60X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A4109000CC6X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-tX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2236Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997

Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: is-728T9.tmp.1.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0X
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000018.00000002.3027194417.0000023D4CA82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CC68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CC68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CC68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CC68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CC68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CC68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CC9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CD57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://s2.symcb.com0
Source: is-9PTPC.tmp.1.dr	String found in binary or memory: http://s3.amazonaws.com/doc/2006-03-01/
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/Body
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/Envelope
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/HeaderBody
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/http://docs.oasis-open.org/wss:stringmustUnderstandxsi
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://sf.symcd.com0&
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: is-728T9.tmp.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://sv.symcd.com0&
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: vc_redist.x64.130.exe, 0000000F.00000003.2658901479.00000000034A0000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.130.exe, 0000000F.00000003.2315287938.000000000148D000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000003.2701655658.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000002.3022940702.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.140.exe, 0000001D.00000003.2734949955.0000000002EDC000.00000004.00000800.00020000.00000000.sdmp, vc_redist.x64.140.exe, 0000001D.00000003.2737279519.0000000000B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: vc_redist.x64.130.exe, 0000000F.00000003.2658174562.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000002.3023884477.0000000003140000.00000004.00000800.00020000.00000000.sdmp, vc_redist.x64.140.exe, 0000001D.00000003.2734949955.0000000002EDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010(
Source: vc_redist.x64.130.exe, 0000000F.00000003.2658174562.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000002.3023884477.0000000003140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010and
Source: vc_redist.x64.130.exe, 0000000F.00000003.2658174562.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000002.3023884477.0000000003140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010lureH
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: starwindconverter.tmp, starwindconverter.tmp, 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: starwindconverter.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: starwindconverter.exe	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: is-VUIE8.tmp.1.dr	String found in binary or memory: http://www.openssl.org/V
Source: is-VUIE8.tmp.1.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: is-VUIE8.tmp.1.dr	String found in binary or memory: http://www.openssl.org/support/faq.html.
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, starwindconverter.tmp, 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://www.vmware.com/0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: http://www.vmware.com/0/
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=1647
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CD12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CD6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CD12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CCF3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.2693608492.0000023D4CD44000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.2693608492.0000023D4CD57000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.2693608492.0000023D4CD38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CD12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CD12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000018.00000003.2693608492.0000023D4CCA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2809369381.00000000005F3000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000002.2811349521.0000000000605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/
Source: starwindconverter.exe, 00000000.00000003.1731798053.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1733720466.0000000003280000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com//
Source: starwindconverter.exe, 00000000.00000003.1731871484.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.2812692493.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2810139887.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/:
Source: starwindconverter.tmp, 00000001.00000002.2811101281.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2809811649.00000000005BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/NT
Source: starwindconverter.tmp, 00000001.00000002.2811349521.0000000000605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/download-free-tools
Source: starwindconverter.tmp, 00000001.00000002.2811101281.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2809811649.00000000005BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/lT
Source: starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/privacy-policy
Source: starwindconverter.tmp, 00000001.00000003.2809040291.0000000000610000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000002.2812251955.0000000003591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/privacy-policy.
Source: starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/starwind-nfr-license-users
Source: starwindconverter.tmp, 00000001.00000003.2257418551.00000000035AC000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1742998627.0000000000623000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2809040291.0000000000610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/starwind-nfr-license-users.
Source: starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/terms
Source: starwindconverter.tmp, 00000001.00000003.1733720466.0000000003280000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000002.2811419131.0000000000661000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2808958826.000000000065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/v2v-help/
Source: starwindconverter.exe, 00000000.00000003.1731871484.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.2812692493.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2810139887.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.starwindsoftware.com/v2v-help/2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.32:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49738 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2.cat (copy)			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-HQLOK.tmp			Jump to dropped file

System Summary

Contains functionality to call native functions

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00423FD4 NtdllDefWindowProc_A,	1_2_00423FD4
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00412A28 NtdllDefWindowProc_A,	1_2_00412A28
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0042F9C0 NtdllDefWindowProc_A,	1_2_0042F9C0
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00479D08 NtdllDefWindowProc_A,	1_2_00479D08
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00457D90 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00457D90

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_0042ED84: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042ED84

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_004098E8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_004098E8
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00455D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_00455D80

Creates driver files

Source: C:\Windows\System32\cmd.exe

File created: C:\Windows\System32\drivers\vstor2-mntapi20-shared.sys

Jump to behavior

Creates files inside the driver directory

Source: C:\Windows\System32\cmd.exe

File created: C:\Windows\System32\drivers\vstor2-mntapi20-shared.sys

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\System32\cmd.exe	File created: C:\Windows\System32\drivers\vstor2-mntapi20-shared.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\64f258.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF594.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcamp120.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\vcomp120.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\64f25b.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\64f25b.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\64f25c.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{929FBD26-9020-399B-9A7A-751D61F0B942}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIF97D.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120chs.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120cht.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120deu.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120enu.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120esn.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120fra.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120ita.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120jpn.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120kor.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\mfc120rus.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\64f25f.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\64f25f.msi
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\64f25b.msi

Detected potential crypto function

Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_00408888	0_2_00408888
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00468034	1_2_00468034
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00471688	1_2_00471688
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00488030	1_2_00488030
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0046A088	1_2_0046A088
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00452100	1_2_00452100
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0043E1F0	1_2_0043E1F0
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004307FC	1_2_004307FC
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00444968	1_2_00444968
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00434A64	1_2_00434A64
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00444F10	1_2_00444F10
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00488F90	1_2_00488F90
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00431388	1_2_00431388
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00445608	1_2_00445608
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0048F6BC	1_2_0048F6BC
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00435768	1_2_00435768
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0045F8C0	1_2_0045F8C0
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0045B970	1_2_0045B970
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00445A14	1_2_00445A14

Found potential string decryption / allocating functions

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: String function: 007F540B appears 73 times
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: String function: 007EF6A2 appears 35 times
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: String function: 007F294E appears 460 times
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: String function: 007EFA86 appears 653 times
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: String function: 007F177A appears 60 times
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: String function: 00DE2F68 appears 462 times
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: String function: 00DDFD12 appears 35 times
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: String function: 00DE5A7C appears 73 times
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: String function: 00DE1D94 appears 59 times
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: String function: 00DE00F7 appears 655 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 00446274 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 0040596C appears 114 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 00453AAC appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 0043497C appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 00458718 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 00403400 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 0040905C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 00407D44 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 00446544 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 0045850C appears 100 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 00403494 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 0040357C appears 33 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 00406F14 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: String function: 00403684 appears 229 times
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: String function: 6C6CAFD3 appears 31 times
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: String function: 00AA177A appears 60 times
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: String function: 00A9F6A2 appears 35 times
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: String function: 00A9FA86 appears 653 times
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: String function: 00AA294E appears 460 times
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: String function: 00AA540B appears 73 times
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: String function: 6C6C10E3 appears 70 times

PE file contains executable resources (Code or Archives)

Source: starwindconverter.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: starwindconverter.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: starwindconverter.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-OCNA5.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-OCNA5.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-OCNA5.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

PE file does not import any functions

Source: mfc120kor.dll.22.dr	Static PE information: No import functions for PE file found
Source: mfc120cht.dll.22.dr	Static PE information: No import functions for PE file found
Source: mfc120enu.dll.22.dr	Static PE information: No import functions for PE file found
Source: mfc120ita.dll.22.dr	Static PE information: No import functions for PE file found
Source: mfc120rus.dll.22.dr	Static PE information: No import functions for PE file found
Source: mfc120deu.dll.22.dr	Static PE information: No import functions for PE file found
Source: mfc120jpn.dll.22.dr	Static PE information: No import functions for PE file found
Source: mfc120fra.dll.22.dr	Static PE information: No import functions for PE file found
Source: mfc120chs.dll.22.dr	Static PE information: No import functions for PE file found
Source: mfc120esn.dll.22.dr	Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs starwindconverter.exe
Source: starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs starwindconverter.exe

Uses 32bit PE files

Source: starwindconverter.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: mfc120kor.dll.22.dr	Static PE information: Section .rsrc
Source: mfc120cht.dll.22.dr	Static PE information: Section .rsrc
Source: mfc120enu.dll.22.dr	Static PE information: Section .rsrc
Source: mfc120ita.dll.22.dr	Static PE information: Section .rsrc
Source: mfc120rus.dll.22.dr	Static PE information: Section .rsrc
Source: mfc120deu.dll.22.dr	Static PE information: Section .rsrc
Source: mfc120jpn.dll.22.dr	Static PE information: Section .rsrc
Source: mfc120fra.dll.22.dr	Static PE information: Section .rsrc
Source: mfc120chs.dll.22.dr	Static PE information: Section .rsrc
Source: mfc120esn.dll.22.dr	Static PE information: Section .rsrc

Source: vstor2-mntapi20-shared.sys.6.dr	Binary string: \DosDevices\%ws\Device\MountPointManager
Source: vstor2-mntapi20-shared.sys.6.dr	Binary string: \Device\vstor2
Source: vstor2-mntapi20-shared.sys.6.dr	Binary string: \Device\

Source: classification engine

Classification label: clean11.evad.winEXE@48/237@2/4

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Code function: 14_2_007EF326 FormatMessageW,GetLastError,LocalFree,

14_2_007EF326

Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_004098E8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_004098E8
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00455D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	1_2_00455D80
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007C13BA GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	14_2_007C13BA
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A713BA GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	26_2_00A713BA
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DB13BA GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,	28_2_00DB13BA

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_004565A8 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,

1_2_004565A8

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Code function: 14_2_007F50CA GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

14_2_007F50CA

Source: C:\Users\user\Desktop\starwindconverter.exe

Code function: 0_2_0040A0D4 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_0040A0D4

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Code function: 14_2_007DE774 ChangeServiceConfigW,GetLastError,

14_2_007DE774

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

File created: C:\Program Files\StarWind Software

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3484:120:WilError_03

Source: C:\Users\user\Desktop\starwindconverter.exe

File created: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2install.bat""

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\starwindconverter.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: vc_redist.x64.130.exe, 0000000E.00000003.2567281053.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.130.exe, 0000000E.00000003.2569148419.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, 64f25b.msi.22.dr

Binary or memory string: SELECT `WixDependency`.`WixDependency`, `WixDependencyProvider`.`Component_`, `WixDependency`.`ProviderKey`, `WixDependency`.`MinVersion`, `WixDependency`.`MaxVersion`, `WixDependency`.`Attributes` FROM `WixDependencyProvider`, `WixDependency`, `WixDependencyRef` WHERE `WixDependency`.`WixDependency` = `WixDependencyRef`.`WixDependency_` AND `WixDependencyProvider`.`WixDependencyProvider` = `WixDependencyRef`.`WixDependencyProvider_`SELECT `WixDependencyProvider`.`WixDependencyProvider`, `WixDependencyProvider`.`Component_`, `WixDependencyProvider`.`ProviderKey`, `WixDependencyProvider`.`Attributes` FROM `WixDependencyProvider`Failed to ignored dependency "%ls" to the string dictionary.;Failed to create the string dictionary.Failed to get the string value of the IGNOREDEPENDENCIES property.IGNOREDEPENDENCIESUnknownFailed to set the dependency name "%ls" into the message record.Failed to set the dependency key "%ls" into the message record.The dependency "%ls" is missing or is not the required version.Found dependent "%ls", name: "%ls".Failed to set the number of dependencies into the message record.Failed to set the message identifier into the message record.Not enough memory to create the message record.wixdepca.cppUnexpected message response %d from user or bootstrapper application.Failed to create the dependency record for message %d.Failed to enumerate all of the rows in the dependency query view.Failed to get WixDependency.Attributes.Failed to get WixDependency.MaxVersion.Failed to get WixDependency.MinVersion.Failed to get WixDependency.ProviderKey.Failed to get WixDependencyProvider.Component_.Failed to get WixDependency.WixDependency.Failed dependency check for %ls.Skipping dependency check for %ls because the component %ls is not being (re)installed.Failed to open the query view for dependencies.Failed to initialize the unique dependency string list.Failed to check if the WixDependency table exists.Skipping the dependency check since no dependencies are authored.WixDependencyFailed to enumerate all of the rows in the dependency provider query view.Failed to get WixDependencyProvider.Attributes.Failed to get WixDependencyProvider.ProviderKey.Failed to get WixDependencyProvider.Component.Failed to get WixDependencyProvider.WixDependencyProvider.Failed dependents check for %ls.Skipping dependents check for %ls because the component %ls is not being uninstalled.Failed to open the query view for dependency providers.Failed to check if the WixDependencyProvider table exists.Skipping the dependents check since no dependency providers are authored.WixDependencyProviderSkipping the dependencies check since IGNOREDEPENDENCIES contains "ALL".Failed to check if "ALL" was set in IGNOREDEPENDENCIES.ALLFailed to get the ignored dependents.Failed to ensure required dependencies for (re)installing components.ALLUSERSFailed to initialize the registry functions.Failed to initialize.WixDependencyRequireFailed to ensure absent dependents for uninstalling com

Source: starwindconverter.exe	String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
Source: vc_redist.x64.130.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: vcredist_x64.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: vc_redist.x64.140.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: starwindconverter.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\starwindconverter.exe

File read: C:\Users\user\Desktop\starwindconverter.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\starwindconverter.exe "C:\Users\user\Desktop\starwindconverter.exe"
Source: C:\Users\user\Desktop\starwindconverter.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp "C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp" /SL5="$10446,40015629,338944,C:\Users\user\Desktop\starwindconverter.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2install.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic OS get OSArchitecture
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr 64
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query vstor2-mntapi20-shared
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start vstor2-mntapi20-shared
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe" /quiet
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Process created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe" /quiet -burn.unelevated BurnPipe.{D7692551-F3D1-4F96-B98C-6EA8EBCE2C29} {99F278BD-B402-4D45-B367-3A71E4C78909} 4116
Source: unknown	Process created: C:\Windows\System32\VSSVC.exe C:\Windows\system32\vssvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k swprv
Source: unknown	Process created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Source: C:\Windows\System32\SrTasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1904,i,7260468871230898073,3398952734327397412,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" /burn.runonce
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Process created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe" /quiet
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Process created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe" /quiet -burn.unelevated BurnPipe.{621695C5-B52A-43D6-BAAE-CEAD8A9F5342} {3E01C30D-E9A5-4BF9-AFE0-A4D60C443091} 3452
Source: C:\Users\user\Desktop\starwindconverter.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp "C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp" /SL5="$10446,40015629,338944,C:\Users\user\Desktop\starwindconverter.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2install.bat""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe" /quiet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe" /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic OS get OSArchitecture	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr 64	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query vstor2-mntapi20-shared	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start vstor2-mntapi20-shared	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Process created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe" /quiet -burn.unelevated BurnPipe.{D7692551-F3D1-4F96-B98C-6EA8EBCE2C29} {99F278BD-B402-4D45-B367-3A71E4C78909} 4116	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1904,i,7260468871230898073,3398952734327397412,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Process created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe"
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Process created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe "C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe" /quiet -burn.unelevated BurnPipe.{621695C5-B52A-43D6-BAAE-CEAD8A9F5342} {3E01C30D-E9A5-4BF9-AFE0-A4D60C443091} 3452

Source: C:\Users\user\Desktop\starwindconverter.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\starwindconverter.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: sxproxy.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: virtdisk.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: vss_ps.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: catsrvut.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: mfcsubs.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: clusapi.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: swprv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: virtdisk.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vss_ps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fveapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: spp.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: srcore.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: wer.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\SrTasks.exe	Section loaded: vss_ps.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: cabinet.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: msi.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: version.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: msasn1.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: msxml3.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: profapi.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: feclient.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: textinputframework.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: coreuicomponents.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: coremessaging.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: ntmarta.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: wintypes.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: windowscodecs.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: explorerframe.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: riched20.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: usp10.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: msls31.dll
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Section loaded: textshaping.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: cabinet.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: msi.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wininet.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: version.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: msasn1.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: msxml3.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wldp.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: profapi.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: apphelp.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wintypes.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wintypes.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wintypes.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: srclient.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: spp.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: powrprof.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: vssapi.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: vsstrace.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: umpdc.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: cabinet.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: msi.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wininet.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: version.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: msasn1.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: msxml3.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wldp.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: profapi.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: feclient.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: iertutil.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wintypes.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wintypes.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: wintypes.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: explorerframe.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: riched20.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: usp10.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: msls31.dll
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Section loaded: textshaping.dll

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: StarWind V2V Converter.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe
Source: Uninstall.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\Program Files\StarWind Software\StarWind V2V Converter\unins000.exe
Source: StarWind V2V Converter.lnk0.1.dr	LNK file: ..\..\..\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Window found: window name: TMainForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Automated click: I accept the agreement

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Licensee is subject to the terms and conditions of this Agreement whether Licensee accesses or obtains Free Software directly from https://www.starwindsoftware.com/ or through any other source. By Using installing and/or Operating Free Software Licensee agrees to be bound by the terms of this Agreement. LICENSEE WILL HAVE THE OPPORTUNITY TO ACCEPT THIS OFFER OF AGREEMENT THROUGH A CLICK-THROUGH PROCEDURE. IF LICENSEE DOES NOT WISH TO ACCEPT THE TERMS OF THIS AGREEMENT AND/OR TO DECLINE THIS AGREEMENT LICENSEE SHALL NOT USE INSTALL OR OPERATE THE FREE SOFTWARE. IF LICENSEE CHOOSES TO ACCEPT THE TERMS OF THIS AGREEMENT LICENSEE MAY DO SO BY CHECKING I AGREE USING THE DESIGNATED CHECK BOX LICENSEES CLICK OF THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON IS A SYMBOL OF LICENSEES SIGNATURE AND BY CLICKING ON THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON LICENSEE CONSENTS TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT AND AGREES THAT THIS AGREEMENT IS ENFORCEABLE AGAINST LICENSEE PURSUANT TO ITS TERMS TO THE SAME EXTENT AS ANY WRITTEN NEGOTIATED AGREEMENT SIGNED BY LICENSEE. IF LICENSEE DOES NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT THEN LICENSEE SHOULD NOT OPERATE THE FREE SOFTWARE AND LICENSEE WILL NOT BE ALLOWED TO USE INSTALL OR OPERATE THE FREE SOFTWARE. FOR AVOIDANCE OF DOUBT AND NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN STARWIND RESERVES THE RIGHT TO REFUSE ACCEPTING THIS AGREEMENT AND NOT TO PROVIDE LICENSEE WITH THE RIGHT TO USE INSTALL OR OPERATE THE FREE SOFTWARE AS CONTEMPLATED HEREUNDER FOR ANY REASON OR NO REASON.Definitions. Each of the expressions indicated below will have in this Agreement the meaning assigned to it namely:Affiliate shall mean with respect to a given Person any person or entity which directly or indirectly controls is controlled by or is under common control with the given Person; control (including with its correlative meanings controlled by and under common control with) means possession directly or indirectly of the power to direct or cause the direction of management or policies (whether through ownership of securities or partnership or other ownership interests by contract or otherwise).Confidential Information shall mean any information Free Software document or other material of any nature relating to or concerning StarWind or Licensee and/or their Affiliates that is provided or made available to receiving Party either before or after the Effective Date directly or indirectly in any form whatsoever including in writing orally and machine readable and including but not be limited to any correspondence memoranda notes e-mails formulas samples equipment compilations blueprints business information technical information know-how information regarding patents patent applicati
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Licensee is subject to the terms and conditions of this Agreement whether Licensee accesses or obtains Free Software directly from https://www.starwindsoftware.com/ or through any other source. By Using installing and/or Operating Free Software Licensee agrees to be bound by the terms of this Agreement. LICENSEE WILL HAVE THE OPPORTUNITY TO ACCEPT THIS OFFER OF AGREEMENT THROUGH A CLICK-THROUGH PROCEDURE. IF LICENSEE DOES NOT WISH TO ACCEPT THE TERMS OF THIS AGREEMENT AND/OR TO DECLINE THIS AGREEMENT LICENSEE SHALL NOT USE INSTALL OR OPERATE THE FREE SOFTWARE. IF LICENSEE CHOOSES TO ACCEPT THE TERMS OF THIS AGREEMENT LICENSEE MAY DO SO BY CHECKING I AGREE USING THE DESIGNATED CHECK BOX LICENSEES CLICK OF THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON IS A SYMBOL OF LICENSEES SIGNATURE AND BY CLICKING ON THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON LICENSEE CONSENTS TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT AND AGREES THAT THIS AGREEMENT IS ENFORCEABLE AGAINST LICENSEE PURSUANT TO ITS TERMS TO THE SAME EXTENT AS ANY WRITTEN NEGOTIATED AGREEMENT SIGNED BY LICENSEE. IF LICENSEE DOES NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT THEN LICENSEE SHOULD NOT OPERATE THE FREE SOFTWARE AND LICENSEE WILL NOT BE ALLOWED TO USE INSTALL OR OPERATE THE FREE SOFTWARE. FOR AVOIDANCE OF DOUBT AND NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN STARWIND RESERVES THE RIGHT TO REFUSE ACCEPTING THIS AGREEMENT AND NOT TO PROVIDE LICENSEE WITH THE RIGHT TO USE INSTALL OR OPERATE THE FREE SOFTWARE AS CONTEMPLATED HEREUNDER FOR ANY REASON OR NO REASON.Definitions. Each of the expressions indicated below will have in this Agreement the meaning assigned to it namely:Affiliate shall mean with respect to a given Person any person or entity which directly or indirectly controls is controlled by or is under common control with the given Person; control (including with its correlative meanings controlled by and under common control with) means possession directly or indirectly of the power to direct or cause the direction of management or policies (whether through ownership of securities or partnership or other ownership interests by contract or otherwise).Confidential Information shall mean any information Free Software document or other material of any nature relating to or concerning StarWind or Licensee and/or their Affiliates that is provided or made available to receiving Party either before or after the Effective Date directly or indirectly in any form whatsoever including in writing orally and machine readable and including but not be limited to any correspondence memoranda notes e-mails formulas samples equipment compilations blueprints business information technical information know-how information regarding patents patent applicati
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Window detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Licensee is subject to the terms and conditions of this Agreement whether Licensee accesses or obtains Free Software directly from https://www.starwindsoftware.com/ or through any other source. By Using installing and/or Operating Free Software Licensee agrees to be bound by the terms of this Agreement. LICENSEE WILL HAVE THE OPPORTUNITY TO ACCEPT THIS OFFER OF AGREEMENT THROUGH A CLICK-THROUGH PROCEDURE. IF LICENSEE DOES NOT WISH TO ACCEPT THE TERMS OF THIS AGREEMENT AND/OR TO DECLINE THIS AGREEMENT LICENSEE SHALL NOT USE INSTALL OR OPERATE THE FREE SOFTWARE. IF LICENSEE CHOOSES TO ACCEPT THE TERMS OF THIS AGREEMENT LICENSEE MAY DO SO BY CHECKING I AGREE USING THE DESIGNATED CHECK BOX LICENSEES CLICK OF THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON IS A SYMBOL OF LICENSEES SIGNATURE AND BY CLICKING ON THE I AGREE TO TERMS OF THIS AGREEMENT BUTTON LICENSEE CONSENTS TO BE BOUND BY AND BECOME A PARTY TO THIS AGREEMENT AND AGREES THAT THIS AGREEMENT IS ENFORCEABLE AGAINST LICENSEE PURSUANT TO ITS TERMS TO THE SAME EXTENT AS ANY WRITTEN NEGOTIATED AGREEMENT SIGNED BY LICENSEE. IF LICENSEE DOES NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT THEN LICENSEE SHOULD NOT OPERATE THE FREE SOFTWARE AND LICENSEE WILL NOT BE ALLOWED TO USE INSTALL OR OPERATE THE FREE SOFTWARE. FOR AVOIDANCE OF DOUBT AND NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN STARWIND RESERVES THE RIGHT TO REFUSE ACCEPTING THIS AGREEMENT AND NOT TO PROVIDE LICENSEE WITH THE RIGHT TO USE INSTALL OR OPERATE THE FREE SOFTWARE AS CONTEMPLATED HEREUNDER FOR ANY REASON OR NO REASON.Definitions. Each of the expressions indicated below will have in this Agreement the meaning assigned to it namely:Affiliate shall mean with respect to a given Person any person or entity which directly or indirectly controls is controlled by or is under common control with the given Person; control (including with its correlative meanings controlled by and under common control with) means possession directly or indirectly of the power to direct or cause the direction of management or policies (whether through ownership of securities or partnership or other ownership interests by contract or otherwise).Confidential Information shall mean any information Free Software document or other material of any nature relating to or concerning StarWind or Licensee and/or their Affiliates that is provided or made available to receiving Party either before or after the Effective Date directly or indirectly in any form whatsoever including in writing orally and machine readable and including but not be limited to any correspondence memoranda notes e-mails formulas samples equipment compilations blueprints business information technical information know-how information regarding patents patent applicati

Found window with many clickable UI elements (buttons, textforms, scrollbars etc)

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Window detected: Number of UI elements: 19
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Window detected: Number of UI elements: 19

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-OCNA5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-DOD6O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-LA1DS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-DMGAR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-RRJPS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-2T9SC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-NDNT1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-C445H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-PM8AC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-0U75Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-NJRVA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-JTGFU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-9PTPC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-239NR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-UHSSF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-3DPGP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QT18L.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QMAR7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-VPH09.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QH72R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QVHTU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-HKUCL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QJJQG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-SRQKS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-OCF30.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-JNOSU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-043UQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-ED59I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6S65I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-QULGP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-U7152.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-80TNO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-S80ND.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-BHS0U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-MMA8U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-9CMA4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-VUIE8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-G86Q6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I8RA6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-LQIVE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-H973S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-728T9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6QBCJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-HGVAF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-FIGM0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-OAJUU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-GCANT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-SN4HU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-NTL6D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-PAU7U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-4G0NR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I6VGK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-JUSQQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-468L0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-F99S5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-MRML8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-T4VT0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-M84MS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-HQLOK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-FDG2J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\is-03KQM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\is-EOQIC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Directory created: C:\Program Files\StarWind Software\StarWind V2V Converter\unins000.msg	Jump to behavior

Creates a software uninstall entry

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}

PE / OLE file has a valid certificate

Source: starwindconverter.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: starwindconverter.exe

Static file information: File size 40311016 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: starwindconverter.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: d:\build\ob\bora-4938387\bora\build\release\p2v\modules\vstor2\amd64\vstor2.pdb source: vstor2-mntapi20-shared.sys.6.dr
Source:	Binary string: D:\build\ob\bora-13861102\bora\build\scons\build\LIBRARIES\vmacore\win64\release\vmacore.pdb source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdbH source: vcredist_x64.exe, 0000001B.00000002.3025002722.000000006C6D5000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\build\ob\bora-6437881\cayman_pcre\build\release\win64_vc120\pcre\build\Release\pcre.pdb source: is-728T9.tmp.1.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixDepCA.pdb source: vc_redist.x64.130.exe, 0000000E.00000003.2567281053.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.130.exe, 0000000E.00000003.2569148419.0000000000AA9000.00000004.00000020.00020000.00000000.sdmp, 64f25b.msi.22.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb source: vc_redist.x64.130.exe, 0000000E.00000003.2566575331.0000000000A57000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.130.exe, 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000E.00000000.2310506729.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000F.00000002.2695158245.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000F.00000000.2312377149.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vcredist_x64.exe, 0000001A.00000002.2706467527.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001A.00000000.2695000937.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001B.00000002.3017994106.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001B.00000000.2699885293.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vc_redist.x64.140.exe, 0000001C.00000000.2700767939.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001C.00000002.2739200058.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001D.00000000.2705924171.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001D.00000002.2741446991.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, is-03KQM.tmp.1.dr
Source:	Binary string: D:\build\ob\bora-6437881\cayman_pcre\build\release\win64_vc120\pcre\build\Release\pcre.pdb"" source: is-728T9.tmp.1.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@E source: vc_redist.x64.130.exe, 0000000E.00000003.2566575331.0000000000A57000.00000004.00000020.00020000.00000000.sdmp, is-03KQM.tmp.1.dr
Source:	Binary string: d:\build\ob\bora-13861102\bora\build\release-x64\apps\vmware-vdiskmanager\vmware-vdiskmanager.pdb source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-13861102\bora\build\scons\build\LIBRARIES\vmomi\win64\release\vmomi.pdb source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-13861102\bora\build\release-x64\apps\vmware-vdiskmanager\vmware-vdiskmanager.pdb source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\WixStdBA.pdb source: vcredist_x64.exe, 0000001B.00000002.3025002722.000000006C6D5000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: d:\build\ob\bora-12677144\cayman_openssl\build\release\win64_vc90sp1\openssl\build\out32dll\libeay32.pdb source: is-VUIE8.tmp.1.dr
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb@ source: vc_redist.x64.130.exe, 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000E.00000000.2310506729.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000F.00000002.2695158245.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vc_redist.x64.130.exe, 0000000F.00000000.2312377149.00000000007FA000.00000002.00000001.01000000.00000009.sdmp, vcredist_x64.exe, 0000001A.00000002.2706467527.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001A.00000000.2695000937.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001B.00000002.3017994106.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp, vcredist_x64.exe, 0000001B.00000000.2699885293.0000000000AAA000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: E:\delivery\Dev\wix37\build\ship\x86\burn.pdb` source: vc_redist.x64.140.exe, 0000001C.00000000.2700767939.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001C.00000002.2739200058.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001D.00000000.2705924171.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp, vc_redist.x64.140.exe, 0000001D.00000002.2741446991.0000000000DEB000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\Projects\aws\sdk_build\bin\Release\aws-cpp-sdk-s3.pdb source: is-9PTPC.tmp.1.dr

Data Obfuscation

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_00450994 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450994

PE file contains sections with non-standard names

Source: is-VUIE8.tmp.1.dr	Static PE information: section name: fipstx
Source: is-VUIE8.tmp.1.dr	Static PE information: section name: fipsro
Source: is-VUIE8.tmp.1.dr	Static PE information: section name: fipsda
Source: is-VUIE8.tmp.1.dr	Static PE information: section name: fipsrd
Source: is-NTL6D.tmp.1.dr	Static PE information: section name: fipstx
Source: is-NTL6D.tmp.1.dr	Static PE information: section name: fipsda
Source: is-NTL6D.tmp.1.dr	Static PE information: section name: fipsrd
Source: is-NTL6D.tmp.1.dr	Static PE information: section name: fipsro
Source: is-03KQM.tmp.1.dr	Static PE information: section name: .wixburn
Source: is-EOQIC.tmp.1.dr	Static PE information: section name: .wixburn
Source: vcredist_x64.exe.14.dr	Static PE information: section name: .wixburn
Source: vcredist_x64.exe.15.dr	Static PE information: section name: .wixburn

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_00406A18 push 00406A55h; ret	0_2_00406A4D
Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_004093B4 push 004093E7h; ret	0_2_004093DF
Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: 0_2_00408580 push ecx; mov dword ptr [esp], eax	0_2_00408585
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00409D9C push 00409DD9h; ret	1_2_00409DD1
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0041A078 push ecx; mov dword ptr [esp], ecx	1_2_0041A07D
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00452100 push ecx; mov dword ptr [esp], eax	1_2_00452105
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0040A273 push ds; ret	1_2_0040A29D
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004062C4 push ecx; mov dword ptr [esp], eax	1_2_004062C5
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0040A29F push ds; ret	1_2_0040A2A0
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00460518 push ecx; mov dword ptr [esp], ecx	1_2_0046051C
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00496594 push ecx; mov dword ptr [esp], ecx	1_2_00496599
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004587B4 push 004587ECh; ret	1_2_004587E4
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00410930 push ecx; mov dword ptr [esp], edx	1_2_00410935
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00486A94 push ecx; mov dword ptr [esp], ecx	1_2_00486A99
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00478D50 push ecx; mov dword ptr [esp], edx	1_2_00478D51
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00412D78 push 00412DDBh; ret	1_2_00412DD3
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0040D288 push ecx; mov dword ptr [esp], edx	1_2_0040D28A
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0040F7E8 push ecx; mov dword ptr [esp], edx	1_2_0040F7EA
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004438E0 push ecx; mov dword ptr [esp], ecx	1_2_004438E4
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00459ACC push 00459B10h; ret	1_2_00459B08
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0049BD44 pushad ; retf	1_2_0049BD53

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QMAR7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120deu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\is-03KQM.tmp	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows\System32\drivers\vstor2-mntapi20-shared.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-UHSSF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmomi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-239NR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-NJRVA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\glib-2.0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-M84MS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\iconv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2-mntapi20-shared.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2-x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap_r.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-T4VT0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-G86Q6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-s3.dll (copy)	Jump to dropped file
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File created: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-OCF30.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-VPH09.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\unins000.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120cht.dll	Jump to dropped file
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-FIGM0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120esn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-iam.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixDiskLibVim.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-SN4HU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-80TNO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-mqtt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\gobject-2.0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-U7152.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-4G0NR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\ssleay32MD.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120rus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-PAU7U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-s3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6QBCJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-H973S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-SRQKS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-JNOSU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-DMGAR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vim-types.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-OAJUU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UGUD3.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-auth.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QT18L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-GCANT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I8RA6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-9CMA4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-BHS0U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixDiskLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixMntapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-io.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-HKUCL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-cal.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120enu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\is-EOQIC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\testing-resources.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-compression.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\libeay32MD.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-ec2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\zlib1.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120ita.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\pcre.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QJJQG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-LA1DS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vddkReporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\gsoap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-3DPGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-crt-cpp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-NTL6D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\expat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-sdkutils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-JTGFU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_ConverterConsole.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120chs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\starwindconverter.exe	File created: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-DOD6O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\wastorage.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\vcruntime140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libxml2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-event-stream.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmacore.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-043UQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-2T9SC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120fra.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssoclient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-MRML8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\diskLibPlugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QVHTU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-http.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2-x86.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-9PTPC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-VUIE8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-NDNT1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I6VGK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\intl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\cpprest140_2_9.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-checksums.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-OCNA5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120kor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-0U75Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6S65I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libeay32.dll (copy)	Jump to dropped file
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File created: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.be\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QH72R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-ED59I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-F99S5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-LQIVE.tmp	Jump to dropped file
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-RRJPS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-C445H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-HGVAF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\gthread-2.0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-QULGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-MMA8U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-728T9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\gvmomi.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120jpn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\is-PM8AC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-S80ND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\liblber.dll (copy)	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

File created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe

Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120deu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120ita.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcomp120.dll	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows\System32\drivers\vstor2-mntapi20-shared.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120kor.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120fra.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120rus.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\vcamp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120cht.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120enu.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120jpn.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120chs.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\mfc120esn.dll	Jump to dropped file

Creates license or readme file

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File created: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf	Jump to behavior
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	File created: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1028\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1029\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1031\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1036\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1040\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1041\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1042\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1045\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1046\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1049\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1055\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\2052\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\3082\license.rtf
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	File created: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\license.rtf

Boot Survival

Creates or modifies windows services

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore

Jump to behavior

Modifies existing windows services

Source: C:\Windows\System32\SrTasks.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarWind Software	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarWind Software\StarWind V2V Converter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarWind Software\StarWind V2V Converter\StarWind V2V Converter.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarWind Software\StarWind V2V Converter\Uninstall.lnk	Jump to behavior

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {050d4fc8-5d48-4b8f-8972-47c82c46020f}	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {050d4fc8-5d48-4b8f-8972-47c82c46020f}	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {050d4fc8-5d48-4b8f-8972-47c82c46020f}	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {050d4fc8-5d48-4b8f-8972-47c82c46020f}	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query vstor2-mntapi20-shared

Hooking and other Techniques for Hiding and Protection

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0042405C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_0042405C
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0042405C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_0042405C
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00422CAC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_00422CAC
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0041811E IsIconic,SetWindowPos,	1_2_0041811E
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00418120 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00418120
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004245E4 IsIconic,SetActiveWindow,	1_2_004245E4
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0042462C IsIconic,SetActiveWindow,SetFocus,	1_2_0042462C
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004187D4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_004187D4
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00484D28 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_00484D28
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0042F71C IsIconic,GetWindowLongA,GetWindowLongA,GetActiveWindow,MessageBoxA,SetActiveWindow,GetActiveWindow,MessageBoxA,SetActiveWindow,	1_2_0042F71C
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004179E8 IsIconic,GetCapture,	1_2_004179E8

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_0041F568 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F568

Source: C:\Users\user\Desktop\starwindconverter.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\VSSVC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains capabilities to detect virtual machines

Source: C:\Windows\System32\svchost.exe	File opened / queried: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	File opened / queried: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exe			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QMAR7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120deu.dll	Jump to dropped file
Source: C:\Windows\System32\cmd.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\vstor2-mntapi20-shared.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-UHSSF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-239NR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-NJRVA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\glib-2.0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-M84MS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\iconv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2-mntapi20-shared.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2-x64.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap_r.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-T4VT0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-G86Q6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-s3.dll (copy)	Jump to dropped file
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-OCF30.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-VPH09.tmp	Jump to dropped file
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\wixstdba.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120cht.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-FIGM0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120esn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-iam.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixDiskLibVim.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-SN4HU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-80TNO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-mqtt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\gobject-2.0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-U7152.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-4G0NR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\ssleay32MD.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120rus.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-PAU7U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-s3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6QBCJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-H973S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-SRQKS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-JNOSU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-DMGAR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-OAJUU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-UGUD3.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-auth.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-GCANT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QT18L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I8RA6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-9CMA4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixDiskLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-BHS0U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixMntapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-io.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-HKUCL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-cal.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120enu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-compression.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\libeay32MD.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-ec2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\zlib1.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120ita.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\pcre.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QJJQG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-LA1DS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vddkReporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\gsoap.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-3DPGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-crt-cpp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-NTL6D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcamp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\expat.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-sdkutils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-common.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-JTGFU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_ConverterConsole.exe (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120chs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-DOD6O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\wastorage.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libxml2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-event-stream.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmacore.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-043UQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-2T9SC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120fra.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssoclient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-MRML8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\diskLibPlugin.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2-x86.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QVHTU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-http.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-VUIE8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-9PTPC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-NDNT1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\vcomp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\intl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I6VGK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-checksums.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\cpprest140_2_9.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120kor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-0U75Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6S65I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-QH72R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-ED59I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-F99S5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-LQIVE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-RRJPS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-C445H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-HGVAF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\gthread-2.0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-QULGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-728T9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-MMA8U.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\mfc120jpn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\is-PM8AC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-S80ND.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Dropped PE file which has not been started: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\liblber.dll (copy)	Jump to dropped file

Found evaded block containing many API calls

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Evaded block: after key decision	graph_14-28655
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Evaded block: after key decision	graph_14-29814
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Evaded block: after key decision	graph_14-29833
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Evaded block: after key decision	graph_14-30481
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Evaded block: after key decision	graph_14-30010

Found evasive API chain (date check)

Source: C:\Users\user\Desktop\starwindconverter.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-6073

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Found evasive API chain checking for process token information

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_14-30249

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\SrTasks.exe TID: 3384	Thread sleep time: -280000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6396	Thread sleep time: -30000s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007EF195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 007EF236h	14_2_007EF195
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007EF195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 007EF22Fh	14_2_007EF195
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A9F195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00A9F236h	26_2_00A9F195
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A9F195 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00A9F22Fh	26_2_00A9F195
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DDF805 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00DDF8A6h	28_2_00DDF805
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DDF805 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00DDF89Fh	28_2_00DDF805

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File Volume queried: C:\Windows FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00476120 FindFirstFileA,FindNextFileA,FindClose,	1_2_00476120
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004531A4 FindFirstFileA,GetLastError,	1_2_004531A4
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_004648D0 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004648D0
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00464D4C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464D4C
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_00463344 FindFirstFileA,FindNextFileA,FindClose,	1_2_00463344
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: 1_2_0049998C FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_0049998C
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007D8BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	14_2_007D8BE8
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007F66A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	14_2_007F66A3
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007F5710 _memset,FindFirstFileW,FindClose,	14_2_007F5710
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00AA66A3 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	26_2_00AA66A3
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A88BE8 _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	26_2_00A88BE8
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00AA5710 _memset,FindFirstFileW,FindClose,	26_2_00AA5710
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 27_2_6C6CA685 _memset,FindFirstFileW,FindClose,	27_2_6C6CA685
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DE6D15 _memset,_memset,GetFileAttributesW,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,GetLastError,GetLastError,GetLastError,FindClose,	28_2_00DE6D15
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DE5D81 _memset,FindFirstFileW,FindClose,	28_2_00DE5D81
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DC8E6E _memset,FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	28_2_00DC8E6E

Source: C:\Users\user\Desktop\starwindconverter.exe

Code function: 0_2_0040A018 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_0040A018

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\NULL	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\vcRuntimeAdditional_amd64	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\NULL	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	File opened: C:\ProgramData\Package Cache\{0025DD72-A959-45B5-A0A3-7EFEB15A8050}v14.36.32532\packages\NULL	Jump to behavior

Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-authd version (%s) does not match that of client (%u.%u)220 VMware Authentication Daemon Version %u.%uVersion NFCSSL supportedNFCSSL supported/tVMXARGS supported%s: BANNER check skipped.
Source: starwindconverter.tmp, 00000001.00000003.2809523994.0000000002314000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exe
Source: is-728T9.tmp.1.dr	Binary or memory string: http://www.vmware.com/0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_set_connect_state
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_CRYPTO_set_locking_callback
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_default_verify_paths
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_bf_cbc
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_sk_new_null
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware vSphere API Browser
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_EncryptFinal
Source: starwindconverter.tmp, 00000001.00000003.2809369381.00000000005F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_WRAPPER_WORKSTATION_NOT_INSTALLED)Service type VIX_SERVICEPROVIDER_VMWARE_WORKSTATION was specified but not installed
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_MD_CTX_init
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SHA1_Final
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_CTX_get_error
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_f_ssl
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get1_session
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ENGINE_finish
Source: starwindconverter.tmp, 00000001.00000003.2104952718.0000000002304000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exe`
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ex 5: vmware-vdiskmanager.exe -n sourceName.vmdk destinationName.vmdk
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_NAME_hash
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware.log
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\Wow6432Node\VMware, Inc.\VMware Workstation\AccountInfoA_SAIFVM: Failed to convert filename
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_set_version
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_get_digestbyname
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.managedObjectInPath
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_UI_OpenSSL
Source: svchost.exe, 00000012.00000003.2547985746.0000021EAE065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_PKEY_type
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_get_serialNumber
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_gmtime_adj
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_CRYPTO_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.notAnObject
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="amd64" name="VMware.VMware.diskUtil" type="win32"></assemblyIdentity><description>"VMware Virtual Disk Manager"</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RAND_seed
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_read_bio_PrivateKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_cert_store
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SHA1_Update
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_ERROR)The VMware Tools installation failed with an unknown error
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VVOL_MSCS_SUPPORTVUMForVSAN_UIVUMForVSAN_BEVsanEncryptVSAN_UNMAPVSAN_VITVSAN_StorageEfficiencyVSAN_IPv6VSAN_IopsLimitVSAN_ErasureCodingVSAN_EncryptionVSAN_CoreDumpVSAN_ChecksumVRDMAVpxdUserVpxdOwnsPermissionsVmknicGatewayvNVMeControllerVMXSandboxvmw_ahcivmkusbvmkataVMFS6VMForkVMcryptVMConsoleUserVMAFD_ESXVCHA_EmbeddedVCHAVC_SecureHeartbeatVC_VAPI_ShimVC_Events_SyslogVC_Events_RetentionVC_Events_LevelFilterVC_Events_DBHealthVC_Events_BurstFilterVCDB_UIVASA3VADPUPITHostCapabilityUSBArbitrator_EnableAutoStartUI_TELEMETRY_ENHTLSv12DefaultSRIOV_NFVSoftNUMASIOCv2RoleEventsAuditingQualityROCEV2RISE_vSphereRISERemoveWFMPowerOnRDMACMqflgeqfle3qedentvProactiveHaProactiveDrsPrepareVmsForSanOnlyPMemOneKVolumesOneGbPagenvmxnet3ntg3NSX_VSWITCH_DRSNOVAnominal_qfle3nominal_qflgenominal_ntg3nominal_ixgbennmlx5_rdmanmlx5_coreNicMgmtnhpsa_nominalnhpsaNFS_AESNFS41_KRB5INFC_DISABLED_IN_VPXANetworkAwareDrsne1000nenicNBD_AIONativeBrowserFileTransferNativeFCOEMirror_ERSPANlsi_msgpt2lsi_mr3_fusionLiveRefreshLicensingMyVmwareSyncixgbeniSCSI_NSXISERIO_FILTERS_UIipmiigbni40enHelper2HWv13HPParallelOperationsHPHostSpecHPExtPluginsHPEngineParallelHPEngineServiceHPCompositeHostProfileHPBulkAnswerFileHBRPerformanceHARestartOrderHaAdmCtrlEnhancementGUEST_SECURE_BOOTgfmsFT_INTEROP_DRSFT_DATASTORE_RANKINGFCDeSwapEditHaUIEnhancementsencryptedVMotionDirectModuleLoadingdcbConfigDaemonManagementSupportCustomAttributesUiCoreStorage_4knDevSupportCL_StreamOptDisksOnDsSupportCL_JsonPersistenceOnDsCL_ISO_ServiceCL_GuestOsCustomizeCBRC2B2BBackupRestoreAUTOMATED_VUM_UPGRADEAsyncNFCApplianceMonitoringAdvancedVCDeploymentMetricsFeatureStateLib: reading feature states from config file: %s
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_write
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.notAnArray
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_MD5_Update
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS12_parse
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS7_verify
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_default_passwd_cb_userdata
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_CTX_init
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_client_cert_cb
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BUF_MEM_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_add_crl
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_d2i_DSA_PUBKEY
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ENGINE_set_default
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS7_get_signer_info
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DH_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_PKEY_assign
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_MNTAPI_CANT_MAKE_VAR_DIR)Cannot create directory '/var/run/vmware/fuse'
Source: vstor2-mntapi20-shared.sys.6.dr	Binary or memory string: LegalCopyrightCopyright (C) 1998-2016 VMware, Inc.>
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: d:\build\ob\bora-13861102\bora\build\release-x64\apps\vmware-vdiskmanager\vmware-vdiskmanager.pdb
Source: is-VUIE8.tmp.1.dr	Binary or memory string: CERTIFICATECERTIFICATECERTIFICATECERTIFICATETRUSTED CERTIFICATETRUSTED CERTIFICATETRUSTED CERTIFICATETRUSTED CERTIFICATECERTIFICATE PAIRCERTIFICATE PAIRCERTIFICATE PAIRCERTIFICATE PAIR.\crypto\pem\pem_oth.c.\crypto\pem\pem_pk8.c.\crypto\pem\pem_pk8.c.\crypto\pem\pem_pk8.c.\crypto\pem\pem_pk8.c.\crypto\pem\pem_pk8.cENCRYPTED PRIVATE KEYENCRYPTED PRIVATE KEYENCRYPTED PRIVATE KEYENCRYPTED PRIVATE KEYPRIVATE KEYPRIVATE KEYPRIVATE KEYPRIVATE KEYANY PRIVATE KEYPRIVATE KEYENCRYPTED PRIVATE KEY.\crypto\pem\pem_pkey.cPRIVATE KEY.\crypto\pem\pem_pkey.c%s PRIVATE KEYPARAMETERSPARAMETERS.\crypto\pem\pem_pkey.c%s PARAMETERS.\crypto\pem\pem_pkey.c.\crypto\pem\pem_pkey.cDH PARAMETERSX9.42 DH PARAMETERS.\crypto\pem\pem_pkey.c.\crypto\pem\pem_pkey.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.c.\crypto\pem\pvkfmt.cC:\Program Files (x86)\VMware\OpenSSL/privateC:\Program Files (x86)\VMware\OpenSSLC:\Program Files (x86)\VMware\OpenSSL/certsC:\Program Files (x86)\VMware\OpenSSL/cert.pemSSL_CERT_DIRSSL_CERT_FILE.\crypto\x509\x509_r2x.c.\crypto\x509\x509_cmp.c.\crypto\x509\x509_cmp.c.\crypto\x509\x509_cmp.c.\crypto\x509\x509_cmp.cNO X509_NAME.\crypto\x509\x509_obj.c.\crypto\x509\x509_obj.c.\crypto\x509\x509_obj.c.\crypto\x509\x509_req.c.\crypto\x509\x509_req.c.\crypto\x509\x509_req.c.\crypto\x509\x509_req.c.\crypto\x509\x509_req.c.\crypto\x509\x509_req.c.\crypto\x509\x509_req.c
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_IN_PROGRESS)A VMware Tools installation is already in progress
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_sha384
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_use_RSAPrivateKey_file
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_alert_desc_string_long
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_set_tmp_dh_callback
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_get_ex_data
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Error writing to vmware-authd socket. error %d
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_ctrl
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_CTX_get_error_depth
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_MD_CTX_md
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_shutdown
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_CRL_verify
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_sha256
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_padding_add_PKCS1_OAEP
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_new
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSLv23_client_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_HMAC_CTX_cleanup
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_get_error
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_MD_CTX_cleanup
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CIPHER_get_name
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CIPHER_get_version
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_debug_sessiondoPathmethodvmodllogoutlogout/finish"
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ble5Sistema de archivos desconocido. Contactar con VMware
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VixDiskLibInitCommonfilelog.fileNamelog.logMinLevelvixDiskLibLock0.06.5.4VMware Virtual Disk Development KitVixDiskLib: Failed to initialize logging!VixDiskLib: %s: Failed to initialize VixDiskLib. %s at %d.
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ex 3: vmware-vdiskmanager.exe -r sourceDisk.vmdk -t 0 destinationDisk.vmdk
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_d2i_PKCS7
Source: starwindconverter.tmp, 00000001.00000002.2812251955.0000000003591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exeC
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_OBJECT_free_contents
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ?GetVMwareClient@RequestContextMixin@Vmacore@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_print_errors
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_CTX_get_current_cert
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_AES_encrypt
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_INTEGER_get
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SSLSystemStoreFromStoreCtxCertificate verification failureThe length of the certificate key is too short.The certificate uses an unsafe digest algorithm.The certificate version is invalid.This certificate's extended key usage extension does not allow it to be used for server authentication.Other certificate trust error.There was an error when trying to check the server's SSL certificate.The host certificate chain is incomplete.A certificate trust list used to create this chain was not time-valid.A certificate trust list used to create this chain did not have a valid signature.A certificate trust list used to create this chain is not valid for this usage.The certificate is explicitly not trusted.The certificate is invalid for its proposed usage.The certificate is based on an untrusted root.The revocation status of the certificate is unknown.The certificate is part of a cycle in its chain of trust.The certificate has no valid signature.The end certificate has no resultant issuance policies, and there is an issuing certification authority certificate that has a policy constraints extension requiring it.The certificate does not support a critical extension.The certificate is not time-valid.The certificate is not properly time-nested.Trust for the certificate has been revoked.The certificate or one of the certificates in the certificate chain has an offline or stale revocation status.The name constraints extension of the certificate or one of the certificates in the certificate chain contains unsupported fields. The minimum and maximum fields are not supported. Minimum must always be zero and maximum must always be absent.The certificate or one of the certificates in the certificate chain has a name constraints extension and there is no name constraint for one of the name choices in the end certificate.The certificate or one of the certificates in the certificate chain has a name constraints extension, and a permitted name constraint is missing for one of the name choices in the end certificate.The certificate or one of the certificates in the certificate chain has a name constraints extension, and there is a name choice in the end certificate that is explicitly excluded.The certificate or one of the certificates in the certificate chain has an invalid name constraints extension.A certificate in the host's chain is explicitly not trusted.One of the certificates has an invalid extension.The certificate or one of the certificates in the certificate chain has a policy constraints extension, and one of the issued certificates has a disallowed policy mapping extension or a missing required issuance policies extension.The certificate or one of the certificates in the certificate chain has a basic constraints extension, and either the certificate cannot be used to issue other certificates, or the chain path length has been exceeded.A cycle in the certificate chain of trust was detected.A certificate in the host's chain does not have a valid signature.A certi
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: To collect data to submit to VMware technical support, run "vm-support".
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_ex_data
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_OPENSSL_add_all_algorithms_noconf
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_MD_CTX_destroy
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ENGINE_get_id
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_add_dir_cert_subjects_to_stack
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ?GetVMwareClient@SessionMixin@Vmacore@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BN_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_REQ_set_pubkey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EC_KEY_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_f_buffer
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: <VMWARE-NULL>
Source: svchost.exe, 00000012.00000003.2548064283.0000021EAE06D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware-CSRF-Token
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_write_bio_PUBKEY
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_version
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ENGINE_register_all_digests
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FileFindExistingSafeTmpDir%s\%s-%s-*vmware%s: Failed to create a safe temporary directory, path "%s". The maximum number of attempts was exceeded.
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_STRING_length
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_ex_data_X509_STORE_CTX_idx
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CnxConnectAuthdVMWARE_HTTPSPROXY%s: Error message: %s
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BN_num_bits
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.stringKeyTypeMismatch.data
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DSA_sign
Source: starwindconverter.tmp, 00000001.00000003.1733720466.0000000003280000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: !{app}\lib\vmware-vdiskmanager.exe
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: %SystemDrive%\%ProgramData%\VMware\vCenterServer\cfgVMWARE_CFG_DIRFeatureStateLib: %s = entry not in dict
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_AES_ecb_encrypt
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ENGINE_load_private_key
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ENGINE_get_first
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_i2d_X509
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_TIME_print
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_debug_session
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ENGINE_cleanup
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_read_bio_RSAPublicKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_set_flags
Source: starwindconverter.tmp, 00000001.00000003.2105015420.0000000003590000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \rogram Files\StarWind Software\StarWind V2V Converter\lib\expat.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\glib-2.0.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\gobject-2.0.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\gthread-2.0.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\gvmomi.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\iconv.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\intl.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libcurl.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libeay32.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\liblber.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap_r.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libxml2.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\pcre.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssleay32.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssoclient.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vddkReporter.exeC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vim-types.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixDiskLib.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixDiskLibVim.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixMntapi.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmacore.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmomi.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exeC:\Program Files\StarWind Software\StarWind V2V Converter\lib\zlib1.dllC:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exeC:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\%s
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_CTX_get_ex_data
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_get_ex_new_index
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_MD5_Final
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware ReservedVMware HiddenDEVCREAT: num Partition mismatch!
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EC_KEY_new_by_curve_name
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_INIT_FAILED)The VMware Tools installation failed to initialize
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Failed to read vmware-authd port number: %s
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_TLSv1_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_set_flags
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_OBJ_txt2nid
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_NAME_cmp
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RAND_get_rand_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_ctrl
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_version
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_verify_depth
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_new
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_TLSv1_1_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_verify
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ProductNameVMware WorkstationN
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_set_purpose
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_LOOKUP_ctrl
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \| VMware
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_write_bio_X509_REQ
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_print_fp
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_tmp_dh_callback
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS7_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_reason_error_string
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_session_id_context
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS7_ctrl
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_get_by_subject
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_get_ex_new_index
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_connect
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Host address lookup for server %s failed: %sInvalid data read while getting status code.Premature end of status line while getting status code.Premature end of status line while getting version number.Response status line did not begin with '%s'.HTTP/Must specify username and passwordConnection terminated by serverBuffer overrun while reading from network connectionMalformed response from serverConnection terminated by server, ret %d err %dWait error %u while attempting readTimeout while attempting readError writing to vmware-authd socket. error %dWait error %u while attempting writeTimeout while attempting writeEnumStrings: Out of memory while enumerating string.
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_LOOKUP_hash_dir
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_add_lookup
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_callback_ctrl
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_sign
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_fd
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSLv23_server_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_DecryptUpdate
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_read_PrivateKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_AES_set_encrypt_key
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509V3_EXT_d2i
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_GUEST_NOT_READY)VMware Tools are not running in the guest OS. Automatic upgrade is not possible
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_cmp_current_time
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_CANCELLED)The VMware Tools installation was canceled
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.lenghAlreadySeen
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_TLSv1_client_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS12_PBE_add
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_set_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_read_bio_PKCS7
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_ctrl
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_use_PrivateKey_file
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSLv3_method
Source: is-VUIE8.tmp.1.dr	Binary or memory string: C:\Program Files (x86)\VMware\OpenSSL
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ?SetVMwareClient@SessionMixin@Vmacore@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CompanyNameVMware, Inc.`
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Session's UserBinding : %1Session's vmware_client : %1Session's UserAgent : %1User-Agent[ResolveSession] ResolveSession calledsoapSessionIdVMware-CSRF-TokenHTTP/1.1Content-LengthSet-CookieKeep-AlivecloseConnectionLocationContent-TypeTransfer-Encoding"
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_new_file
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_GENERAL_NAME_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_OBJ_nid2sn
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SHA1_Transform
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_DigestInit
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSLv3_client_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (VMware internal)
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.managedObjectInPathcom.vmware.vim.propertyPath.error.unexpectedArraycom.vmware.vim.propertyPath.error.notAnObjectcom.vmware.vim.propertyPath.error.notFoundcom.vmware.vim.propertyPath.error.stringKeyTypeMismatch.datacom.vmware.vim.propertyPath.error.stringKeyTypeMismatchcom.vmware.vim.propertyPath.error.intKeyTypeMismatch.datacom.vmware.vim.propertyPath.error.intKeyTypeMismatchcom.vmware.vim.propertyPath.error.notAnArraycom.vmware.vim.propertyPath.error.lenghAlreadySeen0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_check_ca
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_private_encrypt
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_INTEGER_to_BN
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.unexpectedArray
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b:vmware_client"
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS7_cert_from_signer_info
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_PKEY_new
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_NAME_new
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DSA_verify
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BUF_strlcpy
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_cleanup
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE.JOURNAL.VER.1.0."
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_clear
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_get_error_line_data
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_MD4_Init
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SHA256_Init
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Virtual Disk Development Kit
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_DEVICE_NOT_CONNECTED)The guest operating system device used for installation of VMware Tools is not connected
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_STRING_to_UTF8
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_ex_new_index
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_read_bio_RSAPrivateKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE.JOURNAL.VER.1.0.
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SnapshotGetDisksWorkpolicy.vm.sourcevmidvmx-debug-zdumpvmx-zdumpvmmcorescore.vmware64-corevmware-coreSVGAnextIdFloppyPADRLADRFstoppedintrIdxddLencompRingSizereservedddPAcompRingBaseEthernetlevelStatescsiSeqNumberscsiQuiesceModevidevm.suspendTime.clientDataMStatsfpuLevelStatesmmVersioncpuOut of memoryCheckpoint is from a newer versionBad magic in the headerCan't open the fileUnknown error.Cryptography failed.I/O error.Unrecognized data format.Required key was not supplied.The operation completed successfully.@&!@@(msg.vmencryptor.error-NEEDSREPAIR)One of the virtual machine's disks needs repair@&!@@(msg.vmencryptor.error-FILE_LOCKED)The virtual machine appears to be in use@&!@@(msg.vmencryptor.error-VERSION)Encryption is not allowed on this virtual machine@&!@@(msg.vmencryptor.error-DISKSPACE)Insufficient disk space@&!@@(msg.vmencryptor.error-HASCLONE)Cannot change the encryption state of a virtual machine that has linked clones@&!@@(msg.vmencryptor.error-SNAPSHOTLIB)Snapshot library problem@&!@@(msg.vmencryptor.error-UNLOCK_FAILED)Failed to unlock the virtual machine@&!@@(msg.vmencryptor.error-BAD_KEY)The password specified is incorrect@&!@@(msg.vmencryptor.error-NO_PRIVATE_KEY)Imported key is not a private key@&!@@(msg.vmencryptor.error-VM_HAS_CHECKPOINT)Cannot change the encryption state of a virtual machine with a snapshot@&!@@(msg.vmencryptor.error-NO_PASSWORD)The virtual machine is not password-protected@&!@@(msg.vmencryptor.error-CANCELLED)Operation canceled@&!@@(msg.vmencryptor.error-NO_AUTHENT_KEYS)Authentication keys are required@&!@@(msg.vmencryptor.error-DISKLIB)Disk problem@&!@@(msg.vmencryptor.error-CRYPTO)Encryption libraries problem@&!@@(msg.vmencryptor.error-BAD_PARAMETER)Bad parameter@&!@@(msg.vmencryptor.error-VM_NOT_ENC)The virtual machine is not encrypted@&!@@(msg.vmencryptor.error-UNRECOVERABLE)The virtual machine might be corrupted@&!@@(msg.vmencryptor.error-FILEIO)File I/O problem@&!@@(msg.vmencryptor.error-KEYSAFE)Key safe library problem@&!@@(msg.vmencryptor.error-KEYLOCATOR)Failed to locate keys@&!@@(msg.vmencryptor.error-DICTIONARY)Dictionary problem@&!@@(msg.vmencryptor.error-UNKNOWN)Unknown error@&!@@(msg.vmencryptor.error-NOMEM)Out of memory@&!@@(msg.vmencryptor.error-SUCCESS)The operation completed successfully`
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_OpenSSL_add_all_ciphers
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_sk_num
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_HGFS_MOUNT_FAIL)There was an error mounting the Shared Folders file system inside the guest operating system
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_write_bio_PKCS8PrivateKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware VI Client
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_aes_256_xts
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_VerifyFinal
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: bora\lib\log\log.ccustomvmware
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_VERIFY_PARAM_set_flags
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_CIPHER_CTX_block_size
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ?SetVMwareClient@RequestContextMixin@Vmacore@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: GetSystemFirmwareTableKernel32.dllSOFTWARE\%sVMware, Inc.UUIDCreateRandomUnstylized12.0e.x.pproductStateLockIgnoring subsequent product state set
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DH_new
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_GENERAL_NAMES_free
Source: svchost.exe, 00000012.00000002.3019156896.0000021EAE058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_use_PrivateKey
Source: is-728T9.tmp.1.dr	Binary or memory string: CompanyNameVMware
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509V3_add_standard_extensions
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_read
Source: vstor2-mntapi20-shared.sys.6.dr	Binary or memory string: FileDescriptionVMware Virtual Storage Volume Driverj%
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1998-2019 VMware, Inc.<
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_new
Source: is-VUIE8.tmp.1.dr	Binary or memory string: OPENSSLDIR: "C:\Program Files (x86)\VMware\OpenSSL"
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_CTX_new
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1998-2019 VMware, Inc.@
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_des_cbc
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_NAME_ENTRY_get_object
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_set_pubkey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DSA_generate_parameters
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.stringKeyTypeMismatch
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS7_get0_signers
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_shutdown
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_free_strings
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_want
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ex 4: vmware-vdiskmanager.exe -x 36GB myDisk.vmdk
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_ALREADY_UP_TO_DATE)VMware Tools are already up to date
Source: starwindconverter.tmp, 00000001.00000003.2104952718.0000000002304000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0\lib\vmware-vdiskmanager.exe.ex
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_DecryptInit_ex
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_CRYPTO_malloc
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_free_all
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1998-2019 VMware, Inc.X
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BN_bn2hex
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_load_crypto_strings
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_verify_cert_error_string
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_DecryptFinal_ex
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_remove_state
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_new_socket
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Unidad de disco RAM5Tipo de controlador desconocido. Contactar con VMware2GetDiskFreeSpaceEx() f
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RAND_SSLeay
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_PKEY_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_peek_last_error
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_get_verify_callback
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ENGINE_init
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\Wow6432Node\VMware, Inc.\VMware Workstation\AccountInfo
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_set_client_CA_list
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_current_cipher
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: W32Util_GetVMwareGroupSid
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SHA256
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_d2i_PKCS7_fp
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.panic.requestSupport.vmSupport.vmx86)
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_HMAC_Init_ex
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_quiet_shutdown
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RAND_set_rand_method
Source: starwindconverter.tmp, 00000001.00000002.2811384946.000000000061A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Zrogram Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exe
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSLeay
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_CONF_modules_unload
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_DecryptFinal
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_HMAC_Init
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_TLSv1_2_server_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_s_mem
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_generate_key_ex
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.intKeyTypeMismatch.data
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0VMware k0J0OUD0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DH_generate_parameters
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_vfree
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSLv2_client_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_CRYPTO_set_id_callback
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS5_PBKDF2_HMAC
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware User GroupCan't get token info: %s
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: LicensingMyVmwareSync
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_write_bio_RSAPublicKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BN_cmp
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSLv2_method
Source: starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {app}\lib\vmware-vdiskmanager.exe
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Workstation
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_error_string
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_new_connect
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: E0No-User-AgentKeep-AlivecloseConnectionUser-AgentVMware VI ClientVMware-clientVMware-client/3
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SHA1
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RAND_file_name
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_i2d_X509_AUX
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ex 1: vmware-vdiskmanager.exe -c -s 850MB -a ide -t 0 myIdeDisk.vmdk
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_CRYPTO_set_mem_functions
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_digest
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_size
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_WRAPPER_PLAYER_NOT_INSTALLED)Service type VIX_SERVICEPROVIDER_VMWARE_PLAYER was specified but not installed
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE_CFG_DIR
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_EncryptInit_ex
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Internal Program Data Ver 0.1R_Crypto() failed
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_STRING_data
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_load_verify_locations
Source: SrTasks.exe, 00000014.00000002.2819747854.0000016F51573000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c
Source: is-728T9.tmp.1.dr	Binary or memory string: http://www.vmware.com/0/
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_new
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_TLSv1_2_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: <VMWARE-EMPTYSTRING>
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Ramdisk drive"Unknown drive type. Contact VMware
Source: SrTasks.exe, 00000014.00000003.2785323228.0000016F5155C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33czd2P
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_DigestFinal_ex
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_sk_value
Source: starwindconverter.tmp, 00000001.00000002.2812251955.0000000003591000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exe, includ
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_NAME_get_index_by_NID
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_EXTENSION_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DSA_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_get_issuer_name
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_clear_error
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_new_fp
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_error
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_read
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CompanyNameVMware, Inc.T
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SHA256_Final
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_CTX_get_chain
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_HMAC_Final
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CompanyNameVMware, Inc.Z
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_i2d_PublicKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: sconosciuto. Contatta supporto VMware
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_tmp_rsa_callback
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_PKEY_set1_DSA
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_SignFinal
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_PKEY_bits
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_MD4_Final
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_TLSv1_1_server_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_DecryptInit
Source: SrTasks.exe, 00000014.00000003.2742961480.0000016F5155C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b$d
Source: starwindconverter.tmp, 00000001.00000003.2808887043.00000000035AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Files\StarWind Software\StarWind V2V Converter\ssleay32MD.dllC:\Program Files\StarWind Software\StarWind V2V Converter\gsoap.dllC:\Program Files\StarWind Software\StarWind V2V Converter\wastorage.dllC:\Program Files\StarWind Software\StarWind V2V Converter\vcruntime140_1.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-core.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-ec2.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-iam.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-s3.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-auth.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-cal.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-common.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-compression.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-event-stream.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-checksums.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-http.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-io.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-mqtt.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-core.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-crt-cpp.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-s3.dllC:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-sdkutils.dllC:\Program Files\StarWind Software\StarWind V2V Converter\testing-resources.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\diskLibPlugin.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\expat.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\glib-2.0.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\gobject-2.0.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\gthread-2.0.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\gvmomi.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\iconv.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\intl.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libcurl.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libeay32.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\liblber.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap_r.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\libxml2.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\pcre.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssleay32.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssoclient.dllC:\Program Files\StarWind Software\StarWind V2V Converter\lib\vddkReporter.exeC:\Program Files\StarWind Software\Star
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_new_mem_buf
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_sk_pop_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_new_bio_pair
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_certificate
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_CRYPTO_cleanup_all_ex_data
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_library_init
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ex 7: vmware-vdiskmanager.exe -k myDisk.vmdk
Source: SrTasks.exe, 00000014.00000003.2817580024.0000016F51573000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c}d3V
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BN_new
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_OBJ_obj2nid
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_s2i_ASN1_INTEGER
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_NOT_RUNNING)VMware Tools are not running in the guest
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_public_encrypt
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_d2i_DSAPrivateKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_state_string_long
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_CTX_set_verify_cb
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_read_bio_DHparams
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: me de fichiers inconnu. Contactez VMware
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RAND_add
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PKCS12_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DES_set_key
Source: svchost.exe, 00000012.00000002.3019477708.0000021EAE060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_alert_type_string_long
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_pending
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_get_subject_name
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_d2i_PKCS12_fp
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: cM vmware-vmacore-"
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_use_certificate_file
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_AUTO_NOT_SUPPORTED)The VMware Tools installation cannot be upgraded automatically
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_CRYPTO_num_locks
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_TLSv1_2_client_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RAND_load_file
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_cert_verify_callback
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_peek
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-core
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_TOOLS_INSTALL_IMAGE_COPY_FAILED)Could not copy VMware Tools image to the guest operating system
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_HMAC_Update
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_func_error_string
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: authd.forceUseForStandaloneVMXthe VMware Authorization Service%s could not connect to %s for the following reason: %s
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ReleaseVMwarebuild-13861102VixDiskLib: Release socket.
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Error code mismatch in multi-line vmware-authd response. First line error code %d, next line %d.
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_get_ext_d2i
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BN_set_word
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_use_certificate_chain_file
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: d:\build\ob\bora-13861102\bora\build\release-x64\apps\vmware-vdiskmanager\vmware-vdiskmanager.pdb
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ERR_error_string_n
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_test_flags
Source: vstor2-mntapi20-shared.sys.6.dr	Binary or memory string: ProductNameVMware vCenter Converter StandaloneL
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_peer_certificate
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: User-Agent: VMware-client/6.5.0
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_PKEY_copy_parameters
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_default_passwd_cb
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_NAME_get_text_by_NID
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.intKeyTypeMismatch
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE_HTTPSPROXY
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: the VMware Authorization Service
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_write
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_free
Source: VSSVC.exe, 00000011.00000002.3018829606.000002286C577000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000ViuX
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_NAME_add_entry_by_txt
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Badly formed response from vmware-authd: '%s'
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ProductNameVMware Virtual Disk Development KitN
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DSA_size
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware64-core
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \| VMwarePA
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_NAME_print_ex
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SHA256_Transform
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: rimovibile1File system sconosciuto. Contatta supporto VMware
Source: is-VUIE8.tmp.1.dr	Binary or memory string: C:\Program Files (x86)\VMware\OpenSSL/certs
Source: starwindconverter.tmp, 00000001.00000003.2104952718.0000000002304000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \lib\vmware-vdiskmanager.exe
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware-client
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_INTEGER_set
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_renegotiate
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_DigestUpdate
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RamDisk-Laufwerk3Unbekannter Laufwerktyp. Wenden Sie sich an VMware.
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_STRING_type
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_CIPHER_iv_length
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_MNTAPI_INTERNAL)An internal error has occurred. Contact VMware support
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_set_accept_state
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_state
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=1647
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RAND_egd
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_get_ext_by_NID
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_OBJ_NAME_add
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_private_decrypt
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_INTEGER_cmp
Source: svchost.exe, 00000018.00000002.3027027290.0000023D4CA5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3024081333.0000023D4762B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ENGINE_register_all_ciphers
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_PKEY_set1_RSA
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_md5
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_TLSv1_1_client_method
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: %SystemDrive%\%ProgramData%\VMware\vCenterServer\cfg
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: W32Util_GetVMwareGroupSid__vmware__%s: Failed directory attributes check, "%s"
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CIPHER_get_bits
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_i2d_DSAPrivateKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_soap_sessionSOAPAction"
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FileDescriptionVMware Virtual Disk ManagerJ
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_HMAC
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_sha512
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_load_error_strings
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_aes_128_cbc
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_d2i_PublicKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DH_size
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_SESSION_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_read_bio_RSA_PUBKEY
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_check_private_key
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_set_ex_data
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-session-nonce
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: com.vmware.vim.propertyPath.error.notFound
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_CTX_set_cipher_list
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_STORE_CTX_trusted_stack
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_aes_256_ecb
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_AES_cbc_encrypt
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_RSA_public_decrypt
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_ASN1_INTEGER_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_CRL_free
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_d2i_PrivateKey
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_DES_set_odd_parity
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_verify_result
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @&!@@(msg.foundryErrMsgId.VIX_E_OP_NOT_SUPPORTED_ON_NON_VMWARE_VM)The command is supported only on VMware virtual machines
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_EVP_aes_128_ecb
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ex 2: vmware-vdiskmanager.exe -d myDisk.vmdk
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PANIC: %sd:/build/ob/bora-13861102/bora/lib/connect/cnx.c\\.\pipe\vmware-authdpipe%s: Returning false because CnxAuthdProtoConnect failed
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_X509_REQ_set_subject_name
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_d2i_X509
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Session's vmware_client : %1
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_new
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_get_privatekey
Source: svchost.exe, 00000012.00000002.3019156896.0000021EAE042000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ar&Prod_VMware_SATA_CD00#4&224f4
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: build-%05uSOFTWARE\VMware, Inc.\%sversionname%s:%d Buffer too small
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_MD5_Init
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-authd version (%s) does not match that of client (%u.%u)
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Reserved
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \\.\pipe\%s\%s.%dVMWARE%s-fdbora\lib\connect\cnxListen.cCnx: No username or IP address received from peer.
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_SSL_set_fd
Source: SrTasks.exe, 00000014.00000003.2752001905.0000016F5155C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WORKGROUPar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_BIO_f_base64
Source: starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware_PEM_ASN1_read_bio

Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	API call chain: ExitProcess graph end node
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Code function: 14_2_007EA0AC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

14_2_007EA0AC

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_00450994 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00450994

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Code function: 14_2_007F235D GetProcessHeap,RtlReAllocateHeap,

14_2_007F235D

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007EA0AC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_007EA0AC
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007E8A42 SetUnhandledExceptionFilter,	14_2_007E8A42
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Code function: 14_2_007E7EAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_007E7EAA
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A9A0AC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00A9A0AC
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A98A42 SetUnhandledExceptionFilter,	26_2_00A98A42
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 26_2_00A97EAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00A97EAA
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 27_2_6C6CB88C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	27_2_6C6CB88C
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Code function: 27_2_6C6CC9C1 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_6C6CC9C1
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DD90B2 SetUnhandledExceptionFilter,	28_2_00DD90B2
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DD851A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00DD851A
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Code function: 28_2_00DDA71C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00DDA71C

HIPS / PFW / Operating System Protection Evasion

Contains functionality to launch a program with higher privileges

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_0047974C ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_0047974C

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic OS get OSArchitecture	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr 64	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query vstor2-mntapi20-shared	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start vstor2-mntapi20-shared	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_0042F254 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexA,

1_2_0042F254

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_0042E4EC AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E4EC

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: GetLocaleInfoA,	0_2_0040565C
Source: C:\Users\user\Desktop\starwindconverter.exe	Code function: GetLocaleInfoA,	0_2_004056A8
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: GetLocaleInfoA,	1_2_004089B8
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Code function: GetLocaleInfoA,	1_2_00408A04

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png VolumeInformation
Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\logo.png VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_00458DC4 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_00458DC4

Source: C:\Users\user\Desktop\starwindconverter.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Code function: 1_2_00455D38 GetUserNameA,

1_2_00455D38

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Code function: 14_2_007F7D79 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

14_2_007F7D79

Source: C:\Users\user\Desktop\starwindconverter.exe

Code function: 0_2_00404654 GetModuleHandleA,GetVersion,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetProcessDEPPolicy,

0_2_00404654

Source: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	5 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	33 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	33 Windows Service	1 File Deletion	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	33 Masquerading	LSA Secrets	37 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	41 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	3 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
starwindconverter.exe	0%	ReversingLabs
starwindconverter.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_ConverterConsole.exe (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_ConverterConsole.exe (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-auth.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-auth.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-cal.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-cal.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-common.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-common.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-compression.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-compression.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-event-stream.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-event-stream.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-http.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-http.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-io.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-io.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-mqtt.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-mqtt.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-s3.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-s3.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-sdkutils.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-sdkutils.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-checksums.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-checksums.dll (copy)	2%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-core.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-core.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-ec2.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-ec2.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-iam.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-iam.dll (copy)	0%	Virustotal	Browse
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-s3.dll (copy)	0%	ReversingLabs
C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-s3.dll (copy)	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.remobjects.com/psU	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
http://www.innosetup.com/	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.64.196	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGM-ar7EGIjAqkOFqfrWsUuYYc-cHY4mS2DMqZX8MiAbTgaXolWeyzV_Jwf75R-0hkajKDO7EEd0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGM-ar7EGIjDPDwLUDTsFOtyhKJAT5DyNT4-JYGy8AQvI_i61IsKnO-HCW4ZF9DcmjkgW5xqtABsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.vmware.com/0	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	false		high
https://www.starwindsoftware.com/v2v-help/	starwindconverter.tmp, 00000001.00000003.1733720466.0000000003280000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000002.2811419131.0000000000661000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2808958826.000000000065F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	false		high
http://wixtoolset.org/schemas/thmutil/2010	vc_redist.x64.130.exe, 0000000F.00000003.2658901479.00000000034A0000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.130.exe, 0000000F.00000003.2315287938.000000000148D000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000003.2701655658.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000002.3022940702.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp, vc_redist.x64.140.exe, 0000001D.00000003.2734949955.0000000002EDC000.00000004.00000800.00020000.00000000.sdmp, vc_redist.x64.140.exe, 0000001D.00000003.2737279519.0000000000B20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/V	is-VUIE8.tmp.1.dr	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	starwindconverter.exe	false		high
https://www.starwindsoftware.com/	starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2809369381.00000000005F3000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000002.2811349521.0000000000605000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000018.00000003.2693608492.0000023D4CCF3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.2693608492.0000023D4CD44000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.2693608492.0000023D4CD57000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000018.00000003.2693608492.0000023D4CD38000.00000004.00000800.00020000.00000000.sdmp	false		high
http://s3.amazonaws.com/doc/2006-03-01/	is-9PTPC.tmp.1.dr	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html.	is-VUIE8.tmp.1.dr	false		high
http://www.openssl.org/support/faq.html	is-VUIE8.tmp.1.dr	false		high
https://www.starwindsoftware.com/terms	starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/http://docs.oasis-open.org/wss:stringmustUnderstandxsi	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000018.00000003.2693608492.0000023D4CD6A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/Envelope	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	false		high
http://wixtoolset.org/schemas/thmutil/2010lureH	vc_redist.x64.130.exe, 0000000F.00000003.2658174562.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000002.3023884477.0000000003140000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	svchost.exe, 00000018.00000003.2693608492.0000023D4CD12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	false		high
https://www.starwindsoftware.com/download-free-tools	starwindconverter.tmp, 00000001.00000002.2811349521.0000000000605000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000018.00000003.2693608492.0000023D4CD12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.starwindsoftware.com//	starwindconverter.exe, 00000000.00000003.1731798053.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1733720466.0000000003280000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/HeaderBody	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.innosetup.com/	starwindconverter.tmp, starwindconverter.tmp, 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.starwindsoftware.com/:	starwindconverter.exe, 00000000.00000003.1731871484.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.2812692493.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2810139887.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.starwindsoftware.com/privacy-policy	starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	false	URL Reputation: safe	unknown
https://www.starwindsoftware.com/privacy-policy.	starwindconverter.tmp, 00000001.00000003.2809040291.0000000000610000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000002.2812251955.0000000003591000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	starwindconverter.exe	false		high
http://www.vmware.com/0/	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	false		high
http://crl.ver)	svchost.exe, 00000018.00000002.3027194417.0000023D4CA82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.starwindsoftware.com/starwind-nfr-license-users.	starwindconverter.tmp, 00000001.00000003.2257418551.00000000035AC000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1742998627.0000000000623000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2809040291.0000000000610000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/Body	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	false		high
http://docs.oasis-open.org/wss	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.starwindsoftware.com/lT	starwindconverter.tmp, 00000001.00000002.2811101281.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2809811649.00000000005BC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.starwindsoftware.com/v2v-help/2	starwindconverter.exe, 00000000.00000003.1731871484.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.2812692493.00000000020C1000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2810139887.00000000022B8000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://wixtoolset.org/schemas/thmutil/2010(	vc_redist.x64.130.exe, 0000000F.00000003.2658174562.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000002.3023884477.0000000003140000.00000004.00000800.00020000.00000000.sdmp, vc_redist.x64.140.exe, 0000001D.00000003.2734949955.0000000002EDC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.remobjects.com/psU	starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://www.starwindsoftware.com/starwind-nfr-license-users	starwindconverter.tmp, 00000001.00000003.1733811204.00000000022B8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000018.00000003.2693608492.0000023D4CD12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000006E77000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp, vstor2-mntapi20-shared.sys.6.dr, is-VUIE8.tmp.1.dr, is-728T9.tmp.1.dr	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=1647	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007744000.00000004.00001000.00020000.00000000.sdmp	false		high
http://wixtoolset.org/schemas/thmutil/2010and	vc_redist.x64.130.exe, 0000000F.00000003.2658174562.0000000003A7B000.00000004.00000800.00020000.00000000.sdmp, vcredist_x64.exe, 0000001B.00000002.3023884477.0000000003140000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	starwindconverter.exe, 00000000.00000003.1732467657.0000000002370000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.exe, 00000000.00000003.1732292101.0000000002470000.00000004.00001000.00020000.00000000.sdmp, starwindconverter.tmp, starwindconverter.tmp, 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://www.starwindsoftware.com/NT	starwindconverter.tmp, 00000001.00000002.2811101281.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, starwindconverter.tmp, 00000001.00000003.2809811649.00000000005BC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	starwindconverter.tmp, 00000001.00000003.2805000516.0000000007433000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.64.196	www.google.com	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432220
Start date and time:	2024-04-26 17:48:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	starwindconverter.exe
Detection:	CLEAN
Classification:	clean11.evad.winEXE@48/237@2/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 262 Number of non-executed functions: 210
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.211.108, 142.250.64.227, 142.250.217.174, 142.251.107.84, 34.104.35.123, 23.204.76.112
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:50:28	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce {050d4fc8-5d48-4b8f-8972-47c82c46020f} "C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" /burn.runonce
17:49:59	API Interceptor	1x Sleep call for process: WMIC.exe modified
17:50:26	API Interceptor	28x Sleep call for process: SrTasks.exe modified
17:50:37	API Interceptor	2x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse
	http://relevanteduofficelogin.relevantedu.xyz	Get hash	malicious	HTMLPhisher	Browse
	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	https://downloads.locklizard.com/SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTM3MzAwLCJtZXNzYWdlX2lkIjoiMGd5MGJnNjBqOTJwcmNuZjhhNHNxYWpwIzZjY2RmYjMyLWJiNzgtNGQwNC1hYWYwLTg3MjdkMTg4MjZlMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjczMzAwLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGhiYXJ0aGxvd0BzZWN1cnVzdGVjaG5vbG9naWVzLmNvbSZwYXRocz1hYm92ZSZsaW5rPUZheF9PdXRsb29rIiwiaW5kaXZpZHVhbF9pZCI6IjQ0NDY4NzI5YzA1N2Q5ZDJjYzNiYjZlOTc3NDg3MzUyIn0.AryFGbNWOut6hGg1x_WBQ4QL5QU_wggDk6q2PUj7rNI	Get hash	malicious	Captcha Phish	Browse
	https://srmcorp.tecuidoc.com/?PSZlk=ViP	Get hash	malicious	HTMLPhisher	Browse
	gq83mrprwy.exe	Get hash	malicious	Xmrig	Browse
	http://url9212.charteredarena.org/ls/click?upn=u001.kjyKVeM-2Fb1rGOGHOnr1jOBOY3L3JqbNTsl6-2FG2Q28FBbMvScULOdn5hj4fYmOT1gSvNV_eFFQU5nW4TX33oYM-2FvMZ4H4nrQnEbWOt7nYb46lhhradIe8kQ30nH41Yux5-2ByqjXVzNOeRGeH70TSwGBG-2FsCyfS-2BqFuy7r7yA-2BMVhshonhVyPepAGojJAWOStPfHQEXVhS9QapMz6-2FLiLkIDitr77rwl6cV3-2BOVbi0qMHcpubANPDna-2BAJRWKHhsn2J-2BHsm2h-2B1n0PvhIvECyeSGKW-2FdmoYnwMnfXv-2F0VHDQdAF4JyTklFAWOdWvqmq9QaL29M0Lqvm9PdkAaDucmiv1yWhzGJ-2FSlIlic4yMaUzKSM2tXbVKRT-2BcTJHrLGjV82z-2BxMi-2FPWDvS9vQSeDz0xjN0gvzYnMQqfZiJ7fdvgXYvIvcGvziknMmHkQ7sUHmtLIGr6gsv-2FI2qInnZxnaJ1Ow7w3sMmgc-2FLcAEaJe5QnWJ5qez1H3mc7J1f4VLI4PyjCxv7syUPC13rDkwMklRiABfKztYQ3n9LW3FeH4hgMGYJgJovBs-2FKlVUipIzO24iLrfZpg-2FS6-2Fvp-2BRnBXh4Gim5LY7NxdelnIZomgKJ8r1gxfM163jd5ekCcUFZcZJn8BUr-2FrBOq6vvyf5Ut44ln9oAHSsmy2ecvwUHxQ-2Bo0mJA2r9a8FeSV3APNVBZowUa1ZGpOSvbZRLc6uZxrFl3fSWY774fhm-2Fl3qG7s-2BRWj2lGIHB3NEqH1X520Diu5Le7soeKgWoeaLCSrT5v7lt-2B7XayjukGYP4Yz5jSqZD2gXDxl443sgS6brqBQ3LKHfRN7s2NZ-2F6nWblHw6-2BLG-2FTduGCq0lMfhnVz7mFWLyKhJHvoE3C2dN6qv1-2FpHnRcIGopoYVEdZ-2F182c7Ll7OsxlzgTKemGKriHFjxwOhwkIoHVdgcJWnLS8-3D	Get hash	malicious	Unknown	Browse
	https://runrun.it/share/form/0GZMCgHSxRh4PBOM	Get hash	malicious	HTMLPhisher	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTAxOTIyLCJtZXNzYWdlX2lkIjoiMGd4d3poYXc3czloeGZoZWNuNjNuYnFwIzg0YjRlN2VjLTdhZjUtNDU5Yi1hNTYxLWE1ZmVlMTE3NTllNiIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjM3OTIyLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGphbWVzLmZheUBjb3VudHluYXRpb25hbGJhbmsuY29tJnBhdGhzPWFib3ZlJmxpbms9RmF4X091dGxvb2siLCJpbmRpdmlkdWFsX2lkIjoiNDA4YWI4OGRlY2JmNDFjMjRhYTZhMDRlOWU1OWMzZDAifQ.i-tkK1Lnys-MM487ot1MrSYQb6ExLgZNRQbgsH8B2K0	Get hash	malicious	Captcha Phish	Browse	173.222.162.32 20.114.59.183
	http://relevanteduofficelogin.relevantedu.xyz	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32 20.114.59.183
	Settlement DOL 08262024 - Victoria Brignon - Reference #27224675-2722934.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32 20.114.59.183
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	173.222.162.32 20.114.59.183
	https://downloads.locklizard.com/SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	173.222.162.32 20.114.59.183
	https://cdp1.tracking.e360.salesforce.com/click?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0ZW5hbnRfaWQiOiJhMzYwL3Byb2QvNTBhMGYyODg2ZTg4NDA3Y2I1ODUwYmRjOWQwZGIxZTUiLCJjcmVhdGlvbl90aW1lIjoxNzE0MTM3MzAwLCJtZXNzYWdlX2lkIjoiMGd5MGJnNjBqOTJwcmNuZjhhNHNxYWpwIzZjY2RmYjMyLWJiNzgtNGQwNC1hYWYwLTg3MjdkMTg4MjZlMyIsImNoYW5uZWxfdHlwZSI6ImVtYWlsIiwiZXhwIjoxNzQ1NjczMzAwLCJyZWRpcmVjdF91cmwiOiJodHRwczovL3ZtbWVzc2FuZ2VyLnJkb2NtZ2xvYmFsLmNvbS9kb2NzL2luZGV4LnBocD9tYWlsPSUyMGhiYXJ0aGxvd0BzZWN1cnVzdGVjaG5vbG9naWVzLmNvbSZwYXRocz1hYm92ZSZsaW5rPUZheF9PdXRsb29rIiwiaW5kaXZpZHVhbF9pZCI6IjQ0NDY4NzI5YzA1N2Q5ZDJjYzNiYjZlOTc3NDg3MzUyIn0.AryFGbNWOut6hGg1x_WBQ4QL5QU_wggDk6q2PUj7rNI	Get hash	malicious	Captcha Phish	Browse	173.222.162.32 20.114.59.183
	https://srmcorp.tecuidoc.com/?PSZlk=ViP	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32 20.114.59.183
	gq83mrprwy.exe	Get hash	malicious	Xmrig	Browse	173.222.162.32 20.114.59.183
	https://runrun.it/share/form/0GZMCgHSxRh4PBOM	Get hash	malicious	HTMLPhisher	Browse	173.222.162.32 20.114.59.183
	Dragons Dogma 2 v1.0 Plus 36 Trainer.exe	Get hash	malicious	Unknown	Browse	173.222.162.32 20.114.59.183

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	14067
Entropy (8bit):	5.531538349937818
Encrypted:	false
SSDEEP:	192:xTJpMVUu+Rc7wyeidwAkIgwAkxr9E3cjM2npb4:xTXMVUu+RYBwBuO
MD5:	A43183828B3942CBE2BD7D984CF10FEA
SHA1:	3C89DEF28950D31150CF1ADC8C9F52DF98DA9D09
SHA-256:	52CBEE94AE46C7CF77FF7376D809158488E93D17DA318B913CABA3A92E475193
SHA-512:	9C1D74E176FBD0BFC0A563C9770B1BF989C2590F5499236109B7DB401968AABD043208AF38C06AA1CCB21DBDDBA35DD2D437CFD2E16CAF79E1A82C208F09DE44
Malicious:	false
Preview:	...@IXOS.@.....@P..X.@.....@.....@.....@.....@.....@......&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005..vc_runtimeMinimum_x64.msi.@.....@.R...@.....@........&.{FE26E34E-F44B-4B4D-A2C9-878D87759F44}.....@.....@.....@.....@.......@.....@.....@.......@....:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{BC1F4291-6F0A-38EB-984E-C2E555837FE1}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{E5B92048-5859-4AF1-AEAD-B97EBF00B087}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{570C624B-D57C-4CD1-9013-1B80C800093B}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{14E8634F-8AEA-4CD1-AC48-BEBFDA18523A}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{4C723A6F-9201-44D8-BE75-E08B5D104F85}&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}.@......&.{EFA0F8A1-F16D-4E44-8EE4-2CD86E1D12F4}&.{

C:\Config.Msi\64f25e.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	20517
Entropy (8bit):	5.349855918600526
Encrypted:	false
SSDEEP:	384:xRH4oM7QduPrfgoog5QAfCuS588U+LtutBlXDxMe:xRH4oM7QduPrfgoog5awZ7
MD5:	C4C9670241D92335DB9A69A302007320
SHA1:	8C78FF76A5E8FDF562E0D85B331D1F9E1C05F653
SHA-256:	A6F5762D99B9067E7EB8ECA37E926E6538044A7546E59F71CEC8468C5976EB38
SHA-512:	68AAC4B70E17390708B78E4FFCA067AC7A9FAE0AB251790D8076CBBF2BC06A4C44DA734932194809B124046181518B00A6E907DAE6ECE6CA36D4B331B5A8F7A4
Malicious:	false
Preview:	...@IXOS.@.....@P..X.@.....@.....@.....@.....@.....@......&.{929FBD26-9020-399B-9A7A-751D61F0B942}=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005..vc_runtimeAdditional_x64.msi.@.....@.R...@.....@........&.{0990E7AB-85D7-456A-B8F8-1E1E56A29571}.....@.....@.....@.....@.......@.....@.....@.......@....=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{191E6DE4-E7B2-3CE9-B48B-25D0FFF3D88E}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{E70078E7-D25B-421C-A415-0AB472053F72}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{7D2EA505-A879-4E71-8632-F3DE9B679CE6}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{1F74928D-AA17-468C-A7D7-6A730A8DB25B}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{ECA05A2B-D2CC-43F5-B3B4-6501C6C75D8B}&.{929FBD26-9020-399B-9A7A-751D61F0B942}.@......&.{ABE93925-6BF3-4948-90FF-1E4DF15

C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3885672
Entropy (8bit):	5.823039351707255
Encrypted:	false
SSDEEP:	49152:V79qC7KULWT6hsqEFRCbIPB72jl8ma/0G18:rdyQ3XIPB7n0G18
MD5:	836138B79F85B094D80DD61E03FEEB59
SHA1:	40B22993E4CDF7590D85F2DF959BCC9A422DA0EA
SHA-256:	6AF0B0BD8EDFBBDDF564500339F22AE33808FE721963E672D2D2CB8645B09D52
SHA-512:	480FEFC8C8ADD02C2F679D6F03E189419A4D3405F8B551B1AD385852D593A2D2B9513CEBFB4FBA19A3FC53D593847967824F2F011B14E3C0B0B653DB5EAC405E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......l..@(..(..(..!.1.<...5r.)........5l.)......+......&.................5i.4......+...... ..(....... ......v......)....].)..(.5.)......)..Rich(..........................PE..d.....Ke.........."...........#................@.............................p;.....j.;...`.........................................p.$..P..tQ&......0,.`......h.....:.hR....;..W...Q..p....................R..(...pQ...................C...........................text............................... ..`.rdata..8...........................@..@.data...0.....).......).............@....pdata..h.........................@..@.gfids..`.....,.......+.............@..@.tls......... ,.......+.............@....rsrc...`....0,.......+.............@..@.reloc...W....;..X....:.............@..B................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_ConverterConsole.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2548328
Entropy (8bit):	5.442027871227669
Encrypted:	false
SSDEEP:	24576:T8Iqd1MHso0umQ6YnraI1IfxRUCzyy+SSDooo5ywLRZfwxRaZ8jVzo:AI+MHso0uIjRUCzyyqok4RuKCVzo
MD5:	3D9B6EB811EA2D232C823172920936C0
SHA1:	2A152CAA232FC6FF8ACBCD08CA5B5A91096705DC
SHA-256:	CFDB23B9D809FDC6591203FEAAD2354B960FAECE7AE1356B6A93BBE191D72233
SHA-512:	B4FD496E2CF12562E49B9513DEC14D16E971D31D087B166723A6DFF1F0F3B01445FB3BD2B11F07FC266F1858B2C4ED12D12BCD47516ECA40F817FC5D2EFCAE9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......9S.%}2.v}2.v}2.vtJJvi2.v...v\|2.v.k.w.2.v...v\|2.v...vg2.vFl.w~2.vFl.ws2.vFl.wc2.vFl.w{2.v.i.w~2.v.l.wu2.v}2.v_:.v.N.wu2.v.l.w#2.v.l.w\|2.v.l&v\|2.v}2Nv\|2.v.l.w\|2.vRich}2.v........................PE..d.....Ke.........."......(...p.......H.........@..............................&.......'...`.........................................p7...P..\|...0...............D.....&.hR....&.........p.......................(... ................@..P............................text....&.......(.................. ..`.rdata..H....@.......,..............@..@.data... ....`.......>..............@....pdata..D...........................@..@.gfids..\...........................@..@.tls................................@....rsrc...............................@..@.reloc........&......r&.............@..B................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-auth.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	6.216328479198925
Encrypted:	false
SSDEEP:	3072:ueudEthhGFa6dRALpky5bUiExBD1Qg2NCxGc/ga5myWmfdAdQdDgNFgUTa9:uegEtV6vckaRExxya7lAd9b
MD5:	9F2B850F23980339817F4EEC4243CBAB
SHA1:	97D551F79F14AD9B9984497C95D31AE13DB65D7F
SHA-256:	DB6D32A1E93C812392EFD84FC02EE552B30B952540359A2051475481EF2C9A4E
SHA-512:	2701C5B546381E29D51B11CB8E30F411474EA578BFF08AB628182ABEC0F07F7F4CA73258BAAAC564101B21532FB2147781A6FD42AFAF29012134A7EB49A2369B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c6...X...X...X..z...X..~Y...X..~]...X..~\...X..~[...X..zY...X.5~Y...X...Y...X.5~\...X.5~X...X.5~....X.5~Z...X.Rich..X.................PE..d......d.........." ..."....."...........................................................`..........................................s...............................................V...............................T..@............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-cal.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.959529098108337
Encrypted:	false
SSDEEP:	768:adjqZW6lDIp2XlYRkZY2zVwEt3d5/xvJ4GeAd0IKkExQENjC0nS:qj4W8M2lzW6rZvJ4GeAd0I58QEA
MD5:	45E75A61F95883180FA044E09B1269B9
SHA1:	49C339A67C3503C946D0EFF0163FE136BB7D1334
SHA-256:	05A4924BBE86B4123AA5F131E4116DD323BDDF2F77B17D9DF3584F8044DDC292
SHA-512:	1F0873FDE7DC107E2F06E9D73AABFF143CFA7F6D7AD69BEB65A977AC253C382413BF8B139E030F6D4D40EA9E02A97C245570C6AD06FA8A202D196D59889187D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........afP..5P..5P..5Y..5R..5...4R..5...4\..5...4X..5...4S..5...4T..5...4S..5P..50..5...4[..5...4Q..5...5Q..5...4Q..5RichP..5................PE..d......d.........." ...".l...V.......o....................................................`.............................................4......x...............................0...................................P...@............................................text...xj.......l.................. ..`.rdata...<.......>...p..............@..@.data...X...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-common.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	186880
Entropy (8bit):	6.429069473349703
Encrypted:	false
SSDEEP:	3072:+2k5z2o5zvI/uDrZEnBsnKK3scLwYR2JjqMdJbtvuNcLjh9i9/sreIemw40r/HnQ:Tk55lD9Enqnx8M5IZcIelr/H/fw4
MD5:	31E9C9966991DBF97B259B05E5E46D32
SHA1:	85594FF23CC5CF71E9A419E54243EE5AF8A5060F
SHA-256:	AB4154A548B3DFDAD408F5672D9FF95D6E747A7178F044A6329A93E432148BB5
SHA-512:	BF7B4E2854515F57FC780FC80F753E5CAB286765E7F26D4564DF28B56570DAAC827438201D29D0BA815F9AF6087E12DDF5CAA572B0323C1C40BB5662E3F10AC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.. ... ... ...)...2...o.."...o......o..(...o..$...k..'... ...Z.............!.....}.!......!...Rich ...................PE..d......d.........." ...".....*......@........................................0............`..........................................P...V..H...................D%........... .......(.......................(..(....&..@............................................text...x........................... ..`.rdata..............................@..@.data...X...........................@....pdata..D%.......&..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-compression.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.223989056268979
Encrypted:	false
SSDEEP:	192:2stAcoV7QDVufQo6bQJbBPnwW6173lFJ7h5jrkVZcq76VR:2W1TDktl/E73rH8/OT
MD5:	76BF411AC16FA858BC60469BE822E2D4
SHA1:	03BB0574C01F3121F4DAF0655885508EB2DD8F08
SHA-256:	84D2A522452F1393BA4CBFB24121CC8CDD41B2F2CA844ADB76FB11266ADDCA22
SHA-512:	68D11E068F47104DD5C3166C46D12A5A681542A25D31BBA309DD87D1BB47607781A2E097383E7E5CC74F4F217798CAC38419682156DCA57BB124D2729EE46678
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8FE.V.E.V.E.V.L...G.V...W.G.V...S.I.V...R.M.V...U.A.V...W.G.V...W.F.V.E.W.u.V...R.F.V...V.D.V....D.V...T.D.V.RichE.V.........................PE..d......d.........." ...".....$......`.....................................................`.........................................P;......H=..d....p.......`..L...............@....5..............................p4..@............0..`............................text...(........................... ..`.rdata.......0....... ..............@..@.data...x....P.......4..............@....pdata..L....`.......6..............@..@.rsrc........p.......:..............@..@.reloc..@............<..............@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-event-stream.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	6.089365628669285
Encrypted:	false
SSDEEP:	1536:1k/1tGPOpWV9sfm/6t+/JKg/1pB1gg2hkwWerR:1K1tGGY56U/JKg/rTh3wWeF
MD5:	56898B2852019AA1F9EED4D84CC4B4B4
SHA1:	AC4D4B71D69A09F5FD3D1742E793E3A3AFB37D77
SHA-256:	A1EB919BCEF0E750C39051A09AB84BE8E23CF15D7DEF3E26EF7755F031008ED3
SHA-512:	6BD87DB4F4DAD4A15095A4F20848479F92323878DCC1A0608BBE3ACDF417C74DEC6248A152DC526EBB5C37B48F5D926FB2344D16480F1BE6E7D716A386BAB92B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..B..B..B.....B...C..B...G..B...F...B...A..B...C..B...C..B..C...B...F..B...B..B....B...@..B.Rich.B.........................PE..d......d.........." ..."............P.....................................................`.........................................0)..\|....<.......p.......`......................P...................................@...............X............................text............................... ..`.rdata..z{.......\|..................@..@.data........P.......2..............@....pdata.......`.......6..............@..@.rsrc........p.......D..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-http.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	339968
Entropy (8bit):	6.287213449929436
Encrypted:	false
SSDEEP:	6144:GvM3kZ9WXS1FzumW8dwHZceyXPcBkUPxSBE:v0Z9WCG7oPcBkUJSB
MD5:	06AEE761AB17632A93FC14A5A9A530AC
SHA1:	9CCF8BE499AE0A716B02A122D19E35F6AF28FE73
SHA-256:	67313E6ADD7BC17094DB2E1E35257D7005C4F8E69C4AE174B91EB67E3ECBCDC6
SHA-512:	504DA591BB7E6E2DDC9F5D5186AB559BC96559B29121A062DE7A523302702DF5A001E2C00D5ADF25C11FA5443B4A5DD27AAA4C9501E02B21F5CAA2652645417A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......dJ.5 +.f +.f +.f)Shf$+.foW.g"+.foW.g-+.foW.g(+.foW.g#+.fkS.g"+.f.W.g)+.f +.f.+.f.W.g;+.f.W.g!+.f.W.f!+.f.W.g!+.fRich +.f................PE..d......d.........." ..."............."....................................................`..............................................1..@........`....... ...6...........p..H....@...............................>..@............0..0............................text............................... ..`.rdata......0......."..............@..@.data....0.......&..................@....pdata...6... ...8..................@..@.rsrc........`.......(..............@..@.reloc..H....p.......*..............@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-io.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	271872
Entropy (8bit):	6.328490878904118
Encrypted:	false
SSDEEP:	6144:yviVGcFRwNMuIHNBNe5L3rUsMmO2hEIx7gV+Yg:yvixXwNMuADNoMmO2HW+
MD5:	3815366408208A5B43CF54BCD993FB86
SHA1:	5F4014604976DEAB06F359BFFE9677988D30C669
SHA-256:	5380442110FD16592756777CD97076FAD264EABC3C2FA4705BEC5C54B9373B94
SHA-512:	165436FA82AAE96A3CED442026F7EBB4AA886AB9638F285B4F7E2D4D75145DF13D15D81DA8FCE9C6D6AAC3077BF0CC0A4079836BC5B2CDB1E6F4C30373D1DB8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................E..................................>...........>.....>.....>.)....>.....Rich...........PE..d......d.........." ...".(...........,.......................................p............`.............................................2..T...,....P....... ..X ...........`..d....r.......................s..(....q..@............@...............................text...h'.......(.................. ..`.rdata..n....@.......,..............@..@.data....$....... ..................@....pdata..X ... ..."..................@..@.rsrc........P......................@..@.reloc..d....`......................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-mqtt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	6.353432602292633
Encrypted:	false
SSDEEP:	3072:waZiK7lzq9M45v2fNEV9ri7fORE8XOBnAEzBhbS8igLKtalyw8bp4eZZxNOI/2r4:liWlzq9M4GCVdi7fOREnnjLhlGe03
MD5:	59B1C80C2A7EA20AD15B64CA50D6D039
SHA1:	4B5681289759880956512EECDD3030B3BA16D2E0
SHA-256:	F26E2F7D218FBD6099B93E43DC2B98391EAC5B23F5C6D28D95F51393C1BCE33E
SHA-512:	0103A4D23144E892041C3F940B36D1177C1D7065E1D9B0A195A85DAD33F29287B274A57E4BAED0B682DB229345A271F482CB60F8E798EE70E109FB2B98DBDF7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,...h..Xh..Xh..Xa.MXl..X'..Yj..X'..Yd..X'..Y`..X'..Yl..X#..Yj..X...Yo..Xh..X...X...Y\|..X...Yi..X..!Xi..X...Yi..XRichh..X................PE..d......d.........." ...".P...........S....................................... ............`..........................................U...5..l....................#..................`).............................. (..@............`..x............................text....N.......P.................. ..`.rdata...C...`...D...T..............@..@.data...X...........................@....pdata...#.......$..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-s3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	6.15524483839377
Encrypted:	false
SSDEEP:	3072:lb+0swXXTlCBCDXqVEYhpiSr0aoGbhgK5CH473iM2mbc:rXXxeOG0aoGuMLbc
MD5:	03255D2402D0743708C5D03DEB985431
SHA1:	4520A065B96A05C131B942B7F48E143F0501F8F6
SHA-256:	5880FAB7BFDC9590643994A6133C833566ADAEA79B0162F7B8501535717B4F6C
SHA-512:	D5737F258A4EA52C040EB35C12B9A57085F0BE8ED0EB894612BF0D8C2E5DAB26A10DB610BBC11B4E595FFEE2175F00DDFFE5AB187A21C7D4BD6C017BDCA3F693
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^z\.?...?...?...G...?...C...?...C...?...C...?...C...?...G...?...C...?...?..,?...C...?...C...?...C...?...C...?..Rich.?..................PE..d......d.........." ...". ...........$.......................................P............`.........................................`...x!...........0.......................@......................................p...@............0...............................text...x........ .................. ..`.rdata..0....0.......$..............@..@.data...............................@....pdata..............................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-sdkutils.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.1654804126988685
Encrypted:	false
SSDEEP:	1536:Wp2E+0mNWrkwnycFFhaecSFnocJDXop9cVWLpdA1jxvEBcIAuXZY3i3y06t:OH4WrkwnycFFhakFnocJ7YcVWLpdgxMq
MD5:	31116C162092F4F825A6F8F35568FC44
SHA1:	3EFA8E72AF20461C7755E23E5BB65DBA155E3281
SHA-256:	64DDF2FF9F65806B656D775E21B6FDC3C171E79F0C556B761D50E7F4A4F1EF33
SHA-512:	0086B501AE6E54439CECC9B2EB0137B5075B02344EB609761717940378E218D2EC83A7E367DD2509182952C6D502D94B0345E41988EE36B0A15D8DFDCC566588
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ne..ne..ne......ne...d..ne...`..ne...a..ne...f..ne...d..ne.3.d..ne..nd.yne.3.a..ne.3.e..ne.3....ne.3.g..ne.Rich.ne.........PE..d......d.........." ...".....x............................................................`.............................................$...........`.......P...............p......P...................................@...............H............................text............................... ..`.rdata..j].......^..................@..@.data...h....@.....................@....pdata.......P......................@..@.rsrc........`.......8..............@..@.reloc.......p.......:..............@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-checksums.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45568
Entropy (8bit):	7.491828244313408
Encrypted:	false
SSDEEP:	768:Z/j3bn9muQoNKzqaNMo72jUUvJuVIwDwLjAZ94wBgsZPllcmmEVjFv:Fj3bn9mNos3Mi23n3Aj4wB5PAZEVjF
MD5:	FD7FE67686E12E742C07D75B765B431F
SHA1:	631E3DC792B8320296637094844026373E04745B
SHA-256:	BD2DF0F7531A647AA6A9EE7B8FAE65E19150D8E86043A47D481A843B33E53D84
SHA-512:	D6B89DB29AF6E867DD61D833E4A4066A6187B6B5AA069C766656BFB12A4DEAC83FDE6F2A4169AD3D5413E28CD038ED16590F2712FB5F957BF8F41158A392608E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 2%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CQ~..0.[.0.[.0.[.H.[.0.[HL.Z.0.[HL.Z.0.[HL.Z.0.[HL.Z.0.[LH.Z.0.[.L.Z.0.[.0.[%0.[.L.Z.0.[.L.Z.0.[.L.[.0.[.L.Z.0.[Rich.0.[................PE..d......d.........." ..."..................................................................`.....................................................d...............4...............0......................................@............0...............................text...X........................... ..`.rdata......0......................@..@.data...............................@....pdata..4...........................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1233408
Entropy (8bit):	6.416591440619714
Encrypted:	false
SSDEEP:	24576:I/jKqKczOChrhcg13WgLrghNHMpOqiqbkb+:ILrJyC7tmYp0qbkb
MD5:	F9CEF47585ADDD2347ACA547BC99D428
SHA1:	72CDBFA4E758E1245F4451FBB5B7B694EAE89EF5
SHA-256:	2B2D66AEE524F687C4181DC246693415DA74AF023453750CEB076F84051FE12F
SHA-512:	B1C3CFC23B44AF043FD5119F7B3A14AE69B62982DE04F59B303AE314196C46B4EA2E9531C172B325AAD744B8348B1ED7A9688E7AEF4D79A96BDDB84FB604749E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v....@...@...@...@...@..A...@..A...@..A...@..A...@E..A...@..A...@...@...@E..A...@E..A...@E..@...@E..A...@Rich...@........................PE..d.....d.........." ...".P................................................................`..........................................].....x................P.......................G.......................G..(....E..@............`..x............................text....N.......P.................. ..`.rdata..F....`.......T..............@..@.data...h....p.......Z..............@....pdata.......P.......,..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-ec2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12270592
Entropy (8bit):	6.437139345013139
Encrypted:	false
SSDEEP:	49152:qE9XETJJbyPIK5wN0zXtEpPc/ZcugGOgDM2C/of1KV3CqILFf0A9IhxnGOB6LbER:JEPm57SpEagYn7YRFL9qAsCSH24qL4D
MD5:	07DD5F46309CDDA9A9FA0E8E5AC96F9D
SHA1:	E880623F47A15D905030E939F2A9AEDBC9DAC8CF
SHA-256:	317ACA48C56E13BE8A5F159A01C35E4FC75C8C70EA4BEC46FA16FB781F8EF868
SHA-512:	7DF379C3DAF006FE600938E5A72399F0D9E1593CB2760523701A463A30CBD8CB6BAA16BE06E9B2F84931B74D0AB346FA9187E3A21ED2E31B77E390409ABBB472
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~.i@-.i@-.i@-...-.i@-..E,.i@-..D,.i@-..C,.i@-..A,.i@-..A,.i@-Z.A,.i@-.iA-.h@-Z.E,.i@-Z.@,.i@-Z..-.i@-Z.B,.i@-Rich.i@-........PE..d...h..d.........." ...".T..........pB....................................................`............................................P...0m.......`.......................p...%.....T...............................@............p..8............................text...&R.......T.................. ..`.rdata...S#..p...T#..X..............@..@.data..............................@....pdata...............T..............@..@.rsrc........`......................@..@.reloc...%...p...&..................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-iam.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1785856
Entropy (8bit):	6.393623015203453
Encrypted:	false
SSDEEP:	12288:hhqjPwhCMJzhzIwv/kp0HA+Rf7IqZQq1L2ld5FlgSiCqA6W4mKV1fw:hhqjPwkMJzhzIwv/kaA+ROpl3FJ6nC
MD5:	F21BEFD5874F82F12B54D00021BBA617
SHA1:	1F515447A66E8DCACBDAEE18C41C9B46ABBCBC98
SHA-256:	0D6AAC5BA9DA71B3BB1BFE577A47210A9634C3C783F7AD90F8F977979FC7A2AB
SHA-512:	3F81008080399508C3EAA554F9C73E3594A690E602466D666EDFD444C56734AB6B52BFCAE10B4A494C0D49C6CFEFF55BCF0C64DDDC510F60E695C6B6BC040B72
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.iq5j."5j."5j."<.."3j."z..##j."z..#=j."z..#6j."z..#3j."~..#7j."...#6j."5j."5k."...#4j."...#4j."..."4j."...#4j."Rich5j."................PE..d......d.........." ...".x...........K....................................................`..............................................".. ........ ...........e...........0...K...`..............................._..@............................................text...Lw.......x.................. ..`.rdata...j.......l...\|..............@..@.data...x...........................@....pdata...e.......f..................@..@.rsrc........ ......................@..@.reloc...K...0...L..................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-s3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2222592
Entropy (8bit):	6.461809373329875
Encrypted:	false
SSDEEP:	24576:nHYSS/ainDYZ0KEqnfxvwBnBpCMpsNhIkf:nS/ainVqnfxYdBpp6H
MD5:	AC23F6E583ED4C69DAC72CB2751961B9
SHA1:	117E7E88877E395F599398912B66D6FC5B8E971A
SHA-256:	643E4B25C84F19F4D7624E1105EF12D32D0A247FCE591B276B75626E557DC524
SHA-512:	0FA2E8DFEFF5CA3D4B1493D8DECF9716C52DEEEEF82B71E592AC08C064D5E9B874DB2B92249AD2E6FC186CE44211A3295FF090F277B28288F4234828AE1BDD18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........m...>...>...>...>...>..?...>..?...>..?...>..?...>..?...>\.?...>...>..>\.?...>\.?...>\.\|>...>\.?...>Rich...>........................PE..d......d.........." ..."............l........................................0"...........`.........................................p.......\.........!......`!...............!.\0..PV..T............................U..@............@...............................text....,.......................... ..`.rdata..v....@.......2..............@..@.data...(%...0 ....... .............@....pdata.......`!......6!.............@..@.rsrc.........!.......!.............@..@.reloc..\0....!..2....!.............@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-crt-cpp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	395264
Entropy (8bit):	6.350296695291604
Encrypted:	false
SSDEEP:	6144:+Y28RdMK9KL+bJoeKCq4UjHpkU17L3tFn2c5cVillDgkTgqYJm1wx/u:zgWqZD17hZTt
MD5:	7790304C8C91CEEA832AA32D2BC438D0
SHA1:	E0C4A673F69B09D727D3328E56801329E4190AC2
SHA-256:	FDFE180BFB84BA3B601B67AA1F7FE7D2AE3280305BEFF251EAA2D56AC7F33E08
SHA-512:	8FBDDAF3924EE7113C08F9B24D1D35CD581D694ED628D897ACD0A348729F5A9EBF3CB8F973B2E6FC6A98EFC0A7011D15703F4911B882D30B41E90B6ED1DDDA70
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................9...........9....9.....9.c.....9.....Rich....................PE..d.....d.........." ...".....:...............................................P............`..................................................o..h....0...........6...........@..X....#..............................."..@............................................text...n........................... ..`.rdata..............................@..@.data...(=.......6..................@....pdata...6.......8..................@..@.rsrc........0......................@..@.reloc..X....@......................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\cpprest140_2_9.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5978512
Entropy (8bit):	6.346201066436199
Encrypted:	false
SSDEEP:	49152:HLVwASO7GtlqH9frRS4itYBkN9q+rg2jGu6xo2boASEXiAgr7B6kvh967EIU6iwo:tdotY9NPXiAgr7Xh9AL+XJAs
MD5:	A530E50E751B1CCFDB82B5FC6BCB186B
SHA1:	A951126E3F5439AC071834F6D1BE264F539462DF
SHA-256:	C09995556796CADE0C2587F74A7AF4AAF5399673FE598296B5D19513FE7C32AE
SHA-512:	606EE63E126FAE7964ED5916DB46B73DEBADC99AA9F537C28EF8C70DF6AE660928F07430D102B4B1771D3A2B0681B5C24C6E8FDCFC1C3983D6E6B49B73723529
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........u.k..p8..p8..p8.l.8..p8.Mu9..p8.Os9..p8.Ot9..p8.Oq9..p8.Ou9..p8..p8..p8.Mt9[.p8Y.8..p8..q8j.p8VOy9..p8VOp9..p8VO.8..p8...8..p8VOr9..p8Rich..p8........................PE..d...t..W.........." ......8..."......3.......................................[.......\...`...........................................O.....<oP......@[......@W.......[......P[.Lv..0.B.T...................(.B.(.....B...............8.(............................text.....8.......8................. ..`.rdata........8.......8.............@..@.data....a....P.......P.............@....pdata.......@W.......V.............@..@.gfids..D.... [.......Z.............@..@.tls.........0[.......Z.............@....rsrc........@[.......Z.............@..@.reloc..Lv...P[..x....Z.............@..B........................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\gsoap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28697600
Entropy (8bit):	6.354624212232649
Encrypted:	false
SSDEEP:	98304:t/BxsH3Gqdyhz0NOJfo8DA6tOGamKIep44sT2VzTMwoSFRTBOx/cS3lWg:9Bo4hz0QJgc1EOj5STwVn
MD5:	9734111A7D74F04F71C6DBAAE0944428
SHA1:	FEE8A02C1E216761B5FD1A6EF995BD27B7B4D583
SHA-256:	50E80909FDE080AFF01989A69D16ABC45ED611A8430E164A036259C78BD48026
SHA-512:	80E2DFEDB4299375DFAE11CF878B5256CACCBD423000A090FE600D6F18439932DBAF6B4E1AF95FA412C649E63EDB8441DC662B44D38466C0A76A65073CFC62F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P...>...>...>.......>...=...>...:...>...?...>...;...>.q.....>.;.?...>...?.y.>.;.7...>.;.>...>.>.....>.;.<...>.Rich..>.........................PE..d...I.._.........." .....\|F..jo.....dvF......................................0............`.........................................`k.......B..@.... .......@...............0......`P..p............................P................F..............................text....{F......\|F................. ..`.rdata....Y...F...Y...F.............@..@.data........`.......F..............@....pdata.......@......................@..@.gfids..,..........................@..@.rsrc........ .....................@..@.reloc.......0.....................@..B........................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-043UQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	379904
Entropy (8bit):	6.458390738828522
Encrypted:	false
SSDEEP:	6144:XTnNFO2CBHrnYGfkVG1nmYFISJak0+odvA9WIrElWGbtcUu:BFOvBLnYGsVG17VhoReW
MD5:	A1A09E88E1C73FC17BE4C915C8722398
SHA1:	3EDBCE80457CBDAC9273337E43C6FF5F447A221F
SHA-256:	3A235DC6BF1D3522A26687969068DAC87FFD2C74FBBF6F7980CD71DAA05ED004
SHA-512:	62A6FE7C29ECF063E5758F30E0A0A61D11517B5B2EF8296086E9EFD39868DB967AA3ECD44AA45639E44141EEFFD7F2EFBBDFC5795AB9C006A02C2F1E4E51DF74
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`.j...j...j...c...x...%..m...%...b...%...n...%...p...%...l...!...h.......i...j...........o.......k......k.......k...Richj...........PE..d......d.........." ...".....4............................................... ............`.............................................D....]..,................0..............8...............................(.......@...............p............................text...$........................... ..`.rdata..$...........................@..@.data...@$...........v..............@....pdata...0.......2..................@..@.rsrc...............................@..@.reloc..8...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-0U75Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1233408
Entropy (8bit):	6.416591440619714
Encrypted:	false
SSDEEP:	24576:I/jKqKczOChrhcg13WgLrghNHMpOqiqbkb+:ILrJyC7tmYp0qbkb
MD5:	F9CEF47585ADDD2347ACA547BC99D428
SHA1:	72CDBFA4E758E1245F4451FBB5B7B694EAE89EF5
SHA-256:	2B2D66AEE524F687C4181DC246693415DA74AF023453750CEB076F84051FE12F
SHA-512:	B1C3CFC23B44AF043FD5119F7B3A14AE69B62982DE04F59B303AE314196C46B4EA2E9531C172B325AAD744B8348B1ED7A9688E7AEF4D79A96BDDB84FB604749E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v....@...@...@...@...@..A...@..A...@..A...@..A...@E..A...@..A...@...@...@E..A...@E..A...@E..@...@E..A...@Rich...@........................PE..d.....d.........." ...".P................................................................`..........................................].....x................P.......................G.......................G..(....E..@............`..x............................text....N.......P.................. ..`.rdata..F....`.......T..............@..@.data...h....p.......Z..............@....pdata.......P.......,..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-239NR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	6.216328479198925
Encrypted:	false
SSDEEP:	3072:ueudEthhGFa6dRALpky5bUiExBD1Qg2NCxGc/ga5myWmfdAdQdDgNFgUTa9:uegEtV6vckaRExxya7lAd9b
MD5:	9F2B850F23980339817F4EEC4243CBAB
SHA1:	97D551F79F14AD9B9984497C95D31AE13DB65D7F
SHA-256:	DB6D32A1E93C812392EFD84FC02EE552B30B952540359A2051475481EF2C9A4E
SHA-512:	2701C5B546381E29D51B11CB8E30F411474EA578BFF08AB628182ABEC0F07F7F4CA73258BAAAC564101B21532FB2147781A6FD42AFAF29012134A7EB49A2369B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c6...X...X...X..z...X..~Y...X..~]...X..~\...X..~[...X..zY...X.5~Y...X...Y...X.5~\...X.5~X...X.5~....X.5~Z...X.Rich..X.................PE..d......d.........." ..."....."...........................................................`..........................................s...............................................V...............................T..@............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-2T9SC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356352
Entropy (8bit):	6.107743954478696
Encrypted:	false
SSDEEP:	6144:b2/7q2juilqZVyeNrt48ZRCBjU7dugT2rMMRldPrbOiskGuQXEf9ZRsHhZclLnGP:6/7q2juilqZVyebhZRCBjU7dugsMMRlG
MD5:	FCE67ABB13F665DC7CD001C652832700
SHA1:	3FE83869B091F7E03E556D1F25F9F88941157332
SHA-256:	008E598A976F6EA0E8CFD3771E570CE6FD9701DD59E1E9A578AEE82EF0500723
SHA-512:	4116A61B161BF76B63F6F78B44C96E3CDAA8B00229E6A457316AD2195C471CC498754BEF92D10E6C80587791AE7592751E3D66F85D27D3F6A2814F0888E43EC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p...............ip......O.......L.......O.......O.......O......yO..........K...yO......yO......\|O......yO......Rich............PE..d.....)Y.........." ................T.....................................................`..............................................)..DD..........H....`..L)..................0...T...............................................@............................text............................... ..`.rdata..8...........................@..@.data...0....`.......>..............@....pdata..L)...`...*...0..............@..@.gfids...............Z..............@..@.rsrc...H............\..............@..@.reloc...............b..............@..B........................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-3DPGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	186880
Entropy (8bit):	6.429069473349703
Encrypted:	false
SSDEEP:	3072:+2k5z2o5zvI/uDrZEnBsnKK3scLwYR2JjqMdJbtvuNcLjh9i9/sreIemw40r/HnQ:Tk55lD9Enqnx8M5IZcIelr/H/fw4
MD5:	31E9C9966991DBF97B259B05E5E46D32
SHA1:	85594FF23CC5CF71E9A419E54243EE5AF8A5060F
SHA-256:	AB4154A548B3DFDAD408F5672D9FF95D6E747A7178F044A6329A93E432148BB5
SHA-512:	BF7B4E2854515F57FC780FC80F753E5CAB286765E7F26D4564DF28B56570DAAC827438201D29D0BA815F9AF6087E12DDF5CAA572B0323C1C40BB5662E3F10AC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d.. ... ... ...)...2...o.."...o......o..(...o..$...k..'... ...Z.............!.....}.!......!...Rich ...................PE..d......d.........." ...".....*......@........................................0............`..........................................P...V..H...................D%........... .......(.......................(..(....&..@............................................text...x........................... ..`.rdata..............................@..@.data...X...........................@....pdata..D%.......&..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-9PTPC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2222592
Entropy (8bit):	6.461809373329875
Encrypted:	false
SSDEEP:	24576:nHYSS/ainDYZ0KEqnfxvwBnBpCMpsNhIkf:nS/ainVqnfxYdBpp6H
MD5:	AC23F6E583ED4C69DAC72CB2751961B9
SHA1:	117E7E88877E395F599398912B66D6FC5B8E971A
SHA-256:	643E4B25C84F19F4D7624E1105EF12D32D0A247FCE591B276B75626E557DC524
SHA-512:	0FA2E8DFEFF5CA3D4B1493D8DECF9716C52DEEEEF82B71E592AC08C064D5E9B874DB2B92249AD2E6FC186CE44211A3295FF090F277B28288F4234828AE1BDD18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........m...>...>...>...>...>..?...>..?...>..?...>..?...>..?...>\.?...>...>..>\.?...>\.?...>\.\|>...>\.?...>Rich...>........................PE..d......d.........." ..."............l........................................0"...........`.........................................p.......\.........!......`!...............!.\0..PV..T............................U..@............@...............................text....,.......................... ..`.rdata..v....@.......2..............@..@.data...(%...0 ....... .............@....pdata.......`!......6!.............@..@.rsrc.........!.......!.............@..@.reloc..\0....!..2....!.............@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-C445H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3377608
Entropy (8bit):	6.121344735848943
Encrypted:	false
SSDEEP:	49152:fMCRmA81qe7NsppyIPiUgI/6+1txSPKR3S6MBl1gmb9r5cKxCAL0:f4Npdg
MD5:	5FAFA8455487A6B190AB6C1FCA3DF50F
SHA1:	85315F85AF40038B3C8BB47DCF42643D31062F4C
SHA-256:	AC0F5F2386E0E35EECB358FD2076560BB63FDCA982CD7B8415012FA32DE9DC86
SHA-512:	8765216F2E245E0C329EE76A2DA9082685C0A57DAB59E3C2B7242AF2D41B9E42B7850C943B3000D5331F77AA57DE01B3134DA7C0744C67D852C25726FFA7B5A2
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........5.cYT.0YT.0YT.0P,)0ST.0...1[T.0b..1ZT.0b..1RT.0b..1_T.0b..1OT.0..w0XT.0..q0WT.0...1ZT.0YT.0$U.0...1nT.0...1XT.0..E0XT.0YT-0XT.0...1XT.0RichYT.0........................PE..d....J.Z.........." .........Z.......?.......................................04.....f.3...`A........................................@.*.$,..d.,.@.....3.......1.t....l3.......3..^..@M .p...................HN .(....M ..............................................text............................... ..`.rdata..............................@..@.data...`I...`,......J,.............@....pdata..t.....1.......1.............@..@.tls..........3.......3.............@....rsrc.........3.......3.............@..@.reloc...^....3..`....3.............@..B................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-DMGAR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5978512
Entropy (8bit):	6.346201066436199
Encrypted:	false
SSDEEP:	49152:HLVwASO7GtlqH9frRS4itYBkN9q+rg2jGu6xo2boASEXiAgr7B6kvh967EIU6iwo:tdotY9NPXiAgr7Xh9AL+XJAs
MD5:	A530E50E751B1CCFDB82B5FC6BCB186B
SHA1:	A951126E3F5439AC071834F6D1BE264F539462DF
SHA-256:	C09995556796CADE0C2587F74A7AF4AAF5399673FE598296B5D19513FE7C32AE
SHA-512:	606EE63E126FAE7964ED5916DB46B73DEBADC99AA9F537C28EF8C70DF6AE660928F07430D102B4B1771D3A2B0681B5C24C6E8FDCFC1C3983D6E6B49B73723529
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........u.k..p8..p8..p8.l.8..p8.Mu9..p8.Os9..p8.Ot9..p8.Oq9..p8.Ou9..p8..p8..p8.Mt9[.p8Y.8..p8..q8j.p8VOy9..p8VOp9..p8VO.8..p8...8..p8VOr9..p8Rich..p8........................PE..d...t..W.........." ......8..."......3.......................................[.......\...`...........................................O.....<oP......@[......@W.......[......P[.Lv..0.B.T...................(.B.(.....B...............8.(............................text.....8.......8................. ..`.rdata........8.......8.............@..@.data....a....P.......P.............@....pdata.......@W.......V.............@..@.gfids..D.... [.......Z.............@..@.tls.........0[.......Z.............@....rsrc........@[.......Z.............@..@.reloc..Lv...P[..x....Z.............@..B........................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-DOD6O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3885672
Entropy (8bit):	5.823039351707255
Encrypted:	false
SSDEEP:	49152:V79qC7KULWT6hsqEFRCbIPB72jl8ma/0G18:rdyQ3XIPB7n0G18
MD5:	836138B79F85B094D80DD61E03FEEB59
SHA1:	40B22993E4CDF7590D85F2DF959BCC9A422DA0EA
SHA-256:	6AF0B0BD8EDFBBDDF564500339F22AE33808FE721963E672D2D2CB8645B09D52
SHA-512:	480FEFC8C8ADD02C2F679D6F03E189419A4D3405F8B551B1AD385852D593A2D2B9513CEBFB4FBA19A3FC53D593847967824F2F011B14E3C0B0B653DB5EAC405E
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......l..@(..(..(..!.1.<...5r.)........5l.)......+......&.................5i.4......+...... ..(....... ......v......)....].)..(.5.)......)..Rich(..........................PE..d.....Ke.........."...........#................@.............................p;.....j.;...`.........................................p.$..P..tQ&......0,.`......h.....:.hR....;..W...Q..p....................R..(...pQ...................C...........................text............................... ..`.rdata..8...........................@..@.data...0.....).......).............@....pdata..h.........................@..@.gfids..`.....,.......+.............@..@.tls......... ,.......+.............@....rsrc...`....0,.......+.............@..@.reloc...W....;..X....:.............@..B................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-HKUCL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250368
Entropy (8bit):	6.353432602292633
Encrypted:	false
SSDEEP:	3072:waZiK7lzq9M45v2fNEV9ri7fORE8XOBnAEzBhbS8igLKtalyw8bp4eZZxNOI/2r4:liWlzq9M4GCVdi7fOREnnjLhlGe03
MD5:	59B1C80C2A7EA20AD15B64CA50D6D039
SHA1:	4B5681289759880956512EECDD3030B3BA16D2E0
SHA-256:	F26E2F7D218FBD6099B93E43DC2B98391EAC5B23F5C6D28D95F51393C1BCE33E
SHA-512:	0103A4D23144E892041C3F940B36D1177C1D7065E1D9B0A195A85DAD33F29287B274A57E4BAED0B682DB229345A271F482CB60F8E798EE70E109FB2B98DBDF7A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,...h..Xh..Xh..Xa.MXl..X'..Yj..X'..Yd..X'..Y`..X'..Yl..X#..Yj..X...Yo..Xh..X...X...Y\|..X...Yi..X..!Xi..X...Yi..XRichh..X................PE..d......d.........." ...".P...........S....................................... ............`..........................................U...5..l....................#..................`).............................. (..@............`..x............................text....N.......P.................. ..`.rdata...C...`...D...T..............@..@.data...X...........................@....pdata...#.......$..................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-JNOSU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.1654804126988685
Encrypted:	false
SSDEEP:	1536:Wp2E+0mNWrkwnycFFhaecSFnocJDXop9cVWLpdA1jxvEBcIAuXZY3i3y06t:OH4WrkwnycFFhakFnocJ7YcVWLpdgxMq
MD5:	31116C162092F4F825A6F8F35568FC44
SHA1:	3EFA8E72AF20461C7755E23E5BB65DBA155E3281
SHA-256:	64DDF2FF9F65806B656D775E21B6FDC3C171E79F0C556B761D50E7F4A4F1EF33
SHA-512:	0086B501AE6E54439CECC9B2EB0137B5075B02344EB609761717940378E218D2EC83A7E367DD2509182952C6D502D94B0345E41988EE36B0A15D8DFDCC566588
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ne..ne..ne......ne...d..ne...`..ne...a..ne...f..ne...d..ne.3.d..ne..nd.yne.3.a..ne.3.e..ne.3....ne.3.g..ne.Rich.ne.........PE..d......d.........." ...".....x............................................................`.............................................$...........`.......P...............p......P...................................@...............H............................text............................... ..`.rdata..j].......^..................@..@.data...h....@.....................@....pdata.......P......................@..@.rsrc........`.......8..............@..@.reloc.......p.......:..............@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-JTGFU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1785856
Entropy (8bit):	6.393623015203453
Encrypted:	false
SSDEEP:	12288:hhqjPwhCMJzhzIwv/kp0HA+Rf7IqZQq1L2ld5FlgSiCqA6W4mKV1fw:hhqjPwkMJzhzIwv/kaA+ROpl3FJ6nC
MD5:	F21BEFD5874F82F12B54D00021BBA617
SHA1:	1F515447A66E8DCACBDAEE18C41C9B46ABBCBC98
SHA-256:	0D6AAC5BA9DA71B3BB1BFE577A47210A9634C3C783F7AD90F8F977979FC7A2AB
SHA-512:	3F81008080399508C3EAA554F9C73E3594A690E602466D666EDFD444C56734AB6B52BFCAE10B4A494C0D49C6CFEFF55BCF0C64DDDC510F60E695C6B6BC040B72
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.iq5j."5j."5j."<.."3j."z..##j."z..#=j."z..#6j."z..#3j."~..#7j."...#6j."5j."5k."...#4j."...#4j."..."4j."...#4j."Rich5j."................PE..d......d.........." ...".x...........K....................................................`..............................................".. ........ ...........e...........0...K...`..............................._..@............................................text...Lw.......x.................. ..`.rdata...j.......l...\|..............@..@.data...x...........................@....pdata...e.......f..................@..@.rsrc........ ......................@..@.reloc...K...0...L..................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-LA1DS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2548328
Entropy (8bit):	5.442027871227669
Encrypted:	false
SSDEEP:	24576:T8Iqd1MHso0umQ6YnraI1IfxRUCzyy+SSDooo5ywLRZfwxRaZ8jVzo:AI+MHso0uIjRUCzyyqok4RuKCVzo
MD5:	3D9B6EB811EA2D232C823172920936C0
SHA1:	2A152CAA232FC6FF8ACBCD08CA5B5A91096705DC
SHA-256:	CFDB23B9D809FDC6591203FEAAD2354B960FAECE7AE1356B6A93BBE191D72233
SHA-512:	B4FD496E2CF12562E49B9513DEC14D16E971D31D087B166723A6DFF1F0F3B01445FB3BD2B11F07FC266F1858B2C4ED12D12BCD47516ECA40F817FC5D2EFCAE9D
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......9S.%}2.v}2.v}2.vtJJvi2.v...v\|2.v.k.w.2.v...v\|2.v...vg2.vFl.w~2.vFl.ws2.vFl.wc2.vFl.w{2.v.i.w~2.v.l.wu2.v}2.v_:.v.N.wu2.v.l.w#2.v.l.w\|2.v.l&v\|2.v}2Nv\|2.v.l.w\|2.vRich}2.v........................PE..d.....Ke.........."......(...p.......H.........@..............................&.......'...`.........................................p7...P..\|...0...............D.....&.hR....&.........p.......................(... ................@..P............................text....&.......(.................. ..`.rdata..H....@.......,..............@..@.data... ....`.......>..............@....pdata..D...........................@..@.gfids..\...........................@..@.tls................................@....rsrc...............................@..@.reloc........&......r&.............@..B................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-NDNT1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28697600
Entropy (8bit):	6.354624212232649
Encrypted:	false
SSDEEP:	98304:t/BxsH3Gqdyhz0NOJfo8DA6tOGamKIep44sT2VzTMwoSFRTBOx/cS3lWg:9Bo4hz0QJgc1EOj5STwVn
MD5:	9734111A7D74F04F71C6DBAAE0944428
SHA1:	FEE8A02C1E216761B5FD1A6EF995BD27B7B4D583
SHA-256:	50E80909FDE080AFF01989A69D16ABC45ED611A8430E164A036259C78BD48026
SHA-512:	80E2DFEDB4299375DFAE11CF878B5256CACCBD423000A090FE600D6F18439932DBAF6B4E1AF95FA412C649E63EDB8441DC662B44D38466C0A76A65073CFC62F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P...>...>...>.......>...=...>...:...>...?...>...;...>.q.....>.;.?...>...?.y.>.;.7...>.;.>...>.>.....>.;.<...>.Rich..>.........................PE..d...I.._.........." .....\|F..jo.....dvF......................................0............`.........................................`k.......B..@.... .......@...............0......`P..p............................P................F..............................text....{F......\|F................. ..`.rdata....Y...F...Y...F.............@..@.data........`.......F..............@....pdata.......@......................@..@.gfids..,..........................@..@.rsrc........ .....................@..@.reloc.......0.....................@..B........................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-NJRVA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12270592
Entropy (8bit):	6.437139345013139
Encrypted:	false
SSDEEP:	49152:qE9XETJJbyPIK5wN0zXtEpPc/ZcugGOgDM2C/of1KV3CqILFf0A9IhxnGOB6LbER:JEPm57SpEagYn7YRFL9qAsCSH24qL4D
MD5:	07DD5F46309CDDA9A9FA0E8E5AC96F9D
SHA1:	E880623F47A15D905030E939F2A9AEDBC9DAC8CF
SHA-256:	317ACA48C56E13BE8A5F159A01C35E4FC75C8C70EA4BEC46FA16FB781F8EF868
SHA-512:	7DF379C3DAF006FE600938E5A72399F0D9E1593CB2760523701A463A30CBD8CB6BAA16BE06E9B2F84931B74D0AB346FA9187E3A21ED2E31B77E390409ABBB472
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~.i@-.i@-.i@-...-.i@-..E,.i@-..D,.i@-..C,.i@-..A,.i@-..A,.i@-Z.A,.i@-.iA-.h@-Z.E,.i@-Z.@,.i@-Z..-.i@-Z.B,.i@-Rich.i@-........PE..d...h..d.........." ...".T..........pB....................................................`............................................P...0m.......`.......................p...%.....T...............................@............p..8............................text...&R.......T.................. ..`.rdata...S#..p...T#..X..............@..@.data..............................@....pdata...............T..............@..@.rsrc........`......................@..@.reloc...%...p...&..................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-OCF30.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	6.15524483839377
Encrypted:	false
SSDEEP:	3072:lb+0swXXTlCBCDXqVEYhpiSr0aoGbhgK5CH473iM2mbc:rXXxeOG0aoGuMLbc
MD5:	03255D2402D0743708C5D03DEB985431
SHA1:	4520A065B96A05C131B942B7F48E143F0501F8F6
SHA-256:	5880FAB7BFDC9590643994A6133C833566ADAEA79B0162F7B8501535717B4F6C
SHA-512:	D5737F258A4EA52C040EB35C12B9A57085F0BE8ED0EB894612BF0D8C2E5DAB26A10DB610BBC11B4E595FFEE2175F00DDFFE5AB187A21C7D4BD6C017BDCA3F693
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^z\.?...?...?...G...?...C...?...C...?...C...?...C...?...G...?...C...?...?..,?...C...?...C...?...C...?...C...?..Rich.?..................PE..d......d.........." ...". ...........$.......................................P............`.........................................`...x!...........0.......................@......................................p...@............0...............................text...x........ .................. ..`.rdata..0....0.......$..............@..@.data...............................@....pdata..............................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-OCNA5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1015912
Entropy (8bit):	5.6679566867305695
Encrypted:	false
SSDEEP:	24576:YMcMoi3rPR37dzHRA6G7WbuSEmK50PGyx9ZGc:YMrPR37dzHRA6GCbB80zh
MD5:	2356F5F81D797DFA2A9C35E973358693
SHA1:	EA1E81CFE3B0E8F4B09EEBCBF85593E501F4575F
SHA-256:	DCF16311954DBD5585DF660D65F049F5E2CA22303D99B3BAFBA872AE1790882A
SHA-512:	4C104E1A30F0A81C3E920264513B478A26B57F029E4E574C74BB5AC1931B9C1F62BBEB9BD3AEB6318EE17738ED74066BE9CA271A3564F87D3F30E21EB5417D92
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0............@......@...............................&.......T..............hR...@...............................0......................................................CODE............................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..P....@......................@..P.rsrc....T.......V..................@..P.....................r..............@..P........................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-PM8AC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49488
Entropy (8bit):	6.652691609629867
Encrypted:	false
SSDEEP:	768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
MD5:	BBA9680BC310D8D25E97B12463196C92
SHA1:	9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
SHA-256:	E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
SHA-512:	1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-QH72R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	339968
Entropy (8bit):	6.287213449929436
Encrypted:	false
SSDEEP:	6144:GvM3kZ9WXS1FzumW8dwHZceyXPcBkUPxSBE:v0Z9WCG7oPcBkUJSB
MD5:	06AEE761AB17632A93FC14A5A9A530AC
SHA1:	9CCF8BE499AE0A716B02A122D19E35F6AF28FE73
SHA-256:	67313E6ADD7BC17094DB2E1E35257D7005C4F8E69C4AE174B91EB67E3ECBCDC6
SHA-512:	504DA591BB7E6E2DDC9F5D5186AB559BC96559B29121A062DE7A523302702DF5A001E2C00D5ADF25C11FA5443B4A5DD27AAA4C9501E02B21F5CAA2652645417A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......dJ.5 +.f +.f +.f)Shf$+.foW.g"+.foW.g-+.foW.g(+.foW.g#+.fkS.g"+.f.W.g)+.f +.f.+.f.W.g;+.f.W.g!+.f.W.f!+.f.W.g!+.fRich +.f................PE..d......d.........." ..."............."....................................................`..............................................1..@........`....... ...6...........p..H....@...............................>..@............0..0............................text............................... ..`.rdata......0......."..............@..@.data....0.......&..................@....pdata...6... ...8..................@..@.rsrc........`.......(..............@..@.reloc..H....p.......*..............@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-QJJQG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1233408
Entropy (8bit):	6.416591440619714
Encrypted:	false
SSDEEP:	24576:I/jKqKczOChrhcg13WgLrghNHMpOqiqbkb+:ILrJyC7tmYp0qbkb
MD5:	F9CEF47585ADDD2347ACA547BC99D428
SHA1:	72CDBFA4E758E1245F4451FBB5B7B694EAE89EF5
SHA-256:	2B2D66AEE524F687C4181DC246693415DA74AF023453750CEB076F84051FE12F
SHA-512:	B1C3CFC23B44AF043FD5119F7B3A14AE69B62982DE04F59B303AE314196C46B4EA2E9531C172B325AAD744B8348B1ED7A9688E7AEF4D79A96BDDB84FB604749E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v....@...@...@...@...@..A...@..A...@..A...@..A...@E..A...@..A...@...@...@E..A...@E..A...@E..@...@E..A...@Rich...@........................PE..d.....d.........." ...".P................................................................`..........................................].....x................P.......................G.......................G..(....E..@............`..x............................text....N.......P.................. ..`.rdata..F....`.......T..............@..@.data...h....p.......Z..............@....pdata.......P.......,..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-QMAR7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	6.089365628669285
Encrypted:	false
SSDEEP:	1536:1k/1tGPOpWV9sfm/6t+/JKg/1pB1gg2hkwWerR:1K1tGGY56U/JKg/rTh3wWeF
MD5:	56898B2852019AA1F9EED4D84CC4B4B4
SHA1:	AC4D4B71D69A09F5FD3D1742E793E3A3AFB37D77
SHA-256:	A1EB919BCEF0E750C39051A09AB84BE8E23CF15D7DEF3E26EF7755F031008ED3
SHA-512:	6BD87DB4F4DAD4A15095A4F20848479F92323878DCC1A0608BBE3ACDF417C74DEC6248A152DC526EBB5C37B48F5D926FB2344D16480F1BE6E7D716A386BAB92B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..B..B..B.....B...C..B...G..B...F...B...A..B...C..B...C..B..C...B...F..B...B..B....B...@..B.Rich.B.........................PE..d......d.........." ..."............P.....................................................`.........................................0)..\|....<.......p.......`......................P...................................@...............X............................text............................... ..`.rdata..z{.......\|..................@..@.data........P.......2..............@....pdata.......`.......6..............@..@.rsrc........p.......D..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-QT18L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.223989056268979
Encrypted:	false
SSDEEP:	192:2stAcoV7QDVufQo6bQJbBPnwW6173lFJ7h5jrkVZcq76VR:2W1TDktl/E73rH8/OT
MD5:	76BF411AC16FA858BC60469BE822E2D4
SHA1:	03BB0574C01F3121F4DAF0655885508EB2DD8F08
SHA-256:	84D2A522452F1393BA4CBFB24121CC8CDD41B2F2CA844ADB76FB11266ADDCA22
SHA-512:	68D11E068F47104DD5C3166C46D12A5A681542A25D31BBA309DD87D1BB47607781A2E097383E7E5CC74F4F217798CAC38419682156DCA57BB124D2729EE46678
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8FE.V.E.V.E.V.L...G.V...W.G.V...S.I.V...R.M.V...U.A.V...W.G.V...W.F.V.E.W.u.V...R.F.V...V.D.V....D.V...T.D.V.RichE.V.........................PE..d......d.........." ...".....$......`.....................................................`.........................................P;......H=..d....p.......`..L...............@....5..............................p4..@............0..`............................text...(........................... ..`.rdata.......0....... ..............@..@.data...x....P.......4..............@....pdata..L....`.......6..............@..@.rsrc........p.......:..............@..@.reloc..@............<..............@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-QVHTU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	271872
Entropy (8bit):	6.328490878904118
Encrypted:	false
SSDEEP:	6144:yviVGcFRwNMuIHNBNe5L3rUsMmO2hEIx7gV+Yg:yvixXwNMuADNoMmO2HW+
MD5:	3815366408208A5B43CF54BCD993FB86
SHA1:	5F4014604976DEAB06F359BFFE9677988D30C669
SHA-256:	5380442110FD16592756777CD97076FAD264EABC3C2FA4705BEC5C54B9373B94
SHA-512:	165436FA82AAE96A3CED442026F7EBB4AA886AB9638F285B4F7E2D4D75145DF13D15D81DA8FCE9C6D6AAC3077BF0CC0A4079836BC5B2CDB1E6F4C30373D1DB8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................E..................................>...........>.....>.....>.)....>.....Rich...........PE..d......d.........." ...".(...........,.......................................p............`.............................................2..T...,....P....... ..X ...........`..d....r.......................s..(....q..@............@...............................text...h'.......(.................. ..`.rdata..n....@.......,..............@..@.data....$....... ..................@....pdata..X ... ..."..................@..@.rsrc........P......................@..@.reloc..d....`......................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-RRJPS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2131968
Entropy (8bit):	6.734796832087349
Encrypted:	false
SSDEEP:	49152:gUTy752bBkYa4f63T06hQcOhC9ntLjM7bPDIU6iJ8qMXPw2YKb9q:gCta7jQyL4M++qMY2YKb
MD5:	F1752EA7859AF8404606C914F29B9017
SHA1:	A7F19BD859F6F6E17C8EFCBDE0872AA4C641D1B8
SHA-256:	B9912AC316C268EC9B79DE03BCBC28DEBD0192558071EFA4F56145F0B33BA25D
SHA-512:	831D1AB5ED8462023D54F4F3E476FF01C314983C42DEC05173D53DB6340F12F5572422856C9BD2A6E37FF04AA5445474FE31411EAC8C8BD5395513068724C431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............D...D...D.HD...D...E...D...E...D...E...D...E...D...E...D...Do..DS..E...D...D...DV..E...DV..E...DS.$D...DV..E...DRich...D........PE..d.....)Y.........." .........>............................................... !...........`.........................................0........n..\|..... .H....`..d@............ ..G......T............................................................................text...#........................... ..`.rdata..0...........................@..@.data................h..............@....pdata..d@...`...B..................@..@.gfids........ ......8 .............@..@.rsrc...H..... ......: .............@..@.reloc...G.... ..H...@ .............@..B................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-SRQKS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	395264
Entropy (8bit):	6.350296695291604
Encrypted:	false
SSDEEP:	6144:+Y28RdMK9KL+bJoeKCq4UjHpkU17L3tFn2c5cVillDgkTgqYJm1wx/u:zgWqZD17hZTt
MD5:	7790304C8C91CEEA832AA32D2BC438D0
SHA1:	E0C4A673F69B09D727D3328E56801329E4190AC2
SHA-256:	FDFE180BFB84BA3B601B67AA1F7FE7D2AE3280305BEFF251EAA2D56AC7F33E08
SHA-512:	8FBDDAF3924EE7113C08F9B24D1D35CD581D694ED628D897ACD0A348729F5A9EBF3CB8F973B2E6FC6A98EFC0A7011D15703F4911B882D30B41E90B6ED1DDDA70
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................9...........9....9.....9.c.....9.....Rich....................PE..d.....d.........." ...".....:...............................................P............`..................................................o..h....0...........6...........@..X....#..............................."..@............................................text...n........................... ..`.rdata..............................@..@.data...(=.......6..................@....pdata...6.......8..................@..@.rsrc........0......................@..@.reloc..X....@......................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-UHSSF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.959529098108337
Encrypted:	false
SSDEEP:	768:adjqZW6lDIp2XlYRkZY2zVwEt3d5/xvJ4GeAd0IKkExQENjC0nS:qj4W8M2lzW6rZvJ4GeAd0I58QEA
MD5:	45E75A61F95883180FA044E09B1269B9
SHA1:	49C339A67C3503C946D0EFF0163FE136BB7D1334
SHA-256:	05A4924BBE86B4123AA5F131E4116DD323BDDF2F77B17D9DF3584F8044DDC292
SHA-512:	1F0873FDE7DC107E2F06E9D73AABFF143CFA7F6D7AD69BEB65A977AC253C382413BF8B139E030F6D4D40EA9E02A97C245570C6AD06FA8A202D196D59889187D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........afP..5P..5P..5Y..5R..5...4R..5...4\..5...4X..5...4S..5...4T..5...4S..5P..50..5...4[..5...4Q..5...5Q..5...4Q..5RichP..5................PE..d......d.........." ...".l...V.......o....................................................`.............................................4......x...............................0...................................P...@............................................text...xj.......l.................. ..`.rdata...<.......>...p..............@..@.data...X...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\is-VPH09.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45568
Entropy (8bit):	7.491828244313408
Encrypted:	false
SSDEEP:	768:Z/j3bn9muQoNKzqaNMo72jUUvJuVIwDwLjAZ94wBgsZPllcmmEVjFv:Fj3bn9mNos3Mi23n3Aj4wB5PAZEVjF
MD5:	FD7FE67686E12E742C07D75B765B431F
SHA1:	631E3DC792B8320296637094844026373E04745B
SHA-256:	BD2DF0F7531A647AA6A9EE7B8FAE65E19150D8E86043A47D481A843B33E53D84
SHA-512:	D6B89DB29AF6E867DD61D833E4A4066A6187B6B5AA069C766656BFB12A4DEAC83FDE6F2A4169AD3D5413E28CD038ED16590F2712FB5F957BF8F41158A392608E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CQ~..0.[.0.[.0.[.H.[.0.[HL.Z.0.[HL.Z.0.[HL.Z.0.[HL.Z.0.[LH.Z.0.[.L.Z.0.[.0.[%0.[.L.Z.0.[.L.Z.0.[.L.[.0.[.L.Z.0.[Rich.0.[................PE..d......d.........." ..."..................................................................`.....................................................d...............4...............0......................................@............0...............................text...X........................... ..`.rdata......0......................@..@.data...............................@....pdata..4...........................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-FDG2J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2289
Entropy (8bit):	5.481539720414515
Encrypted:	false
SSDEEP:	48:NpLNFED0OMJhgZES3SzZ52nCaSzZ52nCAaQypr8zpF2kuPD:zNFYUhggVFSzoL
MD5:	739172938112F98171BBFEB1BD8124B5
SHA1:	4F4DB9F9EC9C8C3CE1BC42DB9B3506D242E16AFD
SHA-256:	64714DA4D622E8EE470FDC0A42B2AAC214F0B181F934DC25988AC652EA084DD8
SHA-512:	E9112F4D9D152573E75866F91F04164AEC88ADF683CE8BE9942FC71A49EC430D11245B5610841703D6F45A607C61FBAD927A2D7F2A53B5314CA7B4EA60C39CFF
Malicious:	false
Preview:	;/++..;..;Copyright 2008-2017 VMware, Inc. All rights reserved...;..;Module Name:..;..; VSTOR2.INF..;..;Abstract:..; INF file for installing virtual storage..;..;--/....[Version]..Signature = "$Windows NT$"..Class = System..ClassGuid = {4D36E97D-E325-11CE-BFC1-08002BE10318}..Provider=%VMWARE%....DriverVer = 07/21/2017, 6.1.2..CatalogFile=vstor2.cat....;..; General installation section..;....[DefaultInstall.NTx86]..CopyFiles = vstor2.AddFile.NTx86....[DefaultInstall.NTamd64]..CopyFiles = vstor2.AddFile.NTamd64....[DestinationDirs]..DefaultDestDir = 12 ; DIRID_DRIVERS....[vstor2.AddFile.NTx86]..vstor2-x86.sys,vstor2-x86.sys,0x00000006 ; NOSKIP+NOVERSIONCHECK....[vstor2.AddFile.NTamd64]..vstor2-x64.sys,vstor2-x64.sys,0x00000006 ; NOSKIP+NOVERSIONCHECK....;..; Service installation section..;....[DefaultInstall.NTx86.Services]..AddService = vstor2-mntapi20-shared, 0x800, vstor2.Service.NTx86.Install ; SPSVCSINST_STARTSERVICE....[DefaultInstall.NTamd64.Services]..AddService =

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-HQLOK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	data
Category:	dropped
Size (bytes):	9069
Entropy (8bit):	7.101095943484762
Encrypted:	false
SSDEEP:	192:dYTsX4T8aTF2BEOwN5dlt4gRVdt6LJT+wa+3Ef5KYpBjSoJPrMlM:dyZNqwNjlthHS+x+3Ef5dpBjhJDYM
MD5:	1383A2EA422F1923FF325F104798C47E
SHA1:	B816BFAC00E4FD72340EB8AC1E1669AE129D0D34
SHA-256:	A7A591DACBDAB581AD3FEBAF506EC8F7DDF2B004131B9866B54C55056FE96B39
SHA-512:	D8E9356C1B4F699773877935D28F1A4BED1B83F2B0B0C179B895A905CAE1B162D766A8DBD419714C24B7B04552BFE87C9B121900D43D6D999E9FAC6EC39E7A2C
Malicious:	false
Preview:	0.#i..*.H........#Z0.#V...1.0...+......0..n..+.....7....._0..[0...+.....7.........c..E...@.S.M..170822121425Z0...+.....7.....0...0....R1.F.E.7.7.3.A.D.7.C.2.0.A.3.3.8.F.E.4.1.3.F.A.6.C.F.3.E.8.7.8.D.8.A.5.0.C.3.D.A...1..[0@..+.....7...1200...F.i.l.e........v.s.t.o.r.2.-.x.6.4...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........s.\| .8.A?..>...P..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0...0...0....R4.2.2.D.9.9.0.4.0.8.9.9.4.2.2.C.4.D.D.2.C.2.9.E.0.2.8.1.F.9.E.F.A.5.5.2.A.9.3.B...1..[0@..+.....7...1200...F.i.l.e........v.s.t.o.r.2.-.x.8.6...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........B-....B,M......R.;0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-M84MS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46312
Entropy (8bit):	7.014844672996383
Encrypted:	false
SSDEEP:	768:tX5sb+kBAkZ5JkRIOMvxnn23+zj4qA4dr:x56+KJw3Mvx22hAi
MD5:	0DA1FD316EC64BDCCDB2270F2DCF9B6A
SHA1:	424D8D812B8B470388732D7A297069A6A8E1E675
SHA-256:	C89A8C15430F4F6E02A71E74E1D0C803890F6B21D4EA2DF275000EAE801A17B4
SHA-512:	12204AB35A131E1B8745C932A756D127E5D8EDE0E31FDDB3C5B05052BFEFD197882800CD6766E9C69655584260E1B401A9EF6624D910C69142D87EFF98085D97
Malicious:	false
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................NW../9../9../9../8../9.( d../9.( 6../9..W.../9..W.../9..W.../9.Rich./9.................PE..L......Y.........."......@..........Ms.......P......................................c........................................s..<....................R...b...........P...............................................P...............................text....4.......6.................. ..h.rdata.......P.......<..............@..H.data...@....`.......>..............@...INIT.........p.......@..........

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-MRML8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38320
Entropy (8bit):	6.786073447859868
Encrypted:	false
SSDEEP:	768:xhugSWs0GilsRvMbrF9e3FnG/ywOuu/OKiyVFwp23+zjE:qgfsHc/qFGqwOx2KiyV50E
MD5:	701F6FB77B31ED04321108C264D04DE0
SHA1:	422B55BB76305C10D8D491F600EDDE6865F2E9E9
SHA-256:	ADE2410D00A9667B4003BB9ECFE7F64621151246F44CD3A55BF322BEE950181C
SHA-512:	95A87EC1D9918496E80CAC60CBE3B468089B190DB1B44569B39AD139CD4D61EB42E1D39B6651CADDA548589C2B12B31258BC09506C06C56AF97BA550701A0E25
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................J.....J...................J..........................Rich...........................PE..d...%.}X.........."......D.................................................................................................................d...(............p.......X...=..........`Q...............................................P..`............................text....<.......>.................. ..h.rdata.......P.......B..............@..H.data...H....`.......H..............@....pdata.......p.......J..............@..HINIT.................L.............. ....rsrc................R..............@..B.reloc...............V..............@..B................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\is-T4VT0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	52576
Entropy (8bit):	6.886955117724759
Encrypted:	false
SSDEEP:	768:4/tBNUe3xhW1ooAyvS/vKyRlOxln23+zj09qQc:4/t5xsoo/vS/CCAxA208Qc
MD5:	23A0B9F051625718C2A0EC9E28D384E8
SHA1:	D43DF67B9FBF29D0EAE802313CEA8D6C9EA71299
SHA-256:	F146FB6E882B809D913854D4926C8231065024DD7463832B868CC8F4606FA183
SHA-512:	84C764F1746E2B4E09C58AFDCEB0F1602DE1667F6AECE88D3C430C4DD4D79933BACE3DD47BE479A0E821215285956C50E9513CA75FE432374BAA70AB7DE66AB9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.<...R...R...R...S. .R.}>)...R.}>/...R......R.}>?...R......R......R......R.Rich..R.........PE..d......Y.........."......L.........................................................'...........................................................(....................j..`c..........`a...............................................`..`............................text....A.......B.................. ..h.rdata.......`.......F..............@..H.data...d....p.......R..............@....pdata...............T..............@..HINIT.................Z.............. ....rsrc................d..............@..B.reloc...............h..............@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2-mntapi20-shared.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38320
Entropy (8bit):	6.786073447859868
Encrypted:	false
SSDEEP:	768:xhugSWs0GilsRvMbrF9e3FnG/ywOuu/OKiyVFwp23+zjE:qgfsHc/qFGqwOx2KiyV50E
MD5:	701F6FB77B31ED04321108C264D04DE0
SHA1:	422B55BB76305C10D8D491F600EDDE6865F2E9E9
SHA-256:	ADE2410D00A9667B4003BB9ECFE7F64621151246F44CD3A55BF322BEE950181C
SHA-512:	95A87EC1D9918496E80CAC60CBE3B468089B190DB1B44569B39AD139CD4D61EB42E1D39B6651CADDA548589C2B12B31258BC09506C06C56AF97BA550701A0E25
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................J.....J...................J..........................Rich...........................PE..d...%.}X.........."......D.................................................................................................................d...(............p.......X...=..........`Q...............................................P..`............................text....<.......>.................. ..h.rdata.......P.......B..............@..H.data...H....`.......H..............@....pdata.......p.......J..............@..HINIT.................L.............. ....rsrc................R..............@..B.reloc...............V..............@..B................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2-x64.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	52576
Entropy (8bit):	6.886955117724759
Encrypted:	false
SSDEEP:	768:4/tBNUe3xhW1ooAyvS/vKyRlOxln23+zj09qQc:4/t5xsoo/vS/CCAxA208Qc
MD5:	23A0B9F051625718C2A0EC9E28D384E8
SHA1:	D43DF67B9FBF29D0EAE802313CEA8D6C9EA71299
SHA-256:	F146FB6E882B809D913854D4926C8231065024DD7463832B868CC8F4606FA183
SHA-512:	84C764F1746E2B4E09C58AFDCEB0F1602DE1667F6AECE88D3C430C4DD4D79933BACE3DD47BE479A0E821215285956C50E9513CA75FE432374BAA70AB7DE66AB9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.<...R...R...R...S. .R.}>)...R.}>/...R......R.}>?...R......R......R......R.Rich..R.........PE..d......Y.........."......L.........................................................'...........................................................(....................j..`c..........`a...............................................`..`............................text....A.......B.................. ..h.rdata.......`.......F..............@..H.data...d....p.......R..............@....pdata...............T..............@..HINIT.................Z.............. ....rsrc................d..............@..B.reloc...............h..............@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2-x86.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32 executable (native) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46312
Entropy (8bit):	7.014844672996383
Encrypted:	false
SSDEEP:	768:tX5sb+kBAkZ5JkRIOMvxnn23+zj4qA4dr:x56+KJw3Mvx22hAi
MD5:	0DA1FD316EC64BDCCDB2270F2DCF9B6A
SHA1:	424D8D812B8B470388732D7A297069A6A8E1E675
SHA-256:	C89A8C15430F4F6E02A71E74E1D0C803890F6B21D4EA2DF275000EAE801A17B4
SHA-512:	12204AB35A131E1B8745C932A756D127E5D8EDE0E31FDDB3C5B05052BFEFD197882800CD6766E9C69655584260E1B401A9EF6624D910C69142D87EFF98085D97
Malicious:	false
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$........................................................................................................................................................................................................................................................................................................................................................................................................NW../9../9../9../8../9.( d../9.( 6../9..W.../9..W.../9..W.../9.Rich./9.................PE..L......Y.........."......@..........Ms.......P......................................c........................................s..<....................R...b...........P...............................................P...............................text....4.......6.................. ..h.rdata.......P.......<..............@..H.data...@....`.......>..............@...INIT.........p.......@..........

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	data
Category:	dropped
Size (bytes):	9069
Entropy (8bit):	7.101095943484762
Encrypted:	false
SSDEEP:	192:dYTsX4T8aTF2BEOwN5dlt4gRVdt6LJT+wa+3Ef5KYpBjSoJPrMlM:dyZNqwNjlthHS+x+3Ef5dpBjhJDYM
MD5:	1383A2EA422F1923FF325F104798C47E
SHA1:	B816BFAC00E4FD72340EB8AC1E1669AE129D0D34
SHA-256:	A7A591DACBDAB581AD3FEBAF506EC8F7DDF2B004131B9866B54C55056FE96B39
SHA-512:	D8E9356C1B4F699773877935D28F1A4BED1B83F2B0B0C179B895A905CAE1B162D766A8DBD419714C24B7B04552BFE87C9B121900D43D6D999E9FAC6EC39E7A2C
Malicious:	false
Preview:	0.#i..*.H........#Z0.#V...1.0...+......0..n..+.....7....._0..[0...+.....7.........c..E...@.S.M..170822121425Z0...+.....7.....0...0....R1.F.E.7.7.3.A.D.7.C.2.0.A.3.3.8.F.E.4.1.3.F.A.6.C.F.3.E.8.7.8.D.8.A.5.0.C.3.D.A...1..[0@..+.....7...1200...F.i.l.e........v.s.t.o.r.2.-.x.6.4...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........s.\| .8.A?..>...P..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0...0...0....R4.2.2.D.9.9.0.4.0.8.9.9.4.2.2.C.4.D.D.2.C.2.9.E.0.2.8.1.F.9.E.F.A.5.5.2.A.9.3.B...1..[0@..+.....7...1200...F.i.l.e........v.s.t.o.r.2.-.x.8.6...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........B-....B,M......R.;0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0d..+.....7...1V0T...O.S.A.t.t.r.......>2.:.6...0.,.2.:.6...1.,.2.:.6...2.,.2.:.6...3.,.2.:.1.0

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\AMD64\vstor2.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2289
Entropy (8bit):	5.481539720414515
Encrypted:	false
SSDEEP:	48:NpLNFED0OMJhgZES3SzZ52nCaSzZ52nCAaQypr8zpF2kuPD:zNFYUhggVFSzoL
MD5:	739172938112F98171BBFEB1BD8124B5
SHA1:	4F4DB9F9EC9C8C3CE1BC42DB9B3506D242E16AFD
SHA-256:	64714DA4D622E8EE470FDC0A42B2AAC214F0B181F934DC25988AC652EA084DD8
SHA-512:	E9112F4D9D152573E75866F91F04164AEC88ADF683CE8BE9942FC71A49EC430D11245B5610841703D6F45A607C61FBAD927A2D7F2A53B5314CA7B4EA60C39CFF
Malicious:	false
Preview:	;/++..;..;Copyright 2008-2017 VMware, Inc. All rights reserved...;..;Module Name:..;..; VSTOR2.INF..;..;Abstract:..; INF file for installing virtual storage..;..;--/....[Version]..Signature = "$Windows NT$"..Class = System..ClassGuid = {4D36E97D-E325-11CE-BFC1-08002BE10318}..Provider=%VMWARE%....DriverVer = 07/21/2017, 6.1.2..CatalogFile=vstor2.cat....;..; General installation section..;....[DefaultInstall.NTx86]..CopyFiles = vstor2.AddFile.NTx86....[DefaultInstall.NTamd64]..CopyFiles = vstor2.AddFile.NTamd64....[DestinationDirs]..DefaultDestDir = 12 ; DIRID_DRIVERS....[vstor2.AddFile.NTx86]..vstor2-x86.sys,vstor2-x86.sys,0x00000006 ; NOSKIP+NOVERSIONCHECK....[vstor2.AddFile.NTamd64]..vstor2-x64.sys,vstor2-x64.sys,0x00000006 ; NOSKIP+NOVERSIONCHECK....;..; Service installation section..;....[DefaultInstall.NTx86.Services]..AddService = vstor2-mntapi20-shared, 0x800, vstor2.Service.NTx86.Install ; SPSVCSINST_STARTSERVICE....[DefaultInstall.NTamd64.Services]..AddService =

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\diskLibPlugin.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2779568
Entropy (8bit):	6.299455273724156
Encrypted:	false
SSDEEP:	49152:ky+5llbVloWoNIhnOrhwMIWxb4pk9UL9vGLNPF9G0xmh+HTF83HyTVoI7nnHohF9:IvoNIhnOrhwMIWxb4pgUL9vGLNPF9G0u
MD5:	379538551F26772D3736D50D79E2C483
SHA1:	AE830CA279F49AB239FE0ADD5E80AC6C3B6495B9
SHA-256:	C66E3D32AE39572E7C864DCA186FE51C9545CF24D4FFB54B322356CE6FDAB9A3
SHA-512:	67F8E591AE3ECB69996E76B798F3196C499C62F32813DBD8E43EFFD2A0004A23E01704E3AB94D4F1DD4BF48F42CE2BC2569243038B84781733D00BAD3DEEE1E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x.I.............V#......a2......a&..............a ......a1......a6......a'......a!......a$.....Rich....................PE..d....<.\.........." .....(...........................................................+...@.........................................`.%.....(2%.,....`.x....0(..,...,..=...p.HH...U...............................................@..p............................text...n'.......(.................. ..`.rdata...{...@...\|...,..............@..@.data... m....%.......%.............@....pdata...,...0(.......'.............@..@.rsrc...x....`.......).............@..@.reloc..,a...p..b....).............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\expat.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	169392
Entropy (8bit):	6.462137447467944
Encrypted:	false
SSDEEP:	3072:He6v49lD+gUPUyGwsNVg53sXXEOZERELEQQEsuOBEtEFEEOEImEpiWbINRa6LA83:+6v49x+gUPmJN4sUr7vXK6j
MD5:	EB31A5EC5B2A0325AED67B6B705DD136
SHA1:	3CEE985DD8F63E581F945E80B656955B2D5103C6
SHA-256:	CEAF6E1D805CF2E551FCAE530DC5FAC2A82A7DBDF9A99BA4DA9372C17DAE3F1D
SHA-512:	583583A0383390651229A806E3875AE5BD2D61E5EBF85DA6D18A29714857456844E3BAF50AB7735F9C6260D8F488A282DD151B4EEAE0F132C350E9F9D31986BF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...T..T..T.....T.....T.....T..U..T.....T.....T.....T.Rich..T.........................PE..d......\.........." ......................................................................@.........................................p9.......4..<............`..l....X...=......l....................................................................................text...a........................... ..`.rdata..Vb.......d..................@..@.data........P.......,..............@....pdata..l....`.......4..............@..@.rsrc................P..............@..@.reloc...............T..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\glib-2.0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1630640
Entropy (8bit):	6.09113558235971
Encrypted:	false
SSDEEP:	24576:hUEvdSrJjzGadjgiEz+8Qn3/0pjRPupxtQqSeZQ8cddiefdY2GMkmzbYwAan0EbL:XAVEb6aMGDlBABAeUVjT
MD5:	5B581BA9EA65D9A4DACE66140B022626
SHA1:	84A0F6A99C2589E2F8DF009F5B161E55B06A940D
SHA-256:	5B1F9E071163CC1194CAF640B056438F7966D1CD118FB065FFFA05187C9D316E
SHA-512:	5CFEE6B1BBA7C09BF433864E1E6EB8757BAA8A022F61EC764A6DD6E9AACA952195127EA03067D6F8CBB182BE5ED0E5317A71813C70B28BEE0B89C2BAADC4B036
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........E......[...............................................................Rich..........PE..d...M..X.........." ................4................................................a..................................................................H....@..lu.......=..............................................................p............................text...A........................... ..`.rdata..............................@..@.data................h..............@....pdata..lu...@...v..................@..@.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\gobject-2.0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	376752
Entropy (8bit):	6.179078996431783
Encrypted:	false
SSDEEP:	6144:0RTOnw+naqRSQg0MX2T5QSFlUiXU4Qed6ggphkszeobzDt16xFbzGMKG+KKc7MK7:cOaqRS5i5v/UiXU4Qed6ggphkszeev6X
MD5:	4BBEC9BA59E2176F3576C31ABAAC4458
SHA1:	8DBF8C5C04678AC9C46EF704DCE6843BC422BDDB
SHA-256:	FC8836DD656A855A0E17C7D4C04BEA7FAEF9BE8C1F91EB58054CF942BDB24F62
SHA-512:	BB9104C7FF36C2E6F268BEBF3164BD0391E709CDD98FC390B1BCAD7D4DC4F8F0EBFBA234A0C9EF91D023074CE350C323DF90915FA63622E0162B30ED794DB1CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&.w.G.$.G.$.G.$.?"$.G.$.?5$.G.$.G.$GG.$.?3$.G.$.?/$.G.$.?%$.G.$.?4$.G.$.?2$.G.$.?7$.G.$Rich.G.$................PE..d...Z..X.........." ............................................................................................................... ...<8......P.......0.......X).......=..............................................................h............................text............................... ..`.rdata..\~..........................@..@.data....S... ...D..................@....pdata..X).......*...J..............@..@.rsrc...0............t..............@..@.reloc..>............\|..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\gthread-2.0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25520
Entropy (8bit):	6.8005066659410724
Encrypted:	false
SSDEEP:	384:pJTCSjOG86KuQMnYPL5YUHeM6iOUUJp23+r/jLE:pJTBtjhOWiyJp23+zjo
MD5:	68FBCFBF30F1ECFAB5DE3F52612E7B22
SHA1:	75F9C294F24F36DA86C83CB3E7C10D86B783442B
SHA-256:	113D4978108C680F9624152D089401250AC92B0C2058FAB9C3BC2A1F80F38DC2
SHA-512:	8DDC7924F52D16A49735A4FB81002AF4D4439EED13D3FA368B16BB07684361ED2D0496A8A14A7B7B36ACB78E0D3E9E7248E9E55B0C1F00272E963D3223C2FC93
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e..!..!..!..(.8. ..(...+..(.).#..(.>.&..!.....(.$. ..(.?. ..(.9. ..(.<. ..Rich!..........................PE..d...P..X.........." ................4........................................p......\|:.............................................. '.......#..P....P.......@.......&...=...`......P!............................................... .. ............................text...1........................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..$....`.......$..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\gvmomi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5886384
Entropy (8bit):	6.393358756712777
Encrypted:	false
SSDEEP:	49152:VBvHtW/KzQYyZ7m+3lmvHggTm7kxy1K51hxW2SX3eMO6PkepqQHTUt40qgB+FY5B:VPmnRsxyBp0TXi8
MD5:	4401DD4759BFB0E1806833746867D3F1
SHA1:	1FFD2DA6C444819B5825ED9EB2482807B43C9562
SHA-256:	28CE330203A1BC10542EC5C7C3FB199019C31551C3EBFD9D133AA967946C4DCA
SHA-512:	346C70B632313DF98E74341554688CEE230F63CD102DCEBFD491990C37C7EA167656ABEBB1D700927C115A18BFE68723E741E4C897982877EFA8DC639D0755F7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+...J...J...J...2D..J..L.U..J...2P..J....P..J...J..H...2G..J...2V..J...2@.PJ...2Q..J...2W..J...2R..J..Rich.J..........PE..d....:.\.........." .....$@..l........<.......................................[.....VZ...@...........................................M....t.M......pZ......`U.......Y..=....Z..M...M@..............................................@@..............................text...:"@......$@................. ..`.rdata...M...@@..N...(@.............@..@.data...`.....R......vR.............@....pdata.......`U.......S.............@..@.rsrc........pZ.......Y.............@..@.reloc.......Z.......Y.............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\iconv.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1188784
Entropy (8bit):	6.573519479006201
Encrypted:	false
SSDEEP:	24576:gpwQfq4f9lQruaGavkg3NyukbbbYVlBAUZLYWs:gbjQruaGaXj3VlBAUZLYD
MD5:	9E74DACE34B9996BEF250228DD1ADB06
SHA1:	554B1195A0D9860AFA1272286661ED19EB2F8A9B
SHA-256:	54C751CF12000A206F45E31949235F435BE6A1EC5ED14AFA4125A19FD2EAF899
SHA-512:	3329CA6CDEFD685B9D4DEEC1A2F61DE71E009F1E30C240E08DC20DCF19FF6732C3F4BF5449C8B9A68CE02BE9740FA00159CD700A0F23DE58BDDABC71D08335C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................=.....,.....;...........+.....:.....<.....9....Rich...................PE..d....0.O.........." .........\.......[.......................................0.......1....@....................................................<.......D.......L........=... ......P................................................................................text............................... ..`.rdata... ......."..................@..@.data...............................@....pdata..............................@..@.idata..............................@....rsrc...D...........................@..@.reloc..-.... ......................@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\intl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122800
Entropy (8bit):	5.271898350192096
Encrypted:	false
SSDEEP:	1536:DZgqnWq881MDesj/fm5qyF7UBn6I6FM86iyp0zb:DZgqWtEMDesrsqy2X6i86iyp0H
MD5:	1C70B19148794BC9A244134D5E07ABA5
SHA1:	8928235A17213AF53AF2FC13D378670520CE70C0
SHA-256:	829660951C18672A5F382FFA9F6D8946B8B8423D3FD08EA55C0DE7AC024DD45A
SHA-512:	7E7104A4C58EAC4A4D3D21290854BE078DCADDF96EB15BACEB3454469C5BEE2AD4B8488A95D3EF9C97874EB0B75F52F72B124747F74B21376774169391E86D52
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ..PA..PA..PA....s.UA..Y9p.RA..Y9a.RA..Y9v.WA..PA...A..Y9f.tA..Y9w.QA..Y9q.QA..Y9t.QA..RichPA..................PE..d......S.........." .....N...P.......#....................................................@......................................... v..........P.......T................=..........Pe..............................................P................................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data................n..............@....pdata..$............~..............@..@.idata..1...........................@....rsrc...T...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-468L0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	526
Entropy (8bit):	4.815491547285112
Encrypted:	false
SSDEEP:	12:8Nxyuy4EWvnTtjR1j1OHTeVp2Z8NMXCzvqtqEZ3y0iNMXH8Vt:JuXEsnpj1OQGbWaqahX8Vt
MD5:	EDFFA9AECCAF2C5CFD8E4514EB51C26B
SHA1:	5FE4A8ECDA066632DD7906506875D31EF62AC67B
SHA-256:	96D999AF380096FBFAB339C3EF98C42A3FD37C3D1A30F96E9B77DF8FC6D43E62
SHA-512:	2D4E8AF91A413ACDF528C89E4374298C7DFBB2AB79E190800A72CDDB626C4A373BF338B2A3DB3931232AE1D9A40BCC30FD929842B6744580512EE31E16BD193B
Malicious:	false
Preview:	@echo off..rem This batch file uninstalls the vstor2-mntapi20-shared service...rem..rem Check the system type..rem..rem Check if the service is installed..rem..set VSTOR=vstor2-mntapi20-shared..sc query %VSTOR% > nul..if errorlevel 1 (.. echo "Service not found. Quitting".. exit /b 1..)..rem..rem The service is installed, remove it...rem..echo "Service exists, removing it."..sc stop %VSTOR% > nul..sc delete %VSTOR%..del /f %SystemRoot%\System32\drivers\%VSTOR%.sys..rem The service should be cleaned up...exit /b 0..

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-4G0NR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3215792
Entropy (8bit):	6.176453520799816
Encrypted:	false
SSDEEP:	49152:8xAMv72IqK0uvl09JAdF2fAiucXBCJ4GpObZ+k:8xAs8YUGpObZ3
MD5:	FCAEF218015A274463586201312E3911
SHA1:	8DE6125AE1E241D74E2D0C6FFDAFB083A2080AE4
SHA-256:	19630880389BA6697534FCD389B515073D3A62312905CA8543941F437ABBC2B7
SHA-512:	A80A5755F5BB59133DF9036409C80570FF9A86ABF4999824E108EEFC86C02C449CC189CAF6FBFAE8FEC48929AF93709EA58F5CF0C5E78E3BB91C41F632118405
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}].G9<..9<..9<...s..;<..0D..8<..0D..6<..9<...=..0D..*<..0D..A<..0D..8<..0D..8<..0D..8<..Rich9<..........PE..d...\8.\.........." .....Z...v.......m.......................................p1......01...@...........................................(..\...d(.......0. ....`-..p....0..=....1..F............................ .(....................p...............................text....Z.......Z.................. ..`.rdata.......p.......^..............@..@.data........`,......@,.............@....pdata...p...`-..r....,.............@..@.tls..........0......h0.............@....rsrc... .....0......j0.............@..@.reloc...c....1..d...p0.............@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6QBCJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	380848
Entropy (8bit):	6.195304778802536
Encrypted:	false
SSDEEP:	6144:i//wzjZDszT767kgMkLTwrFv5XdE3GHjbJVlPTQvrAwiWIs+KdW2n90flc7PZcH2:i/I3ZDen67IaTiFv5NE3GHjbJPTOrAwj
MD5:	159457ACC759B2DF40C2BF193ED9E8AA
SHA1:	79A1F3B58D20485B7C66F70D715C008599F1B129
SHA-256:	06BF65DCD5BC6ED8BEC9ABFEEFD150DC0CD907192F1ECA36DDF7A3A30713391B
SHA-512:	3CFC77C375E6F0DA8F3D7FF8AFB229E7F6B983DBBC92A3B7E23D07612336DB9F3C52C2FC0695E9B5406F7ADF7CCB6C7635CBDA851C92AE1C91FED02AA96CA481
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:jOK[..K[..K[..B#..I[..B#..I[..B#..L[..K[...Z..B#..u[..B#..J[..U...J[..B#..J[..RichK[..........................PE..d...:.\.........." ................\|.....................................................@.........................................0H...)..07..P...............P(.......=..............................................................`............................text...1........................... ..`.rdata..............................@..@.data................Z..............@....pdata..P(.......*...N..............@..@.rsrc................x..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-6S65I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	169392
Entropy (8bit):	6.462137447467944
Encrypted:	false
SSDEEP:	3072:He6v49lD+gUPUyGwsNVg53sXXEOZERELEQQEsuOBEtEFEEOEImEpiWbINRa6LA83:+6v49x+gUPmJN4sUr7vXK6j
MD5:	EB31A5EC5B2A0325AED67B6B705DD136
SHA1:	3CEE985DD8F63E581F945E80B656955B2D5103C6
SHA-256:	CEAF6E1D805CF2E551FCAE530DC5FAC2A82A7DBDF9A99BA4DA9372C17DAE3F1D
SHA-512:	583583A0383390651229A806E3875AE5BD2D61E5EBF85DA6D18A29714857456844E3BAF50AB7735F9C6260D8F488A282DD151B4EEAE0F132C350E9F9D31986BF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...T..T..T.....T.....T.....T..U..T.....T.....T.....T.Rich..T.........................PE..d......\.........." ......................................................................@.........................................p9.......4..<............`..l....X...=......l....................................................................................text...a........................... ..`.rdata..Vb.......d..................@..@.data........P.......,..............@....pdata..l....`.......4..............@..@.rsrc................P..............@..@.reloc...............T..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-728T9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	412648
Entropy (8bit):	6.401609248265626
Encrypted:	false
SSDEEP:	6144:X1QPI4PDV0ERaUlbWAxBIfH7W6odcIA5cz5YKt:X1QPIWfdcIAKCK
MD5:	2300544F62EFF258F63695693F6E8E74
SHA1:	9A5D48BD447010B88E34353BF6BCC859BE0A31A6
SHA-256:	E8B6958CC9F45A36E3D303360B28E87DBEB5A43B644EE1ECEF2AB7ADF59DACA3
SHA-512:	D77FE37B8A61AE42C03069BC6314047DCFB5C58C9D74C89B8CB6CC58CDE3A0EEEDBC385968F549C8652539632AA102975D8868F76970E11BC06DDEFA42B19551
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........k...k...k.....k.....k.....k.....k.p-....k...j...k.......k.......k.......k.......k.......k.Rich..k.........PE..d......Y.........." .....x...................................................P............`.........................................P...........<....0...................=...@..X......8...........................p...p............................................text...{w.......x.................. ..`.rdata..^n.......p...\|..............@..@.data...............................@....pdata..............................@..@.rsrc........0......................@..@.reloc..X....@......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-80TNO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25520
Entropy (8bit):	6.8005066659410724
Encrypted:	false
SSDEEP:	384:pJTCSjOG86KuQMnYPL5YUHeM6iOUUJp23+r/jLE:pJTBtjhOWiyJp23+zjo
MD5:	68FBCFBF30F1ECFAB5DE3F52612E7B22
SHA1:	75F9C294F24F36DA86C83CB3E7C10D86B783442B
SHA-256:	113D4978108C680F9624152D089401250AC92B0C2058FAB9C3BC2A1F80F38DC2
SHA-512:	8DDC7924F52D16A49735A4FB81002AF4D4439EED13D3FA368B16BB07684361ED2D0496A8A14A7B7B36ACB78E0D3E9E7248E9E55B0C1F00272E963D3223C2FC93
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e..!..!..!..(.8. ..(...+..(.).#..(.>.&..!.....(.$. ..(.?. ..(.9. ..(.<. ..Rich!..........................PE..d...P..X.........." ................4........................................p......\|:.............................................. '.......#..P....P.......@.......&...=...`......P!............................................... .. ............................text...1........................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..$....`.......$..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-9CMA4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	516528
Entropy (8bit):	6.463290819234875
Encrypted:	false
SSDEEP:	12288:FsL9jcfjthK0XmHZ85wiPzSww9EchxcGTlTBTFDTw:FsLS7tEumHOiiGREchTTBRDTw
MD5:	09DA913D5FD46FC8DBBBB0B45DC42F9D
SHA1:	882C43B4AB88140E0C90723E40AEA3FC6EE025DC
SHA-256:	F49D4F04771E9D701E8E29A9B01F3085053FC1EEAED5A3E2617394DB61DD12AA
SHA-512:	4972C9FFF8D72CBB2A15AAC0C71D10B59054694A4F6355AB5FBA942A9381D304E3AF11A7DC90F0A9E4B41C8B7828601DB116CB3DC5A11F93632F1E976ED3384F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b...b...b..L-{..b....x..b....i..b....~..b...b..c....n.Lb.......b...0y..b....\|..b..Rich.b..........................PE..d....J.\.........." ......................................................................@.........................................0Q.......>...............p...N.......=..........`...................................................0............................text............................... ..`.rdata...y.......z..................@..@.data........`.......@..............@....pdata...N...p...P...B..............@..@.rsrc...............................@..@.reloc..^...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-BHS0U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1188784
Entropy (8bit):	6.573519479006201
Encrypted:	false
SSDEEP:	24576:gpwQfq4f9lQruaGavkg3NyukbbbYVlBAUZLYWs:gbjQruaGaXj3VlBAUZLYD
MD5:	9E74DACE34B9996BEF250228DD1ADB06
SHA1:	554B1195A0D9860AFA1272286661ED19EB2F8A9B
SHA-256:	54C751CF12000A206F45E31949235F435BE6A1EC5ED14AFA4125A19FD2EAF899
SHA-512:	3329CA6CDEFD685B9D4DEEC1A2F61DE71E009F1E30C240E08DC20DCF19FF6732C3F4BF5449C8B9A68CE02BE9740FA00159CD700A0F23DE58BDDABC71D08335C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................=.....,.....;...........+.....:.....<.....9....Rich...................PE..d....0.O.........." .........\.......[.......................................0.......1....@....................................................<.......D.......L........=... ......P................................................................................text............................... ..`.rdata... ......."..................@..@.data...............................@....pdata..............................@..@.idata..............................@....rsrc...D...........................@..@.reloc..-.... ......................@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-ED59I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2779568
Entropy (8bit):	6.299455273724156
Encrypted:	false
SSDEEP:	49152:ky+5llbVloWoNIhnOrhwMIWxb4pk9UL9vGLNPF9G0xmh+HTF83HyTVoI7nnHohF9:IvoNIhnOrhwMIWxb4pgUL9vGLNPF9G0u
MD5:	379538551F26772D3736D50D79E2C483
SHA1:	AE830CA279F49AB239FE0ADD5E80AC6C3B6495B9
SHA-256:	C66E3D32AE39572E7C864DCA186FE51C9545CF24D4FFB54B322356CE6FDAB9A3
SHA-512:	67F8E591AE3ECB69996E76B798F3196C499C62F32813DBD8E43EFFD2A0004A23E01704E3AB94D4F1DD4BF48F42CE2BC2569243038B84781733D00BAD3DEEE1E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x.I.............V#......a2......a&..............a ......a1......a6......a'......a!......a$.....Rich....................PE..d....<.\.........." .....(...........................................................+...@.........................................`.%.....(2%.,....`.x....0(..,...,..=...p.HH...U...............................................@..p............................text...n'.......(.................. ..`.rdata...{...@...\|...,..............@..@.data... m....%.......%.............@....pdata...,...0(.......'.............@..@.rsrc...x....`.......).............@..@.reloc..,a...p..b....).............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-F99S5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	96176
Entropy (8bit):	6.787200685822373
Encrypted:	false
SSDEEP:	1536:LtjwzJ177gtAQ3zyKl0JPFmgnToIf0IO0IOlS1gLIc+zFMLiy6G0Y:xjwzJ9knzBN0TBfaalS1gLIrFMLiy6Gh
MD5:	6A9565A9A7ECE535CEDFB1F9BBF05C6B
SHA1:	330D22F467D0696459B3A0AE7AE6922D2FB003FB
SHA-256:	D8D06DCC9499BEDF4CFD52A85553B26BD0092CDD338202FD85F5346D92F15C24
SHA-512:	6FB0E6FD6D2C71BF6A9823D141ECA65C04515865EDF7ED3030F7F567611440A5B39441635496B83961283FD4D2A655312367EA751788838C91A56BEF524F0E35
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i.YK-.7.-.7.-.7.....(.7.$...,.7.$.../.7.$...(.7.-.6...7.$...7.7.$...,.7.$...,.7.$...,.7.Rich-.7.........PE..d....j^U.........." .........t.......................................................3....@......................................... 7......T2..<....`..(....P.......:...=...p..\....................................................................................text...a........................... ..`.rdata...].......^..................@..@.data...@....@.......$..............@....pdata.......P.......&..............@..@.rsrc...(....`.......0..............@..@.reloc.......p.......8..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-FIGM0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62384
Entropy (8bit):	6.375911484831348
Encrypted:	false
SSDEEP:	768:E0x5okxZPod8jPFArxhqk+9JeQ3wep+peIb2OOq5rXu2gVOriynp23+zjB6:ERH2rk6FF+pH6OrBgQriyY00
MD5:	47482E1A1459F847E31401E3493F8DB7
SHA1:	27B65CE11B2FA5CBABB74EA90B81F2A61A5E36EA
SHA-256:	D997DF9CD9F0B14B98D793F0C2B3337590DCED75E5B1B2EED429830EA7481ABC
SHA-512:	3080C2BBB8F3ACE97CB3E557896ACC3F960EEE83E7654BAD279DFA444F4C002ACB89180FE6AA189E654C4B67F69F0EAC7A05C57D72893F1991B6363CBE425D67
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ZK.H..........R{.....xx.....ej.....Ri.....R......Ro.......p...Rx.....Rm....Rich...........PE..d....;.\.........."......^...T.................@.........................................@.....................................................x........................=......H....s...............................................p..X............................text....\.......^.................. ..`.rdata..BC...p...D...b..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-G86Q6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	146352
Entropy (8bit):	6.167048310629116
Encrypted:	false
SSDEEP:	3072:TdDJ1m0IEZBVi2wyc2Dbcsi6CXnWpVkItOsZt2y27Uiy80N:TNvHIAnTcWaGkItOsZxAeN
MD5:	41A96059CED0C55307DF6C0FE24E289D
SHA1:	B881E6E4696F735499196D2AB6A8CD121EA22A5F
SHA-256:	DD2CE827BFDB519495C135DA2DCE32A61AA16F871AE11506773ABFF3B5AC2715
SHA-512:	4A4A9B3B17D31BF36B6475D1663AC40C8D9E0556EEEDC385306AE076E5CCCA086CA86AD5A9B4C616F2DDF67B79E4263D0DCAD9B48129596BD6E125F0061054E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...cJ..c.c...c..c...c...c...c...c...c.c...c...c...c...c...c...c...c...c...c...cRich...c........................PE..d...UQ.V.........." .....F..........L........................................P.......4......................................................H...<....0....... ..$........=...@.......c...............................................`...............................text....D.......F.................. ..`.rdata..q>...`...@...J..............@..@.data....y.......Z..................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-GCANT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1718192
Entropy (8bit):	6.39620848204772
Encrypted:	false
SSDEEP:	49152:00aSLnxDf8DH62pdeG2YzCbYky9U/7iuhtk3WNgU18MO6XoM7zS1mhT8ygP0eJ+0:rDfseG2Yeb7Diuhtk3WNgU18MO64M7zS
MD5:	4D560029BE0D1029A12E74857C81CFE4
SHA1:	A809B0432C5339C03229E68DD65E49947E986040
SHA-256:	B80FCDAFD3027E14243373BDD612DF05EB8543CDF89A51E491D09A73B935AA0F
SHA-512:	D2D51A63D9C4579C4401EA77BCA57A5A5051F7C284F37FD37C51D187942D77F0AB21C7EACD7589CA97541446DFF01CF291994A289C489040D0AE792A8EF63031
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U. ...N...N...N......N......N......N...O...N......N......N.... .N......N......N......N.Rich..N.........PE..d....;.\.........." .........<......................................................}.....@..........................................................@.......P..\........=...P..46...................................................................................text...j........................... ..`.rdata...M.......N..................@..@.data...@#... ......................@....pdata..\....P......................@..@.rsrc........@......................@..@.reloc...D...P...F..................@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-H973S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2322352
Entropy (8bit):	6.983105063140714
Encrypted:	false
SSDEEP:	49152:rwG9BZcAk8dlaja+MmRHjHpiIhSJuupGaXDg68BAUZLYkhQ:Duj/RHjquBAUZLXQ
MD5:	128EFC1A69BD3D9C63F288AE2CAF4CE9
SHA1:	FD0AE6BD1377ABDD02E3498A4BEFE3C60012387B
SHA-256:	E3FA5E87A30B2ED85DB32D84F7816DCBBB988B413FC2CA1C0560FBDE981C7A6F
SHA-512:	64828B708A5E253B467D96706922830C92295F7D3EAE8E7A1811636D2CD0A975C5FE3ABC1320C75D850E7CDDC615363EA4A7BBAD4201212798AAD75DA5BEECC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-.qUi...i...i.......o...`...k...`...k...`...k...`...n...i......`...^...`...h...w..h...`...h...Richi...................PE..d.....Q\.........." .................+........................................#......#...............................................!.....<.!.P....0#.$....."......2#..=...@#......................................................................................text....~.......................... ..`.rdata...D.......F..................@..@.data..../....!.......!.............@....pdata........".......!.............@..@.rsrc...$....0#.......".............@..@.reloc..R1...@#..2....#.............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-HGVAF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770992
Entropy (8bit):	5.956936625724099
Encrypted:	false
SSDEEP:	12288:XjNWt1hqCIZ4nBkP+/Hzex8wVXQijhDeZjKPW0CaEt6:TNWPDHzeDryZj83w6
MD5:	B471DCCE5CFA82D0A1A4457D2595B5D5
SHA1:	6266E95003E71605E830E41BE8F4D7548461C4F7
SHA-256:	19C72CCA329F6B2CFA8266B2E242E59676B665C4C37465A709564F1AB4C510D4
SHA-512:	68CBEA121D5872DC11D65F146757B525F9ACCBCE0B080017C092971933ADB12FD0185951CF0154B8BFCFCF43D182F795EDC0F88681F1D62A700A02084086D5F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(.g~lj.-lj.-lj.-e..-ej.-lj.-.j.-.%.-mj.-e..-mj.-e..-aj.-e..-tj.-e..-mj.-e..-mj.-e..-mj.-Richlj.-........................PE..d...Y8.\.........." ................................................................p.....@.........................................P...........d.......0....P...C.......=......$...p................................................................................text............................... ..`.rdata..-...........................@..@.data....9.......0..................@....pdata...C...P...D...,..............@..@.rsrc...0............p..............@..@.reloc..F............v..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I6VGK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804720
Entropy (8bit):	6.387198261279158
Encrypted:	false
SSDEEP:	49152:RPn0Vh2XPBmb11w89B87/v2JIcR4pru1VXjI6eHGuf9X2rtGd3tDkQfp/TYpivre:uemD9B87/MIcaru1VXjI6eHGuf9Xr9DQ
MD5:	2351B99C18A3027F7C6E8A665D58F4F8
SHA1:	877DABFF1580E28A71958319517FAE57BB81CCEC
SHA-256:	88FDA6277A23FCC707AD687D43152E0A9F5CB68551D75825E894EFB88237594A
SHA-512:	E75F915A3C4043DCC15A5E3363CB4647B52A67C1250533B6468D75CAE62F62577D64A18B43B0F1EB4D619DA8C229230D22A996FF54C29D1EF9B69EF0A8E1986B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X..9...9...9..:vj..9...A{..9...Ao..9...9..@8...Ax..9...Ai..9...A...8...Ah..9...Am..9..Rich.9..........PE..d....;.\.........."......n.....................@..........................................@..........................................................p..d+...p.......L...=.......9..p...................................................0............................text....m.......n.................. ..`.rdata..h............r..............@..@.data....1...0....... ..............@....pdata.......p......................@..@.rsrc...d+...p...,..................@..@.reloc..pH.......J..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-I8RA6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	401840
Entropy (8bit):	6.008237154518556
Encrypted:	false
SSDEEP:	12288:H92/bocatSwtP2BhnhUTFdL1HZaoEgHDa:H92EDtP2BhnwFdLVZaoEIa
MD5:	6A489AAABDB75BDFA22F2A59F8341E8A
SHA1:	34E00818D5E536908811A1E06D4D2E3AE1208F85
SHA-256:	A3BB521D70788660D311B3E6DFC4AEA054B291F353343EF544ED20535A9D6582
SHA-512:	174128CEE94FC4C8414D7E8BBE50DCDD5E82B7EA9944C59FAA441239967F5D9FD6DBC95936C7C3742F493361AC56A9C947177E07CCD2065D4BC3AA42FA521062
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..#..#..#...v."...d.....c.....u.(...s.(..#..&...i.....r."..=.t."..*.q."..Rich#..........................PE..d..._Q.V.........." .....F...........M.......................................@......M?.............................................. ....$.....x.... ...........".......=...0..D...0h...............................................`...............................text...NE.......F.................. ..`.rdata.. }...`...~...J..............@..@.data...$...........................@....pdata...".......$..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-JUSQQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1266
Entropy (8bit):	4.869620493270453
Encrypted:	false
SSDEEP:	24:qw+mJgwE+FPO9sKDGnHj1OnN4vbWtLahX8rW1wrKW58sVc5XOPRy7MptOy4:qKgwbFPO+nZOnevgLaOW1TW58sVWOPDa
MD5:	EE637DCF6555986B1F46553E2C843EA4
SHA1:	98E445E99D7742D6BCC497F8A106BF16182547F4
SHA-256:	D2DF8A9DA88DC6AE67774FD655DCF165DA2584974C6A374F7A811AC14CEFC029
SHA-512:	98D428FB689200848DE5FF1FC2B3A3FDC84F567337AC152B000A5EC9EE2C6D16CDFFD052C1CCDEE68420CE26B4D7206611C7A46C82870AB1B2EE2C40DA18AE44
Malicious:	false
Preview:	@echo off..rem This batch file installs a new vstor2-mntapi20-shared service...rem If a previous binary is installed, then the old service will be..rem removed before the new service is installed...rem..rem Check the system type..rem....set VSTOR=vstor2-mntapi20-shared..wmic OS get OSArchitecture \| findstr 64..if errorlevel 1 (.. echo "This driver can only be installed on a 64-bit system.".. exit /b 1..)..rem..rem Check if the service is installed..rem..sc query %VSTOR% > nul..if errorlevel 1 (.. echo "Service not found, adding the service.".. goto Installit..)..rem..rem The service is installed, remove it...rem..echo "Service exists, removing it first."..sc stop %VSTOR% > nul..sc delete %VSTOR%..del /f %SystemRoot%\System32\drivers\%VSTOR%.sys..rem The service should be cleaned up. Now install the new driver..:Installit..copy /v /y /b AMD64\%VSTOR%.sys /b %SystemRoot%\System32\drivers\%VSTOR%.sys /b..sc create %VSTOR% type= kernel start= auto error= normal binpath= System

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-LQIVE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	436656
Entropy (8bit):	5.98230009612887
Encrypted:	false
SSDEEP:	6144:+N0ofDy1Ew2+KiraU+0sH4XJ+h+04ta1TIZ/5qW4RJoPJROFsEesRmIur1AJLhF:aAEw2So0scgh+1BB5qW4R2ROFsEesVLD
MD5:	637DB80A97E66718C0088DA2623F2E42
SHA1:	2327CA7A9405F3DBF0849A92A7F288C167E94D55
SHA-256:	1052C6AEBDC4B6BC277B12D7685A6351F6F50E72CF998065D05D98EE2326C799
SHA-512:	9FE2C6957D99FFCB49F48FDE138A7A809CBA85FEB834BC780EE9C965BDC68BEBCE0CF883AB524213D764A395289124EC5E36CF83965FC3E0EA3A529FEC7B56B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.d...7...7...7.^.7...7.i.7...7.i.7?..7.i.7...7.i.7...7...7...7.i.7...7.i.7...7.C.7...7.i.7...7Rich...7........PE..d...qQ.V.........." ................`P.......................................0.......u..............................................p...H+......x................&...l...=... ..P.......................................................8............................text............................... ..`.rdata..............................@..@.data........@.......$..............@....pdata...&.......(...6..............@..@.rsrc................^..............@..@.reloc..6.... .......d..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-MMA8U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122800
Entropy (8bit):	5.271898350192096
Encrypted:	false
SSDEEP:	1536:DZgqnWq881MDesj/fm5qyF7UBn6I6FM86iyp0zb:DZgqWtEMDesrsqy2X6i86iyp0H
MD5:	1C70B19148794BC9A244134D5E07ABA5
SHA1:	8928235A17213AF53AF2FC13D378670520CE70C0
SHA-256:	829660951C18672A5F382FFA9F6D8946B8B8423D3FD08EA55C0DE7AC024DD45A
SHA-512:	7E7104A4C58EAC4A4D3D21290854BE078DCADDF96EB15BACEB3454469C5BEE2AD4B8488A95D3EF9C97874EB0B75F52F72B124747F74B21376774169391E86D52
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ..PA..PA..PA....s.UA..Y9p.RA..Y9a.RA..Y9v.WA..PA...A..Y9f.tA..Y9w.QA..Y9q.QA..Y9t.QA..RichPA..................PE..d......S.........." .....N...P.......#....................................................@......................................... v..........P.......T................=..........Pe..............................................P................................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data................n..............@....pdata..$............~..............@..@.idata..1...........................@....rsrc...T...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-NTL6D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3388848
Entropy (8bit):	6.491217454296774
Encrypted:	false
SSDEEP:	49152:lZsN0V5QDg5l4YOjj1J8jSIkD0Ze81y2QQkHauGjsS5SYdp/IU6i8yqYvy0Pq:lSuK1Sn1y2O+CZn
MD5:	9A46FD947033F80AC3821BA5D7EAA42C
SHA1:	66C54169DE936EEA3A231C084C967AC90A45A012
SHA-256:	DFAD5E8233E845645A52A501523243C747B7A1154EBF38850AB3ABD1FD4E1030
SHA-512:	788FDB939B906EFF9019BB672F7BAE068682C80DAE9247C56C68111784E5026D0F9526C11207A81A95240B322E2275727F1FB2A208ABF5711BAF4532818D3630
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E..+...+...+...+...+..{P...+.......+.'.....+.......+......+.......+.......+.....i.+.......+.......+.......+.Rich..+.........PE..d.....}X.........." .........................................................04.....+.4...@.........................................P.)......m).......3......p0.L....x3..=....3..s...................................................................................text............................... ..`fipstx...... ...................... ..`.rdata..n...........................@..@.data.........)..6....).............@....pdata..L....p0......./.............@..@fipsda...g...`2..h....1.............@...fipsrd..`+....2..,...2.............@..@fipsro..P.....3......V2.............@..@.rsrc.........3.......2.............@..@.reloc........3.......2.............@..B................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-OAJUU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25279920
Entropy (8bit):	6.119520211473779
Encrypted:	false
SSDEEP:	98304:V91SpvP4q9z3LohJa1nydVC4N2nUK6i9pcRc14Xq7HK3VQkIWWHeCtxJeyWBPiod:VjSpvQWc/a1n5w9QBkx19LZ
MD5:	96B115A2F4D00B38989F9017C78649E2
SHA1:	2067634F44CA16E43D81EAB549621136AC1351DC
SHA-256:	571BE1C718F1E661F43317B896B73679CC51FEFFFE0E4C63AA7F69C7A78CE31A
SHA-512:	4EBA1A386B7C52D24285D512D83EB05120DE1D42D9A29ABE1A3757932EC82F6A5908D83BDE8181F86D9FFABC8F287139F4F67FA5D753D89AE54E9DF7AC249FE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._..............y...........\|.............i......n......x......~......{....Rich...........................PE..d....9.\.........." ................X4.......................................`......-^....@.............................................Q.P.....x.....{.$.....l..........=....{.p...0P..............................................................................text............................... ..`.rdata.............................@..@.data.........X.......X.............@....pdata........l.......k.............@..@.rsrc...$.....{.......z.............@..@.reloc........{.......z.............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-PAU7U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6013872
Entropy (8bit):	6.1043677911563075
Encrypted:	false
SSDEEP:	49152:L5mpQaDzxN8FX5CLsjGz0Sf8IAnrNrU8GQZgoHUgdjH+L6V3L9Re8KewD3dhS/x2:j9ICOeS433LwTezYr
MD5:	216EF82119AF915FAAA4A811029954D3
SHA1:	566479339BC63D1740F89D6CEBFB9A7A2DBD83F2
SHA-256:	BFE0DDC04FF052D83B5C98B19720A49A4FB4EA876961F309CB60DAEB0224CEF2
SHA-512:	E8CF7F7A50EC717312DE36EE7F7FCAE6DB407D41E839CC79C8EA60D4C485130E197501CBCD80A0FE67EB429636C237CEC9BC11E50231550344E952EFE40A4150
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.?.8.Q.8.Q.8.Q.1...9.Q....7.Q.1...'.Q.8.P...Q.1...<.Q.1....Q.1....Q.1...9.Q.1...9.Q.1...9.Q.Rich8.Q.................PE..d...;8.\.........." ......7...#..............................................P\......D\...@.........................................P.N.NK..8JN.@.....[. .... T..P....[..=....[..p..pM8......................[@.(.....................8..............................text.....7.......7................. ..`.rdata........8.......7.............@..@.data.........Q.......P.............@....pdata...P... T..R....S.............@..@.tls....Q.....[.......Z.............@....rsrc... .....[.......Z.............@..@.reloc........[.......Z.............@..B................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-QULGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1630640
Entropy (8bit):	6.09113558235971
Encrypted:	false
SSDEEP:	24576:hUEvdSrJjzGadjgiEz+8Qn3/0pjRPupxtQqSeZQ8cddiefdY2GMkmzbYwAan0EbL:XAVEb6aMGDlBABAeUVjT
MD5:	5B581BA9EA65D9A4DACE66140B022626
SHA1:	84A0F6A99C2589E2F8DF009F5B161E55B06A940D
SHA-256:	5B1F9E071163CC1194CAF640B056438F7966D1CD118FB065FFFA05187C9D316E
SHA-512:	5CFEE6B1BBA7C09BF433864E1E6EB8757BAA8A022F61EC764A6DD6E9AACA952195127EA03067D6F8CBB182BE5ED0E5317A71813C70B28BEE0B89C2BAADC4B036
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........E......[...............................................................Rich..........PE..d...M..X.........." ................4................................................a..................................................................H....@..lu.......=..............................................................p............................text...A........................... ..`.rdata..............................@..@.data................h..............@....pdata..lu...@...v..................@..@.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-S80ND.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5886384
Entropy (8bit):	6.393358756712777
Encrypted:	false
SSDEEP:	49152:VBvHtW/KzQYyZ7m+3lmvHggTm7kxy1K51hxW2SX3eMO6PkepqQHTUt40qgB+FY5B:VPmnRsxyBp0TXi8
MD5:	4401DD4759BFB0E1806833746867D3F1
SHA1:	1FFD2DA6C444819B5825ED9EB2482807B43C9562
SHA-256:	28CE330203A1BC10542EC5C7C3FB199019C31551C3EBFD9D133AA967946C4DCA
SHA-512:	346C70B632313DF98E74341554688CEE230F63CD102DCEBFD491990C37C7EA167656ABEBB1D700927C115A18BFE68723E741E4C897982877EFA8DC639D0755F7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+...J...J...J...2D..J..L.U..J...2P..J....P..J...J..H...2G..J...2V..J...2@.PJ...2Q..J...2W..J...2R..J..Rich.J..........PE..d....:.\.........." .....$@..l........<.......................................[.....VZ...@...........................................M....t.M......pZ......`U.......Y..=....Z..M...M@..............................................@@..............................text...:"@......$@................. ..`.rdata...M...@@..N...(@.............@..@.data...`.....R......vR.............@....pdata.......`U.......S.............@..@.rsrc........pZ.......Y.............@..@.reloc.......Z.......Y.............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-SN4HU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	597424
Entropy (8bit):	5.958314679698687
Encrypted:	false
SSDEEP:	12288:xQxGXjpO6Oa34nXEEukMHAFsmWE5pV7Si3nhSO:xQxGXjpnOhfb1FstwpV7Si3hSO
MD5:	35032F479DE00BEF632E701C606477F4
SHA1:	DD298975B1857237DBDCC7CC5FCD280014815E29
SHA-256:	9E09DFB5B7524CC183AA07D92E031F57DD0352B5C0040C34542751FB9BFE4563
SHA-512:	2EECFE24B9084D1F775EF8D85C6F3AFF09855572816F125BADD38582B66AAEB274647015B19F291B16D0778EDE69EAA05BEFC44D7000987B316DD4072CB8A333
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..;o..ho..ho..h...hk..hf..hm..hf..hp..ho..h...hf..hk..hf..hl..hf..h.hf..hn..hf..hn..hf..hn..hRicho..h................PE..d....;.\.........." .................!.......................................`.......B....@......................................... .......PY..,....0..........H<.......=...@......`...................................................0............................text...A........................... ..`.rdata..............................@..@.data... P...........n..............@....pdata..H<.......>...~..............@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-U7152.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	376752
Entropy (8bit):	6.179078996431783
Encrypted:	false
SSDEEP:	6144:0RTOnw+naqRSQg0MX2T5QSFlUiXU4Qed6ggphkszeobzDt16xFbzGMKG+KKc7MK7:cOaqRS5i5v/UiXU4Qed6ggphkszeev6X
MD5:	4BBEC9BA59E2176F3576C31ABAAC4458
SHA1:	8DBF8C5C04678AC9C46EF704DCE6843BC422BDDB
SHA-256:	FC8836DD656A855A0E17C7D4C04BEA7FAEF9BE8C1F91EB58054CF942BDB24F62
SHA-512:	BB9104C7FF36C2E6F268BEBF3164BD0391E709CDD98FC390B1BCAD7D4DC4F8F0EBFBA234A0C9EF91D023074CE350C323DF90915FA63622E0162B30ED794DB1CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&.w.G.$.G.$.G.$.?"$.G.$.?5$.G.$.G.$GG.$.?3$.G.$.?/$.G.$.?%$.G.$.?4$.G.$.?2$.G.$.?7$.G.$Rich.G.$................PE..d...Z..X.........." ............................................................................................................... ...<8......P.......0.......X).......=..............................................................h............................text............................... ..`.rdata..\~..........................@..@.data....S... ...D..................@....pdata..X).......*...J..............@..@.rsrc...0............t..............@..@.reloc..>............\|..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\is-VUIE8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2374576
Entropy (8bit):	6.717232964452072
Encrypted:	false
SSDEEP:	49152:qZ5ADHajSXvvFgeMP4BKqxVKGR6VYtCjRjPIU6iYTq/GQVPNoN:uKHgaxVKM+yq/TLG
MD5:	D42BAA7438CDBE8CD57A8519CA4BB523
SHA1:	9E1DF02D1AA6436C34DAB661CB174C5D02F04F13
SHA-256:	9031FBD24BC9B27715048819879FCB22011DB430155C7C12D34EDA279EA758CF
SHA-512:	4D9D2C26CC8CA9DBC07AFEFED2162BD2DFCDBB576110D94FDB602A70BDAB59748917045D198CF4D171C14B8E9102B48D7FEDFDD6DC47DACC8DEDD48A8F9C79BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........GEp.&+#.&+#.&+#.^.#.&+#.^.#.&+#.^.#.&+#.&*#$&+#.&+#.&+#.^.#.$+#.^.#.&+#.t.#.&+#.^.#.&+#Rich.&+#........PE..d...-.\.........." ................H9.......................................`$.......$...@.........................................._......pQ........#......`!.._....#..=....$.(J...@...............................................0..(............................text............0.................. ..`fipstx..P....@.......4.............. ..`.rdata.......0......."..............@..@.data...P8... ......................@....pdata..._...`!..`....!.............@..@fipsro..`....."......t".............@..@fipsda..fg...P#..h....#.............@...fipsrd..t-....#......j#.............@..@.rsrc.........#.......#.............@..@.reloc..L]....$..^....#.............@..B........................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	516528
Entropy (8bit):	6.463290819234875
Encrypted:	false
SSDEEP:	12288:FsL9jcfjthK0XmHZ85wiPzSww9EchxcGTlTBTFDTw:FsLS7tEumHOiiGREchTTBRDTw
MD5:	09DA913D5FD46FC8DBBBB0B45DC42F9D
SHA1:	882C43B4AB88140E0C90723E40AEA3FC6EE025DC
SHA-256:	F49D4F04771E9D701E8E29A9B01F3085053FC1EEAED5A3E2617394DB61DD12AA
SHA-512:	4972C9FFF8D72CBB2A15AAC0C71D10B59054694A4F6355AB5FBA942A9381D304E3AF11A7DC90F0A9E4B41C8B7828601DB116CB3DC5A11F93632F1E976ED3384F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............b...b...b..L-{..b....x..b....i..b....~..b...b..c....n.Lb.......b...0y..b....\|..b..Rich.b..........................PE..d....J.\.........." ......................................................................@.........................................0Q.......>...............p...N.......=..........`...................................................0............................text............................... ..`.rdata...y.......z..................@..@.data........`.......@..............@....pdata...N...p...P...B..............@..@.rsrc...............................@..@.reloc..^...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2374576
Entropy (8bit):	6.717232964452072
Encrypted:	false
SSDEEP:	49152:qZ5ADHajSXvvFgeMP4BKqxVKGR6VYtCjRjPIU6iYTq/GQVPNoN:uKHgaxVKM+yq/TLG
MD5:	D42BAA7438CDBE8CD57A8519CA4BB523
SHA1:	9E1DF02D1AA6436C34DAB661CB174C5D02F04F13
SHA-256:	9031FBD24BC9B27715048819879FCB22011DB430155C7C12D34EDA279EA758CF
SHA-512:	4D9D2C26CC8CA9DBC07AFEFED2162BD2DFCDBB576110D94FDB602A70BDAB59748917045D198CF4D171C14B8E9102B48D7FEDFDD6DC47DACC8DEDD48A8F9C79BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........GEp.&+#.&+#.&+#.^.#.&+#.^.#.&+#.^.#.&+#.&*#$&+#.&+#.&+#.^.#.$+#.^.#.&+#.t.#.&+#.^.#.&+#Rich.&+#........PE..d...-.\.........." ................H9.......................................`$.......$...@.........................................._......pQ........#......`!.._....#..=....$.(J...@...............................................0..(............................text............0.................. ..`fipstx..P....@.......4.............. ..`.rdata.......0......."..............@..@.data...P8... ......................@....pdata..._...`!..`....!.............@..@fipsro..`....."......t".............@..@fipsda..fg...P#..h....#.............@...fipsrd..t-....#......j#.............@..@.rsrc.........#.......#.............@..@.reloc..L]....$..^....#.............@..B........................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\liblber.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	146352
Entropy (8bit):	6.167048310629116
Encrypted:	false
SSDEEP:	3072:TdDJ1m0IEZBVi2wyc2Dbcsi6CXnWpVkItOsZt2y27Uiy80N:TNvHIAnTcWaGkItOsZxAeN
MD5:	41A96059CED0C55307DF6C0FE24E289D
SHA1:	B881E6E4696F735499196D2AB6A8CD121EA22A5F
SHA-256:	DD2CE827BFDB519495C135DA2DCE32A61AA16F871AE11506773ABFF3B5AC2715
SHA-512:	4A4A9B3B17D31BF36B6475D1663AC40C8D9E0556EEEDC385306AE076E5CCCA086CA86AD5A9B4C616F2DDF67B79E4263D0DCAD9B48129596BD6E125F0061054E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...cJ..c.c...c..c...c...c...c...c...c.c...c...c...c...c...c...c...c...c...c...cRich...c........................PE..d...UQ.V.........." .....F..........L........................................P.......4......................................................H...<....0....... ..$........=...@.......c...............................................`...............................text....D.......F.................. ..`.rdata..q>...`...@...J..............@..@.data....y.......Z..................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	401840
Entropy (8bit):	6.008237154518556
Encrypted:	false
SSDEEP:	12288:H92/bocatSwtP2BhnhUTFdL1HZaoEgHDa:H92EDtP2BhnwFdLVZaoEIa
MD5:	6A489AAABDB75BDFA22F2A59F8341E8A
SHA1:	34E00818D5E536908811A1E06D4D2E3AE1208F85
SHA-256:	A3BB521D70788660D311B3E6DFC4AEA054B291F353343EF544ED20535A9D6582
SHA-512:	174128CEE94FC4C8414D7E8BBE50DCDD5E82B7EA9944C59FAA441239967F5D9FD6DBC95936C7C3742F493361AC56A9C947177E07CCD2065D4BC3AA42FA521062
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..#..#..#...v."...d.....c.....u.(...s.(..#..&...i.....r."..=.t."..*.q."..Rich#..........................PE..d..._Q.V.........." .....F...........M.......................................@......M?.............................................. ....$.....x.... ...........".......=...0..D...0h...............................................`...............................text...NE.......F.................. ..`.rdata.. }...`...~...J..............@..@.data...$...........................@....pdata...".......$..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libldap_r.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	436656
Entropy (8bit):	5.98230009612887
Encrypted:	false
SSDEEP:	6144:+N0ofDy1Ew2+KiraU+0sH4XJ+h+04ta1TIZ/5qW4RJoPJROFsEesRmIur1AJLhF:aAEw2So0scgh+1BB5qW4R2ROFsEesVLD
MD5:	637DB80A97E66718C0088DA2623F2E42
SHA1:	2327CA7A9405F3DBF0849A92A7F288C167E94D55
SHA-256:	1052C6AEBDC4B6BC277B12D7685A6351F6F50E72CF998065D05D98EE2326C799
SHA-512:	9FE2C6957D99FFCB49F48FDE138A7A809CBA85FEB834BC780EE9C965BDC68BEBCE0CF883AB524213D764A395289124EC5E36CF83965FC3E0EA3A529FEC7B56B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.d...7...7...7.^.7...7.i.7...7.i.7?..7.i.7...7.i.7...7...7...7.i.7...7.i.7...7.C.7...7.i.7...7Rich...7........PE..d...qQ.V.........." ................`P.......................................0.......u..............................................p...H+......x................&...l...=... ..P.......................................................8............................text............................... ..`.rdata..............................@..@.data........@.......$..............@....pdata...&.......(...6..............@..@.rsrc................^..............@..@.reloc..6.... .......d..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\libxml2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2322352
Entropy (8bit):	6.983105063140714
Encrypted:	false
SSDEEP:	49152:rwG9BZcAk8dlaja+MmRHjHpiIhSJuupGaXDg68BAUZLYkhQ:Duj/RHjquBAUZLXQ
MD5:	128EFC1A69BD3D9C63F288AE2CAF4CE9
SHA1:	FD0AE6BD1377ABDD02E3498A4BEFE3C60012387B
SHA-256:	E3FA5E87A30B2ED85DB32D84F7816DCBBB988B413FC2CA1C0560FBDE981C7A6F
SHA-512:	64828B708A5E253B467D96706922830C92295F7D3EAE8E7A1811636D2CD0A975C5FE3ABC1320C75D850E7CDDC615363EA4A7BBAD4201212798AAD75DA5BEECC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-.qUi...i...i.......o...`...k...`...k...`...k...`...n...i......`...^...`...h...w..h...`...h...Richi...................PE..d.....Q\.........." .................+........................................#......#...............................................!.....<.!.P....0#.$....."......2#..=...@#......................................................................................text....~.......................... ..`.rdata...D.......F..................@..@.data..../....!.......!.............@....pdata........".......!.............@..@.rsrc...$....0#.......".............@..@.reloc..R1...@#..2....#.............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\pcre.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	412648
Entropy (8bit):	6.401609248265626
Encrypted:	false
SSDEEP:	6144:X1QPI4PDV0ERaUlbWAxBIfH7W6odcIA5cz5YKt:X1QPIWfdcIAKCK
MD5:	2300544F62EFF258F63695693F6E8E74
SHA1:	9A5D48BD447010B88E34353BF6BCC859BE0A31A6
SHA-256:	E8B6958CC9F45A36E3D303360B28E87DBEB5A43B644EE1ECEF2AB7ADF59DACA3
SHA-512:	D77FE37B8A61AE42C03069BC6314047DCFB5C58C9D74C89B8CB6CC58CDE3A0EEEDBC385968F549C8652539632AA102975D8868F76970E11BC06DDEFA42B19551
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........k...k...k.....k.....k.....k.....k.p-....k...j...k.......k.......k.......k.......k.......k.Rich..k.........PE..d......Y.........." .....x...................................................P............`.........................................P...........<....0...................=...@..X......8...........................p...p............................................text...{w.......x.................. ..`.rdata..^n.......p...\|..............@..@.data...............................@....pdata..............................@..@.rsrc........0......................@..@.reloc..X....@......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	380848
Entropy (8bit):	6.195304778802536
Encrypted:	false
SSDEEP:	6144:i//wzjZDszT767kgMkLTwrFv5XdE3GHjbJVlPTQvrAwiWIs+KdW2n90flc7PZcH2:i/I3ZDen67IaTiFv5NE3GHjbJPTOrAwj
MD5:	159457ACC759B2DF40C2BF193ED9E8AA
SHA1:	79A1F3B58D20485B7C66F70D715C008599F1B129
SHA-256:	06BF65DCD5BC6ED8BEC9ABFEEFD150DC0CD907192F1ECA36DDF7A3A30713391B
SHA-512:	3CFC77C375E6F0DA8F3D7FF8AFB229E7F6B983DBBC92A3B7E23D07612336DB9F3C52C2FC0695E9B5406F7ADF7CCB6C7635CBDA851C92AE1C91FED02AA96CA481
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:jOK[..K[..K[..B#..I[..B#..I[..B#..L[..K[...Z..B#..u[..B#..J[..U...J[..B#..J[..RichK[..........................PE..d...:.\.........." ................\|.....................................................@.........................................0H...)..07..P...............P(.......=..............................................................`............................text...1........................... ..`.rdata..............................@..@.data................Z..............@....pdata..P(.......*...N..............@..@.rsrc................x..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\ssoclient.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770992
Entropy (8bit):	5.956936625724099
Encrypted:	false
SSDEEP:	12288:XjNWt1hqCIZ4nBkP+/Hzex8wVXQijhDeZjKPW0CaEt6:TNWPDHzeDryZj83w6
MD5:	B471DCCE5CFA82D0A1A4457D2595B5D5
SHA1:	6266E95003E71605E830E41BE8F4D7548461C4F7
SHA-256:	19C72CCA329F6B2CFA8266B2E242E59676B665C4C37465A709564F1AB4C510D4
SHA-512:	68CBEA121D5872DC11D65F146757B525F9ACCBCE0B080017C092971933ADB12FD0185951CF0154B8BFCFCF43D182F795EDC0F88681F1D62A700A02084086D5F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(.g~lj.-lj.-lj.-e..-ej.-lj.-.j.-.%.-mj.-e..-mj.-e..-aj.-e..-tj.-e..-mj.-e..-mj.-e..-mj.-Richlj.-........................PE..d...Y8.\.........." ................................................................p.....@.........................................P...........d.......0....P...C.......=......$...p................................................................................text............................... ..`.rdata..-...........................@..@.data....9.......0..................@....pdata...C...P...D...,..............@..@.rsrc...0............p..............@..@.reloc..F............v..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vddkReporter.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62384
Entropy (8bit):	6.375911484831348
Encrypted:	false
SSDEEP:	768:E0x5okxZPod8jPFArxhqk+9JeQ3wep+peIb2OOq5rXu2gVOriynp23+zjB6:ERH2rk6FF+pH6OrBgQriyY00
MD5:	47482E1A1459F847E31401E3493F8DB7
SHA1:	27B65CE11B2FA5CBABB74EA90B81F2A61A5E36EA
SHA-256:	D997DF9CD9F0B14B98D793F0C2B3337590DCED75E5B1B2EED429830EA7481ABC
SHA-512:	3080C2BBB8F3ACE97CB3E557896ACC3F960EEE83E7654BAD279DFA444F4C002ACB89180FE6AA189E654C4B67F69F0EAC7A05C57D72893F1991B6363CBE425D67
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ZK.H..........R{.....xx.....ej.....Ri.....R......Ro.......p...Rx.....Rm....Rich...........PE..d....;.\.........."......^...T.................@.........................................@.....................................................x........................=......H....s...............................................p..X............................text....\.......^.................. ..`.rdata..BC...p...D...b..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vim-types.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25279920
Entropy (8bit):	6.119520211473779
Encrypted:	false
SSDEEP:	98304:V91SpvP4q9z3LohJa1nydVC4N2nUK6i9pcRc14Xq7HK3VQkIWWHeCtxJeyWBPiod:VjSpvQWc/a1n5w9QBkx19LZ
MD5:	96B115A2F4D00B38989F9017C78649E2
SHA1:	2067634F44CA16E43D81EAB549621136AC1351DC
SHA-256:	571BE1C718F1E661F43317B896B73679CC51FEFFFE0E4C63AA7F69C7A78CE31A
SHA-512:	4EBA1A386B7C52D24285D512D83EB05120DE1D42D9A29ABE1A3757932EC82F6A5908D83BDE8181F86D9FFABC8F287139F4F67FA5D753D89AE54E9DF7AC249FE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._..............y...........\|.............i......n......x......~......{....Rich...........................PE..d....9.\.........." ................X4.......................................`......-^....@.............................................Q.P.....x.....{.$.....l..........=....{.p...0P..............................................................................text............................... ..`.rdata.............................@..@.data.........X.......X.............@....pdata........l.......k.............@..@.rsrc...$.....{.......z.............@..@.reloc........{.......z.............@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixDiskLib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1718192
Entropy (8bit):	6.39620848204772
Encrypted:	false
SSDEEP:	49152:00aSLnxDf8DH62pdeG2YzCbYky9U/7iuhtk3WNgU18MO6XoM7zS1mhT8ygP0eJ+0:rDfseG2Yeb7Diuhtk3WNgU18MO64M7zS
MD5:	4D560029BE0D1029A12E74857C81CFE4
SHA1:	A809B0432C5339C03229E68DD65E49947E986040
SHA-256:	B80FCDAFD3027E14243373BDD612DF05EB8543CDF89A51E491D09A73B935AA0F
SHA-512:	D2D51A63D9C4579C4401EA77BCA57A5A5051F7C284F37FD37C51D187942D77F0AB21C7EACD7589CA97541446DFF01CF291994A289C489040D0AE792A8EF63031
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U. ...N...N...N......N......N......N...O...N......N......N.... .N......N......N......N.Rich..N.........PE..d....;.\.........." .........<......................................................}.....@..........................................................@.......P..\........=...P..46...................................................................................text...j........................... ..`.rdata...M.......N..................@..@.data...@#... ......................@....pdata..\....P......................@..@.rsrc........@......................@..@.reloc...D...P...F..................@..B................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixDiskLibVim.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	597424
Entropy (8bit):	5.958314679698687
Encrypted:	false
SSDEEP:	12288:xQxGXjpO6Oa34nXEEukMHAFsmWE5pV7Si3nhSO:xQxGXjpnOhfb1FstwpV7Si3hSO
MD5:	35032F479DE00BEF632E701C606477F4
SHA1:	DD298975B1857237DBDCC7CC5FCD280014815E29
SHA-256:	9E09DFB5B7524CC183AA07D92E031F57DD0352B5C0040C34542751FB9BFE4563
SHA-512:	2EECFE24B9084D1F775EF8D85C6F3AFF09855572816F125BADD38582B66AAEB274647015B19F291B16D0778EDE69EAA05BEFC44D7000987B316DD4072CB8A333
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..;o..ho..ho..h...hk..hf..hm..hf..hp..ho..h...hf..hk..hf..hl..hf..h.hf..hn..hf..hn..hf..hn..hRicho..h................PE..d....;.\.........." .................!.......................................`.......B....@......................................... .......PY..,....0..........H<.......=...@......`...................................................0............................text...A........................... ..`.rdata..............................@..@.data... P...........n..............@....pdata..H<.......>...~..............@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vixMntapi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3388848
Entropy (8bit):	6.491217454296774
Encrypted:	false
SSDEEP:	49152:lZsN0V5QDg5l4YOjj1J8jSIkD0Ze81y2QQkHauGjsS5SYdp/IU6i8yqYvy0Pq:lSuK1Sn1y2O+CZn
MD5:	9A46FD947033F80AC3821BA5D7EAA42C
SHA1:	66C54169DE936EEA3A231C084C967AC90A45A012
SHA-256:	DFAD5E8233E845645A52A501523243C747B7A1154EBF38850AB3ABD1FD4E1030
SHA-512:	788FDB939B906EFF9019BB672F7BAE068682C80DAE9247C56C68111784E5026D0F9526C11207A81A95240B322E2275727F1FB2A208ABF5711BAF4532818D3630
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E..+...+...+...+...+..{P...+.......+.'.....+.......+......+.......+.......+.....i.+.......+.......+.......+.Rich..+.........PE..d.....}X.........." .........................................................04.....+.4...@.........................................P.)......m).......3......p0.L....x3..=....3..s...................................................................................text............................... ..`fipstx...... ...................... ..`.rdata..n...........................@..@.data.........)..6....).............@....pdata..L....p0......./.............@..@fipsda...g...`2..h....1.............@...fipsrd..`+....2..,...2.............@..@fipsro..P.....3......V2.............@..@.rsrc.........3.......2.............@..@.reloc........3.......2.............@..B................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmacore.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6013872
Entropy (8bit):	6.1043677911563075
Encrypted:	false
SSDEEP:	49152:L5mpQaDzxN8FX5CLsjGz0Sf8IAnrNrU8GQZgoHUgdjH+L6V3L9Re8KewD3dhS/x2:j9ICOeS433LwTezYr
MD5:	216EF82119AF915FAAA4A811029954D3
SHA1:	566479339BC63D1740F89D6CEBFB9A7A2DBD83F2
SHA-256:	BFE0DDC04FF052D83B5C98B19720A49A4FB4EA876961F309CB60DAEB0224CEF2
SHA-512:	E8CF7F7A50EC717312DE36EE7F7FCAE6DB407D41E839CC79C8EA60D4C485130E197501CBCD80A0FE67EB429636C237CEC9BC11E50231550344E952EFE40A4150
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.?.8.Q.8.Q.8.Q.1...9.Q....7.Q.1...'.Q.8.P...Q.1...<.Q.1....Q.1....Q.1...9.Q.1...9.Q.1...9.Q.Rich8.Q.................PE..d...;8.\.........." ......7...#..............................................P\......D\...@.........................................P.N.NK..8JN.@.....[. .... T..P....[..=....[..p..pM8......................[@.(.....................8..............................text.....7.......7................. ..`.rdata........8.......7.............@..@.data.........Q.......P.............@....pdata...P... T..R....S.............@..@.tls....Q.....[.......Z.............@....rsrc... .....[.......Z.............@..@.reloc........[.......Z.............@..B................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmomi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3215792
Entropy (8bit):	6.176453520799816
Encrypted:	false
SSDEEP:	49152:8xAMv72IqK0uvl09JAdF2fAiucXBCJ4GpObZ+k:8xAs8YUGpObZ3
MD5:	FCAEF218015A274463586201312E3911
SHA1:	8DE6125AE1E241D74E2D0C6FFDAFB083A2080AE4
SHA-256:	19630880389BA6697534FCD389B515073D3A62312905CA8543941F437ABBC2B7
SHA-512:	A80A5755F5BB59133DF9036409C80570FF9A86ABF4999824E108EEFC86C02C449CC189CAF6FBFAE8FEC48929AF93709EA58F5CF0C5E78E3BB91C41F632118405
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}].G9<..9<..9<...s..;<..0D..8<..0D..6<..9<...=..0D..*<..0D..A<..0D..8<..0D..8<..0D..8<..Rich9<..........PE..d...\8.\.........." .....Z...v.......m.......................................p1......01...@...........................................(..\...d(.......0. ....`-..p....0..=....1..F............................ .(....................p...............................text....Z.......Z.................. ..`.rdata.......p.......^..............@..@.data........`,......@,.............@....pdata...p...`-..r....,.............@..@.tls..........0......h0.............@....rsrc... .....0......j0.............@..@.reloc...c....1..d...p0.............@..B................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vmware-vdiskmanager.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804720
Entropy (8bit):	6.387198261279158
Encrypted:	false
SSDEEP:	49152:RPn0Vh2XPBmb11w89B87/v2JIcR4pru1VXjI6eHGuf9X2rtGd3tDkQfp/TYpivre:uemD9B87/MIcaru1VXjI6eHGuf9Xr9DQ
MD5:	2351B99C18A3027F7C6E8A665D58F4F8
SHA1:	877DABFF1580E28A71958319517FAE57BB81CCEC
SHA-256:	88FDA6277A23FCC707AD687D43152E0A9F5CB68551D75825E894EFB88237594A
SHA-512:	E75F915A3C4043DCC15A5E3363CB4647B52A67C1250533B6468D75CAE62F62577D64A18B43B0F1EB4D619DA8C229230D22A996FF54C29D1EF9B69EF0A8E1986B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X..9...9...9..:vj..9...A{..9...Ao..9...9..@8...Ax..9...Ai..9...A...8...Ah..9...Am..9..Rich.9..........PE..d....;.\.........."......n.....................@..........................................@..........................................................p..d+...p.......L...=.......9..p...................................................0............................text....m.......n.................. ..`.rdata..h............r..............@..@.data....1...0....... ..............@....pdata.......p......................@..@.rsrc...d+...p...,..................@..@.reloc..pH.......J..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2install.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1266
Entropy (8bit):	4.869620493270453
Encrypted:	false
SSDEEP:	24:qw+mJgwE+FPO9sKDGnHj1OnN4vbWtLahX8rW1wrKW58sVc5XOPRy7MptOy4:qKgwbFPO+nZOnevgLaOW1TW58sVWOPDa
MD5:	EE637DCF6555986B1F46553E2C843EA4
SHA1:	98E445E99D7742D6BCC497F8A106BF16182547F4
SHA-256:	D2DF8A9DA88DC6AE67774FD655DCF165DA2584974C6A374F7A811AC14CEFC029
SHA-512:	98D428FB689200848DE5FF1FC2B3A3FDC84F567337AC152B000A5EC9EE2C6D16CDFFD052C1CCDEE68420CE26B4D7206611C7A46C82870AB1B2EE2C40DA18AE44
Malicious:	false
Preview:	@echo off..rem This batch file installs a new vstor2-mntapi20-shared service...rem If a previous binary is installed, then the old service will be..rem removed before the new service is installed...rem..rem Check the system type..rem....set VSTOR=vstor2-mntapi20-shared..wmic OS get OSArchitecture \| findstr 64..if errorlevel 1 (.. echo "This driver can only be installed on a 64-bit system.".. exit /b 1..)..rem..rem Check if the service is installed..rem..sc query %VSTOR% > nul..if errorlevel 1 (.. echo "Service not found, adding the service.".. goto Installit..)..rem..rem The service is installed, remove it...rem..echo "Service exists, removing it first."..sc stop %VSTOR% > nul..sc delete %VSTOR%..del /f %SystemRoot%\System32\drivers\%VSTOR%.sys..rem The service should be cleaned up. Now install the new driver..:Installit..copy /v /y /b AMD64\%VSTOR%.sys /b %SystemRoot%\System32\drivers\%VSTOR%.sys /b..sc create %VSTOR% type= kernel start= auto error= normal binpath= System

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2uninstall.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	526
Entropy (8bit):	4.815491547285112
Encrypted:	false
SSDEEP:	12:8Nxyuy4EWvnTtjR1j1OHTeVp2Z8NMXCzvqtqEZ3y0iNMXH8Vt:JuXEsnpj1OQGbWaqahX8Vt
MD5:	EDFFA9AECCAF2C5CFD8E4514EB51C26B
SHA1:	5FE4A8ECDA066632DD7906506875D31EF62AC67B
SHA-256:	96D999AF380096FBFAB339C3EF98C42A3FD37C3D1A30F96E9B77DF8FC6D43E62
SHA-512:	2D4E8AF91A413ACDF528C89E4374298C7DFBB2AB79E190800A72CDDB626C4A373BF338B2A3DB3931232AE1D9A40BCC30FD929842B6744580512EE31E16BD193B
Malicious:	false
Preview:	@echo off..rem This batch file uninstalls the vstor2-mntapi20-shared service...rem..rem Check the system type..rem..rem Check if the service is installed..rem..set VSTOR=vstor2-mntapi20-shared..sc query %VSTOR% > nul..if errorlevel 1 (.. echo "Service not found. Quitting".. exit /b 1..)..rem..rem The service is installed, remove it...rem..echo "Service exists, removing it."..sc stop %VSTOR% > nul..sc delete %VSTOR%..del /f %SystemRoot%\System32\drivers\%VSTOR%.sys..rem The service should be cleaned up...exit /b 0..

C:\Program Files\StarWind Software\StarWind V2V Converter\lib\zlib1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	96176
Entropy (8bit):	6.787200685822373
Encrypted:	false
SSDEEP:	1536:LtjwzJ177gtAQ3zyKl0JPFmgnToIf0IO0IOlS1gLIc+zFMLiy6G0Y:xjwzJ9knzBN0TBfaalS1gLIrFMLiy6Gh
MD5:	6A9565A9A7ECE535CEDFB1F9BBF05C6B
SHA1:	330D22F467D0696459B3A0AE7AE6922D2FB003FB
SHA-256:	D8D06DCC9499BEDF4CFD52A85553B26BD0092CDD338202FD85F5346D92F15C24
SHA-512:	6FB0E6FD6D2C71BF6A9823D141ECA65C04515865EDF7ED3030F7F567611440A5B39441635496B83961283FD4D2A655312367EA751788838C91A56BEF524F0E35
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i.YK-.7.-.7.-.7.....(.7.$...,.7.$.../.7.$...(.7.-.6...7.$...7.7.$...,.7.$...,.7.$...,.7.Rich-.7.........PE..d....j^U.........." .........t.......................................................3....@......................................... 7......T2..<....`..(....P.......:...=...p..\....................................................................................text...a........................... ..`.rdata...].......^..................@..@.data...@....@.......$..............@....pdata.......P.......&..............@..@.rsrc...(....`.......0..............@..@.reloc.......p.......8..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\libeay32MD.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2131968
Entropy (8bit):	6.734796832087349
Encrypted:	false
SSDEEP:	49152:gUTy752bBkYa4f63T06hQcOhC9ntLjM7bPDIU6iJ8qMXPw2YKb9q:gCta7jQyL4M++qMY2YKb
MD5:	F1752EA7859AF8404606C914F29B9017
SHA1:	A7F19BD859F6F6E17C8EFCBDE0872AA4C641D1B8
SHA-256:	B9912AC316C268EC9B79DE03BCBC28DEBD0192558071EFA4F56145F0B33BA25D
SHA-512:	831D1AB5ED8462023D54F4F3E476FF01C314983C42DEC05173D53DB6340F12F5572422856C9BD2A6E37FF04AA5445474FE31411EAC8C8BD5395513068724C431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............D...D...D.HD...D...E...D...E...D...E...D...E...D...E...D...Do..DS..E...D...D...DV..E...DV..E...DS.$D...DV..E...DRich...D........PE..d.....)Y.........." .........>............................................... !...........`.........................................0........n..\|..... .H....`..d@............ ..G......T............................................................................text...#........................... ..`.rdata..0...........................@..@.data................h..............@....pdata..d@...`...B..................@..@.gfids........ ......8 .............@..@.rsrc...H..... ......: .............@..@.reloc...G.... ..H...@ .............@..B................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\ssleay32MD.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	356352
Entropy (8bit):	6.107743954478696
Encrypted:	false
SSDEEP:	6144:b2/7q2juilqZVyeNrt48ZRCBjU7dugT2rMMRldPrbOiskGuQXEf9ZRsHhZclLnGP:6/7q2juilqZVyebhZRCBjU7dugsMMRlG
MD5:	FCE67ABB13F665DC7CD001C652832700
SHA1:	3FE83869B091F7E03E556D1F25F9F88941157332
SHA-256:	008E598A976F6EA0E8CFD3771E570CE6FD9701DD59E1E9A578AEE82EF0500723
SHA-512:	4116A61B161BF76B63F6F78B44C96E3CDAA8B00229E6A457316AD2195C471CC498754BEF92D10E6C80587791AE7592751E3D66F85D27D3F6A2814F0888E43EC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p...............ip......O.......L.......O.......O.......O......yO..........K...yO......yO......\|O......yO......Rich............PE..d.....)Y.........." ................T.....................................................`..............................................)..DD..........H....`..L)..................0...T...............................................@............................text............................... ..`.rdata..8...........................@..@.data...0....`.......>..............@....pdata..L)...`...*...0..............@..@.gfids...............Z..............@..@.rsrc...H............\..............@..@.reloc...............b..............@..B........................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\testing-resources.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	379904
Entropy (8bit):	6.458390738828522
Encrypted:	false
SSDEEP:	6144:XTnNFO2CBHrnYGfkVG1nmYFISJak0+odvA9WIrElWGbtcUu:BFOvBLnYGsVG17VhoReW
MD5:	A1A09E88E1C73FC17BE4C915C8722398
SHA1:	3EDBCE80457CBDAC9273337E43C6FF5F447A221F
SHA-256:	3A235DC6BF1D3522A26687969068DAC87FFD2C74FBBF6F7980CD71DAA05ED004
SHA-512:	62A6FE7C29ECF063E5758F30E0A0A61D11517B5B2EF8296086E9EFD39868DB967AA3ECD44AA45639E44141EEFFD7F2EFBBDFC5795AB9C006A02C2F1E4E51DF74
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`.j...j...j...c...x...%..m...%...b...%...n...%...p...%...l...!...h.......i...j...........o.......k......k.......k...Richj...........PE..d......d.........." ...".....4............................................... ............`.............................................D....]..,................0..............8...............................(.......@...............p............................text...$........................... ..`.rdata..$...........................@..@.data...@$...........v..............@....pdata...0.......2..................@..@.rsrc...............................@..@.reloc..8...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	InnoSetup Log StarWind V2V Converter (9.0.1.369), version 0x30, 9722 bytes, 473627\user, "C:\Program Files\StarWind Software\StarWind V2V Converter"
Category:	dropped
Size (bytes):	9722
Entropy (8bit):	5.051569262204352
Encrypted:	false
SSDEEP:	96:bStC6Ry0Gr4cVSQs0LnLX5HoPElozlozWoVDoAoRnoUopoT4of4oW4oioXoOo9MB:UC6rcVSQ1nJSB/Rk7sevo3u5
MD5:	45A9252C29E7198F89867BE8B48D468B
SHA1:	6C580886E913962EB1DF11E5C5F90520C73C55D2
SHA-256:	349B68436A5D539E25CE56F1B610D5333DC0466CAE2C84A19D458B3D9EDF5C45
SHA-512:	D946F22A8FB72983D8EAAB3CEC85F97076A076387587B556073376680A970A00E479121B2445092E99A85A3C1CD55E30E21404BF9AB36B5C42AC77CF0C7DB8A3
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................StarWind V2V Converter (9.0.1.369)..............................................................................................StarWind V2V Converter (9.0.1.369)..............................................................................................0...T....%..%...............................................................................................................M.............<,......Y....473627.user9C:\Program Files\StarWind Software\StarWind V2V Converter...........1.(.... ............IFPS.............................................................................................................BOOLEAN...........................!MAIN....-1.............CHECKCOMMANDLINE....8 @8..PARAMCOUNT.......PARAMSTR........SHELLEXEC..............ISWIN64.........................._.....+...Global\7A907711-98BB-44C6-898E-FA15F2C2C68C.....1.......3........`........................`............`....`....`..........`.......

C:\Program Files\StarWind Software\StarWind V2V Converter\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1015912
Entropy (8bit):	5.6679566867305695
Encrypted:	false
SSDEEP:	24576:YMcMoi3rPR37dzHRA6G7WbuSEmK50PGyx9ZGc:YMrPR37dzHRA6GCbB80zh
MD5:	2356F5F81D797DFA2A9C35E973358693
SHA1:	EA1E81CFE3B0E8F4B09EEBCBF85593E501F4575F
SHA-256:	DCF16311954DBD5585DF660D65F049F5E2CA22303D99B3BAFBA872AE1790882A
SHA-512:	4C104E1A30F0A81C3E920264513B478A26B57F029E4E574C74BB5AC1931B9C1F62BBEB9BD3AEB6318EE17738ED74066BE9CA271A3564F87D3F30E21EB5417D92
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0............@......@...............................&.......T..............hR...@...............................0......................................................CODE............................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..P....@......................@..P.rsrc....T.......V..................@..P.....................r..............@..P........................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\unins000.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	InnoSetup messages, version 5.5.3, 221 messages (ASCII), &About Setup...
Category:	dropped
Size (bytes):	11401
Entropy (8bit):	4.69271701473269
Encrypted:	false
SSDEEP:	192:MyuyHdp7pdoksdMKUURqCZYcI71gWb/I+XIWCMVtQs:bFz7p82KaCZYcI71Tb/rIWCMVtN
MD5:	2019EFB38EB66ED6ECA1747CE0E0A7DC
SHA1:	8E92DB2383410D767E3AC26E90B6B52C3AE0255D
SHA-256:	D816931A62CB3BC09FF5D8326D33DBE7C6129C3E804321DFD6C57F5BA93FB715
SHA-512:	3618352B8201D76B62A57FE6B9E64EDF159253BA48401F120978BB9D9ABFCE7D18C51DC98465F12068F712F7F40D5C664D5117715838FD0CE4E4BF9A394F6824
Malicious:	false
Preview:	Inno Setup Messages (5.5.3).........................................\,..........&About Setup....%1 version %2..%3....%1 home page:..%4..About Setup.You must be logged in as an administrator when installing this program..The following applications are using files that need to be updated by Setup. It is recommended that you allow Setup to automatically close these applications..The following applications are using files that need to be updated by Setup. It is recommended that you allow Setup to automatically close these applications. After the installation has completed, Setup will attempt to restart the applications..Folder names cannot include any of the following characters:....%1.The folder name cannot include any of the following characters:....%1..Select a folder in the list below, then click OK..Browse For Folder.< &Back.&Browse....Cancel.&Finish.&Install.&Make New Folder.&Next >.&No.N&o to All.OK.B&rowse....&Yes.Yes to &All.Setup cannot continue. Please click Cancel to exit..Setu

C:\Program Files\StarWind Software\StarWind V2V Converter\vc\is-03KQM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7194312
Entropy (8bit):	7.989068634658633
Encrypted:	false
SSDEEP:	196608:19OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:Gz5x7jLXkmkU4cFe
MD5:	96B61B8E069832E6B809F24EA74567BA
SHA1:	8BF41BA9EEF02D30635A10433817DBB6886DA5A2
SHA-256:	E554425243E3E8CA1CD5FE550DB41E6FA58A007C74FAD400274B128452F38FB8
SHA-512:	3A55DCE14BBD455808BD939A5008B67C9C7111CAB61B1339528308022E587726954F8C55A597C6974DC543964BDB6532FE433556FBEEAF9F8CB4D95F2BBFFC12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........m...@.................................t!..,........7............m..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\vc\is-EOQIC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14572000
Entropy (8bit):	7.996598244898582
Encrypted:	true
SSDEEP:	393216:xTPq5dCsKSR65cX7Eyd/qnejOX3L8T8KYfU3j:VP5iw56oyleejcL8T8fc3
MD5:	27B141AACC2777A82BB3FA9F6E5E5C1C
SHA1:	3155CB0F146B927FCC30647C1A904CD162548C8C
SHA-256:	5EEA714E1F22F1875C1CB7B1738B0C0B1F02AEC5ECB95F0FDB1C5171C6CD93A3
SHA-512:	7789EABB6DD4A159BB899D2E6D6DF70ADDB3DF239BDA6F9EAD8C1D2A2AC2062FCE3A495814B48A3C2BEC12F13800AD0703E2C61C35158B0912011B914F098011
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-.}}~.}}~.}}~...~.}}~...~.}}~...~.}}~...~.}}~.}\|~.\|}~...~.}}~...~.}}~.}.~.}}~...~.}}~Rich.}}~........PE..L....S.T.....................6....................@..........................P...........@..................................6..@........9..........(....>......03.. .......................H/......./..@............................................text............................... ..`.rdata.............................@..@.data....0...`.......:..............@....wixburn8............J..............@..@.tls.................L..............@....rsrc....9.......:...N..............@..@.reloc...D.......F..................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7194312
Entropy (8bit):	7.989068634658633
Encrypted:	false
SSDEEP:	196608:19OaQ54oYY7jLwXjZ41OON2uk3bQWgtyccMEL:Gz5x7jLXkmkU4cFe
MD5:	96B61B8E069832E6B809F24EA74567BA
SHA1:	8BF41BA9EEF02D30635A10433817DBB6886DA5A2
SHA-256:	E554425243E3E8CA1CD5FE550DB41E6FA58A007C74FAD400274B128452F38FB8
SHA-512:	3A55DCE14BBD455808BD939A5008B67C9C7111CAB61B1339528308022E587726954F8C55A597C6974DC543964BDB6532FE433556FBEEAF9F8CB4D95F2BBFFC12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0........m...@.................................t!..,........7............m..>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14572000
Entropy (8bit):	7.996598244898582
Encrypted:	true
SSDEEP:	393216:xTPq5dCsKSR65cX7Eyd/qnejOX3L8T8KYfU3j:VP5iw56oyleejcL8T8fc3
MD5:	27B141AACC2777A82BB3FA9F6E5E5C1C
SHA1:	3155CB0F146B927FCC30647C1A904CD162548C8C
SHA-256:	5EEA714E1F22F1875C1CB7B1738B0C0B1F02AEC5ECB95F0FDB1C5171C6CD93A3
SHA-512:	7789EABB6DD4A159BB899D2E6D6DF70ADDB3DF239BDA6F9EAD8C1D2A2AC2062FCE3A495814B48A3C2BEC12F13800AD0703E2C61C35158B0912011B914F098011
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........-.}}~.}}~.}}~...~.}}~...~.}}~...~.}}~...~.}}~.}\|~.\|}~...~.}}~...~.}}~.}.~.}}~...~.}}~Rich.}}~........PE..L....S.T.....................6....................@..........................P...........@..................................6..@........9..........(....>......03.. .......................H/......./..@............................................text............................... ..`.rdata.............................@..@.data....0...`.......:..............@....wixburn8............J..............@..@.tls.................L..............@....rsrc....9.......:...N..............@..@.reloc...D.......F..................@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\vcruntime140_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49488
Entropy (8bit):	6.652691609629867
Encrypted:	false
SSDEEP:	768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
MD5:	BBA9680BC310D8D25E97B12463196C92
SHA1:	9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
SHA-256:	E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
SHA-512:	1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

C:\Program Files\StarWind Software\StarWind V2V Converter\wastorage.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3377608
Entropy (8bit):	6.121344735848943
Encrypted:	false
SSDEEP:	49152:fMCRmA81qe7NsppyIPiUgI/6+1txSPKR3S6MBl1gmb9r5cKxCAL0:f4Npdg
MD5:	5FAFA8455487A6B190AB6C1FCA3DF50F
SHA1:	85315F85AF40038B3C8BB47DCF42643D31062F4C
SHA-256:	AC0F5F2386E0E35EECB358FD2076560BB63FDCA982CD7B8415012FA32DE9DC86
SHA-512:	8765216F2E245E0C329EE76A2DA9082685C0A57DAB59E3C2B7242AF2D41B9E42B7850C943B3000D5331F77AA57DE01B3134DA7C0744C67D852C25726FFA7B5A2
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........5.cYT.0YT.0YT.0P,)0ST.0...1[T.0b..1ZT.0b..1RT.0b..1_T.0b..1OT.0..w0XT.0..q0WT.0...1ZT.0YT.0$U.0...1nT.0...1XT.0..E0XT.0YT-0XT.0...1XT.0RichYT.0........................PE..d....J.Z.........." .........Z.......?.......................................04.....f.3...`A........................................@.*.$,..d.,.@.....3.......1.t....l3.......3..^..@M .p...................HN .(....M ..............................................text............................... ..`.rdata..............................@..@.data...`I...`,......J,.............@....pdata..t.....1.......1.............@..@.tls..........3.......3.............@....rsrc.........3.......3.............@..@.reloc...^....3..`....3.............@..B................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073659836993925
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrJ:KooCEYhgYEL0In
MD5:	7D3DF8B547ABDFA1251FC8E51E42E7CF
SHA1:	7D2E7B3EB7497DF90FCF1F48EBF7A35E8204ADC2
SHA-256:	DC0800A467444FDEFB56B886D9ED62FDA55E8548DD350BEC33BA778066B25A4A
SHA-512:	BCABC3B02BB488368FFBD658EFEC547892FB96AA48BE98E92AA3A9FFA4EF706376D8C587F2F7F50BCB9A99E8DB9E53FD9DC86F6517D43B1CA3044518BAEE20C4
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x83a51d1a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42217571517024904
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	0B3BEAC5360C7A450937BFC300A9A0A2
SHA1:	947926C23FAA8675775A6CFEB51CA8B7E69A1FD7
SHA-256:	F6FFC6496BFBFFA8467C777783DF99BAF1C79E934C63F768D11BB109BBD9D733
SHA-512:	93BDD035791B29DCC9814F636B8C7A337593601A4F38605D1019D2199A59570BFCBF197DF4F77865E979D73732BDA05F3B8B291BAB8B76735767DB0511FDF3A7
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A.'2...\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................'2...\|7.................1...'2...\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.077282837629612
Encrypted:	false
SSDEEP:	3:A2/lEYe14MZkjn13a/KRN/PyBtollcVO/lnlZMxZNQl:A2/yz1rZk53qK7CcOewk
MD5:	61CD9CF632A90BEA99EE26FD9FB84E2B
SHA1:	743892386E5704978EA54FF029A9600EBA679F2C
SHA-256:	1A4CE722A2EFB19DC73698EDF500DD577341786CDD76DBC7E911A470BAADF706
SHA-512:	4043C233EC2129308DEDB8B8A6B4C24F9584EFC0088C942A85132B9C9DE2836F73C424B3F9CB93CF4D89513C01034507CEFFEC128A49A6A850DFF1AA60354D8C
Malicious:	false
Preview:	..z......................................;...{..'2...\|.......{A..............{A......{A..........{A]................1...'2...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarWind Software\StarWind V2V Converter\StarWind V2V Converter.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Apr 26 14:49:40 2024, mtime=Fri Apr 26 14:49:40 2024, atime=Wed Nov 8 12:10:16 2023, length=3885672, window=hide
Category:	dropped
Size (bytes):	1198
Entropy (8bit):	4.513808522082519
Encrypted:	false
SSDEEP:	24:8mJdldzc1gEQXIJrR06DV9AYxbmlz8dHgEI6ONdHgEI6tyzBm:8mBdQ1BQXkrefYBoz8dHBI5dHBIIC
MD5:	2215C9A71A7BFD06F95850AAED12D838
SHA1:	30048FC77D35107B1F68447855EF60757BA0D778
SHA-256:	1FA72E5150A576F3269DA67926D722E56E565B81C8E07EC467F105DD2391FED6
SHA-512:	E3E978995FBBD1BC55072155AE524C01A7BB99BB8F0FD90CF1D0ECE8C6DCE471D2EF187BB1446BE37419B8BF1A04C09EF42DD55E9F611B72626D78638EA816AF
Malicious:	false
Preview:	L..................F.... .....eY...DjvY.....^.D...hJ;..........................P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDWQ`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......X5~..STARWI~1..T......X5~.X5~..........................!..S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.....v.1......X7~..STARWI~1..^......X5~.X7~..........................cf.S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.e.r.....p.2.hJ;.hWHi .V2V_CO~1.EXE..T......X5~.X5~....y.........................V.2.V._.C.o.n.v.e.r.t.e.r...e.x.e.......z...............-.......y............]G......C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe..].....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.\.S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.e.r.\.V.2.V._.C.o.n.v.e.r.t.e.r...e.x.e.9.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.\.S.t.a.r.W.i.n.d

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarWind Software\StarWind V2V Converter\Uninstall.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Apr 26 14:49:40 2024, mtime=Fri Apr 26 14:49:40 2024, atime=Fri Apr 26 14:49:02 2024, length=1015912, window=hide
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	4.544052535314114
Encrypted:	false
SSDEEP:	24:8mqbdzL1gEQ3JW6/2wwUADxbmlddHgEI6NsdHgEI6tyA+Vr+VoBm:8mudv1BQZWw0DBoddHBIQsdHBIInAx
MD5:	FE92EEDA4BF871ED9E850E07B1442C09
SHA1:	10C5871DE0D12393B72733EEDC635100796D0A9D
SHA-256:	1A0C94051D390E0BE5D1A8C84FB60699544FF0BB0EAEC68EA451F7A12CEC5136
SHA-512:	2AA6CC29CC150AFA3F7ADE2EEE8B7A7AB1D71E6FA93AD57CEDC8B8AD423C09668DA49ABCCAFFE934CBBF6C2B0DB0CC5B3A94A815BDA175DA9EF9905978A22E01
Malicious:	false
Preview:	L..................F.... .....`Y.....`Y....^.C...h............................P.O. .:i.....+00.../C:\.....................1......X5~..PROGRA~1..t......O.I.X<~....B...............J......!..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......X5~..STARWI~1..T......X5~.X<~..........................!..S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.....v.1......X:~..STARWI~1..^......X5~.X<~.........................Jo..S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.e.r.....f.2.h....X"~ .unins000.exe..J......X5~.X5~.........................j9..u.n.i.n.s.0.0.0...e.x.e.......u...............-.......t............]G......C:\Program Files\StarWind Software\StarWind V2V Converter\unins000.exe..X.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.\.S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.e.r.\.u.n.i.n.s.0.0.0...e.x.e.9.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.\.S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.

C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\state.rsm

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	2.5730774581648626
Encrypted:	false
SSDEEP:	12:GZK34pgMClGttDq+xUFZMAKL+ftun2QllubdpZgEE2A6lX1yT:cKUgMClc2ZMAKKdHgEI6V1y
MD5:	9DAA04A059A50AD78BF3EDB366F0485A
SHA1:	AE2749CCF79489B4940D23B9911409EDDE626755
SHA-256:	C8BA6F803D14858E911418ACABF9F22EDE64A85DC3005EB8F898CFEF9CAEDB58
SHA-512:	85828E9C074E0DBD443CB6FCFC562D5190D4BBEE46DEE3293D93F30D20E32023D98937ACC2083997B97DB5F642117BED01D67D9CB028369B78FDAA9C7E0EA0B0
Malicious:	false
Preview:	A.......................................................................................................................................................................................................................W.i.x.B.u.n.d.l.e.F.o.r.c.e.d.R.e.s.t.a.r.t.P.a.c.k.a.g.e.................W.i.x.B.u.n.d.l.e.L.a.s.t.U.s.e.d.S.o.u.r.c.e.............................W.i.x.B.u.n.d.l.e.N.a.m.e.....<...M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.3. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.2...0...3.0.5.0.1.........W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.....R...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.\.S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.e.r.\.v.c.\.v.c._.r.e.d.i.s.t...x.6.4...1.3.0...e.x.e.....................

C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	461400
Entropy (8bit):	6.929902355722629
Encrypted:	false
SSDEEP:	12288:IymOcB+pwPprnVmLmDsC+FU+ZOSzt9tzZ:ILOsDFncLmKDZOSzXFZ
MD5:	E16E6D68CE1949C9721656390F47CE07
SHA1:	9009CCA5DC05E22F4CF0D8529A473F19B363103B
SHA-256:	18E6D3D96FCD39BA069C0E6EBC108881EC5BB07E29A24B0177688CE391DAC526
SHA-512:	63A179E4DB0CB7954DDC9AEE9E3C7AECAE9E160154243B248B94647EB8DEFAFB7041EE291F6F880DC3CA7F298DD548E4B3CF0B650E9A7E34F34D2D2F0DD36127
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0......<.....@.................................t!..,........7...............>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Users\Public\Desktop\StarWind V2V Converter.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Apr 26 14:49:40 2024, mtime=Fri Apr 26 14:49:54 2024, atime=Wed Nov 8 12:10:16 2023, length=3885672, window=hide
Category:	dropped
Size (bytes):	1174
Entropy (8bit):	4.52850657116078
Encrypted:	false
SSDEEP:	24:8mD1BdzL1gEQ3JW6DV9AYxbmlzwdHgEI6ONdHgEI6tyzBm:8m3dv1BQZWfYBozwdHBI5dHBIIC
MD5:	B61096EBF58C2A4F9FADE3B5A04017DC
SHA1:	60F795A6AE1FC68E7C98EA33E89A8F297097932B
SHA-256:	3B7B541E5E12856812D3896134936D15EE92A4F24F173A5B1512EA0958EAB518
SHA-512:	7168DB51015316A0A9BF9B7785352FA0E747735964706B19194EF475933C64150DFD5FAE37C105A7DC1A8307E954CFD674BAF3A77042ADC8CDA8E10A004F3BDB
Malicious:	false
Preview:	L..................F.... .....eY......b.....^.D...hJ;..........................P.O. .:i.....+00.../C:\.....................1......X5~..PROGRA~1..t......O.I.X<~....B...............J......!..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......X5~..STARWI~1..T......X5~.X<~..........................!..S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.....v.1......X:~..STARWI~1..^......X5~.X<~.........................Jo..S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.e.r.....p.2.hJ;.hWHi .V2V_CO~1.EXE..T......X5~.X5~....y.........................V.2.V._.C.o.n.v.e.r.t.e.r...e.x.e.......z...............-.......y............]G......C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe..Q.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.\.S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.e.r.\.V.2.V._.C.o.n.v.e.r.t.e.r...e.x.e.9.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.\.S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240426175001.log

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	ASCII text, with very long lines (322), with CRLF line terminators
Category:	dropped
Size (bytes):	8929
Entropy (8bit):	5.5384056692381805
Encrypted:	false
SSDEEP:	192:So+k7q8XHzb5AjNjz8MuUCMrG4Kt1sdMAi:RV7q8X5Ah/JBKt1PAi
MD5:	7EDA1D7C713285BC2A8CA159037129EF
SHA1:	570EBA19DB94C7FEC8E38E4A3058D520E0DE1228
SHA-256:	7AA261BE9D0583A5094DCF7F93E963012A659D35356D28AA1F239B10024A0D5F
SHA-512:	D1CD567724715C3B8886030AF7EA0D6B152C2A2B3304E528B3E47D0998BDB82ADFCDFCC33CD2300DCE45A97FB5B8F710763A1F2D9681887C15E2E10AC0E3309E
Malicious:	false
Preview:	[16B0:038C][2024-04-26T17:50:01]i001: Burn v3.7.2829.0, Windows v6.3 (Build 9600: Service Pack 0), path: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe, cmdline: '/quiet -burn.unelevated BurnPipe.{D7692551-F3D1-4F96-B98C-6EA8EBCE2C29} {99F278BD-B402-4D45-B367-3A71E4C78909} 4116'..[16B0:038C][2024-04-26T17:50:01]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240426175001.log'..[16B0:038C][2024-04-26T17:50:01]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe'..[16B0:038C][2024-04-26T17:50:01]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501'..[16B0:038C][2024-04-26T17:50:01]i100: Detect begin, 2 packages..[16B0:038C][2024-04-26T17:50:01]i101: Detected package: vcRuntimeMinimum_x64, state: Absent, cached: None..[16B0:038C][2024-0

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240426175001_0_vcRuntimeMinimum_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (588), with CRLF line terminators
Category:	dropped
Size (bytes):	175144
Entropy (8bit):	3.7955608106643792
Encrypted:	false
SSDEEP:	1536:juwwfCyac1V7/9zZTolxpJuIEhJem5nvnteed0vGmdqb9HI1HcRqT/+jGklluuPO:jNEjGklluuPgeDes1Fil
MD5:	34FA95C2DB3B7630795060B4569FE5BE
SHA1:	EC4CFE39362895FAC106E1EE0CFD300241E1D329
SHA-256:	CBAB1904CAB35CE9FD9ED17749458E6F6FFAB4B9DC5CF2697693E32A975CC4A8
SHA-512:	493CF3CC755F7A7099D8D33AB737B2E35D0A81EE23106DBA4A856FE0A9DB05D71B6422678A27DE9C44B43E2402046916294F04783E329A2ACAAF115A4C7C7457
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.6./.0.4./.2.0.2.4. . .1.7.:.5.0.:.2.7. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.\.S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.e.r.\.v.c.\.v.c._.r.e.d.i.s.t...x.6.4...1.3.0...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.1.4.:.9.8.). .[.1.7.:.5.0.:.2.8.:.3.5.1.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.1.4.:.9.8.). .[.1.7.:.5.0.:.2.8.:.3.5.1.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.1.4.:.9.8.). .[.1.7.:.5.0.:.2.8.:.3.5.1.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.A.7.4.9.D.8.E.6.-.B.6.1.3.-.3.B.E.3.-.8.F.5.F.-.0.4.5.C.8.4.E.B.A.2.9.B.}.v.1.2...0...2.1.0.0.5.\.p.a.c.k.a.g.e.s.\.v.c.R.u.

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240426175001_1_vcRuntimeAdditional_x64.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (588), with CRLF line terminators
Category:	dropped
Size (bytes):	197528
Entropy (8bit):	3.8063608255046315
Encrypted:	false
SSDEEP:	3072:txSjdsWrrrrrrrrrreeeTTd36BhJcoHVOYyGh+A:OjN
MD5:	F8445C2C6EF32B859012D48BE7FDD9C3
SHA1:	C474585BB7B3D2F530D13F185469513981DB3E66
SHA-256:	4A8E311AD8CD6D5087B2FD58A6404D1FBAA040B8B852D05FC44E51539F59BCAC
SHA-512:	18CC285413A5803715DC21BDA2B23C10E3D9A88695C90E099F9195EE147C644C974CD4E5577E3224FBA5F2E04248A820679876962F42F9E5CA987C264A37D648
Malicious:	false
Preview:	..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .2.6./.0.4./.2.0.2.4. . .1.7.:.5.0.:.3.0. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.S.t.a.r.W.i.n.d. .S.o.f.t.w.a.r.e.\.S.t.a.r.W.i.n.d. .V.2.V. .C.o.n.v.e.r.t.e.r.\.v.c.\.v.c._.r.e.d.i.s.t...x.6.4...1.3.0...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.1.4.:.1.C.). .[.1.7.:.5.0.:.3.0.:.8.3.5.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.1.4.:.1.C.). .[.1.7.:.5.0.:.3.0.:.8.3.5.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.1.4.:.1.C.). .[.1.7.:.5.0.:.3.0.:.8.3.5.].:. ........ .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . ........ .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.9.2.9.F.B.D.2.6.-.9.0.2.0.-.3.9.9.B.-.9.A.7.A.-.7.5.1.D.6.1.F.0.B.9.4.2.}.v.1.2...0...2.1.0.0.5.\.p.a.c.k.a.g.e.s.\.v.c.R.u.

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240426175040.log

Download File

Process:	C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	863
Entropy (8bit):	5.391316308394698
Encrypted:	false
SSDEEP:	24:JctGMsLzATvuZvcP2UfkuHqInXemK+ynVDmK+yTRNcCZc:6t1QlIhku2ZvDZRa
MD5:	91E14033012FFFEFCF57B9529CBACEC9
SHA1:	7715504B8B47A908E15EDFDF2D630618AE57DA6A
SHA-256:	1D23F2A0206218CBC6CE59A448CF40ECB0EAAA74B4608D7DC8CE9B6286E2F2C1
SHA-512:	429F863D43747D1472380C619EA57A08790ED0F40A0AF7D9DE1E4B519BFE538EA307F17DE885603F58EF3419CEDE031C8112E0103444BEA4724C1FE24F4CAFF5
Malicious:	false
Preview:	[07C8:0DA8][2024-04-26T17:50:39]i001: Burn v3.7.2829.0, Windows v6.3 (Build 9600: Service Pack 0), path: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe, cmdline: ''..[07C8:0DA8][2024-04-26T17:50:40]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240426175040.log'..[07C8:0DA8][2024-04-26T17:50:40]i100: Detect begin, 2 packages..[07C8:0DA8][2024-04-26T17:50:40]i101: Detected package: vcRuntimeMinimum_x64, state: Present, cached: Complete..[07C8:0DA8][2024-04-26T17:50:40]i101: Detected package: vcRuntimeAdditional_x64, state: Present, cached: Complete..[07C8:0DA8][2024-04-26T17:50:40]i052: Condition 'VersionNT64 >= v6.0 OR (VersionNT64 = v5.2 AND ServicePackLevel >= 1)' evaluates to true...[07C8:0DA8][2024-04-26T17:50:40]i199: Detect complete, result: 0x0..

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240426175041.log

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	ASCII text, with very long lines (317), with CRLF line terminators
Category:	dropped
Size (bytes):	6652
Entropy (8bit):	5.499428390454036
Encrypted:	false
SSDEEP:	192:qHlwDNjl1cm14N14N14N14N14N14N14N14Vuu7GpqP:K0hR7R
MD5:	AF320F68FEC63BA6DE6CC6E9B1D5084D
SHA1:	73DBC8874A0451D29D61AAD1E4A1CACAB0E98CC5
SHA-256:	AAB5AEFC3E0C6BEDDACBBECFE1C725115BCDE29AE7A6C627D9C334F52997D461
SHA-512:	4529AEE27C80CE2ECBFDC93F3BFE18E0EA5594BF0972A39D0DA4D46644416518B2AB5E810A864F9517FE1B26530CED6EFD5DFC8741FB105D66BD905FC0696A2D
Malicious:	false
Preview:	[09E8:065C][2024-04-26T17:50:40]i001: Burn v3.7.3813.0, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe, cmdline: '/quiet -burn.unelevated BurnPipe.{621695C5-B52A-43D6-BAAE-CEAD8A9F5342} {3E01C30D-E9A5-4BF9-AFE0-A4D60C443091} 3452'..[09E8:065C][2024-04-26T17:50:41]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20240426175041.log'..[09E8:065C][2024-04-26T17:50:41]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe'..[09E8:065C][2024-04-26T17:50:41]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Program Files\StarWind Software\StarWind V2V Converter\vc\'..[09E8:065C][2024-04-26T17:50:42]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026'..[09E8:065C][2024-04

C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp

Download File

Process:	C:\Users\user\Desktop\starwindconverter.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1015912
Entropy (8bit):	5.6679566867305695
Encrypted:	false
SSDEEP:	24576:YMcMoi3rPR37dzHRA6G7WbuSEmK50PGyx9ZGc:YMrPR37dzHRA6GCbB80zh
MD5:	2356F5F81D797DFA2A9C35E973358693
SHA1:	EA1E81CFE3B0E8F4B09EEBCBF85593E501F4575F
SHA-256:	DCF16311954DBD5585DF660D65F049F5E2CA22303D99B3BAFBA872AE1790882A
SHA-512:	4C104E1A30F0A81C3E920264513B478A26B57F029E4E574C74BB5AC1931B9C1F62BBEB9BD3AEB6318EE17738ED74066BE9CA271A3564F87D3F30E21EB5417D92
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0............@......@...............................&.......T..............hR...@...............................0......................................................CODE............................... ..`DATA.... ...........................@...BSS......................................idata...&.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..P....@......................@..P.rsrc....T.......V..................@..P.....................r..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-UGUD3.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\BootstrapperApplicationData.xml

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	5906
Entropy (8bit):	3.745782944389551
Encrypted:	false
SSDEEP:	96:X0eVJbgV2VBLHeBFbOjn6yeHqbP0wLyc08n6qLUemc4q4I0wMLrycNLihtrtvRtH:X001Ks1SbypIDpixLURhfzLG0LiFOBL8
MD5:	0BD4FA44198EB101D1F070BB99A12C0B
SHA1:	A2091705BA9B5FE87B5D9573243687367D16C7B7
SHA-256:	54BF9F4BC4ADCBBA99AEF3C048522C23822D3DDAB51891DCBA3B6F59192A2B28
SHA-512:	FD8BC5E440D1483FDB858A6F51CE14850E7D236B8EF0CED6DB64C8D213C5DEC552A8B377509830D12AF4A1FBD09006DA4CE04299DD6E686F2AD03E112E378E50
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.U.x.B.l.o.c.k.e.r. .S.h.o.r.t.N.a.m.e.=.".M.i.n.i.m.u.m.O.S.L.e.v.e.l.". .T.y.p.e.=.".S.t.o.p.". .C.o.n.d.i.t.i.o.n.=.".N.O.T.(.(.V.e.r.s.i.o.n.N.T. .&.g.t.;. .v.6...1.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.6...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).).". .D.i.s.p.l.a.y.T.e.x.t.=.".#.l.o.c...M.i.n.i.m.u.m.O.S.L.e.v.e.l.". ./.>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T.6.4. .&.g.t.;.=. .v.6...0. .O.R. .(.V.e.r.s.i.o.n.N.T.6.4. .=. .v.5...2. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .X.P. .S.P.1. .(.

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	6841
Entropy (8bit):	5.231818976502303
Encrypted:	false
SSDEEP:	192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
MD5:	1E47EE7B71B22488068343DF4CE30534
SHA1:	DEAEE13F21AB70B57F44F0AA3128EC7AD9E3816A
SHA-256:	8518F0420972C1DBE8A323FFC6F57863AF0B80C6A3B27FD0C6FC9BDABB7E2D13
SHA-512:	C4C653BFD1FC493B0EFD8F9C75495287818179DC35969D1FB1927FAAC3FF9189FDE1131C5ABBCC3963F707412A7F8AD05A9E6855B7D47D6DF1F80D25D67BE9ED
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\\generator Riched20 6.2.9200}{\\mmathPr\mnaryLim0\mdispDef1\mwrapIndent1440 }\viewkind4\uc1 ..\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT SOFTWARE LICENSE TERMS\par....\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 MICROSOFT VISUAL C++ REDISTRIBUTABLE FOR VISUAL STUDIO 2013 \par....\pard\nowidctlpar\sb120\sa120\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. Please read them. They apply to the software named above, which includes the media on which you received it, if any. The terms also apply to any Microsoft\par....\pard\nowidctlpar\fi-360\li360\sb120\sa120\f1\'b7\tab\f0 updates,\par..\f1\'b7\tab\f0 supplements,\par..\f1\'b7\tab\f0 Internet-based services, and\par..\f1\'b7\tab\f0 support services\pa

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\logo.png

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:	24:q36cnTKM/3kTIQiBmYKHeQWalGt1Sj9kYIt1uZ+bYOQe0IChR95aW:qqiTKMPuUBm7eQJGtYJM1uZCVszaW
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:	48:c5DiTl/+desK19hDUNKwsqq8+JIDxN3mt7NlN1NVvAdMcgLPDHVXK8KTKjKnSnYF:uDiTl/BbTxmup/vrxATd
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\thm.xml

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5881
Entropy (8bit):	5.175177119212422
Encrypted:	false
SSDEEP:	96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
MD5:	0056F10A42638EA8B4BEFC614741DDD6
SHA1:	61D488CFBEA063E028A947CB1610EE372D873C9F
SHA-256:	6B1BA0DEA830E556A58C883290FAA5D49C064E546CBFCD0451596A10CC693F87
SHA-512:	5764EC92F65ACC4EBE4DE1E2B58B8817E81E0A6BC2F6E451317347E28D66E1E6A3773D7F18BE067BBB2CB52EF1FA267754AD2BF2529286CF53730A03409D398E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="64" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader)</T

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	6.262646414883502
Encrypted:	false
SSDEEP:	1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
MD5:	A52E5220EFB60813B31A82D101A97DCB
SHA1:	56E16E4DF0944CB07E73A01301886644F062D79B
SHA-256:	E7C8E7EDD9112137895820E789BAAAECA41626B01FB99FEDE82968DDB66D02CF
SHA-512:	D6565BA18B5B9795D6BDE3EF94D8F7CD77BF8BB69BA3FE7ADEFB80FC7C5D888CDFDC79238D86A0839846AEA4A1E51FC0CAED3D62F7054885E8B15FAD9F6C654E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................x=....x...... .....0.....n..x.....x8....x9....x>...Rich..........................PE..L......R...........!.....2..........1........P...............................0.......1....@.............................................l...........................0S..............................`...@............P...............................text...M0.......2.................. ..`.rdata..yd...P...f...6..............@..@.data..../..........................@....rsrc...l...........................@..@.reloc..B ......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.be\vcredist_x64.exe

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	461400
Entropy (8bit):	6.929902355722629
Encrypted:	false
SSDEEP:	12288:IymOcB+pwPprnVmLmDsC+FU+ZOSzt9tzZ:ILOsDFncLmKDZOSzXFZ
MD5:	E16E6D68CE1949C9721656390F47CE07
SHA1:	9009CCA5DC05E22F4CF0D8529A473F19B363103B
SHA-256:	18E6D3D96FCD39BA069C0E6EBC108881EC5BB07E29A24B0177688CE391DAC526
SHA-512:	63A179E4DB0CB7954DDC9AEE9E3C7AECAE9E160154243B248B94647EB8DEFAFB7041EE291F6F880DC3CA7F298DD548E4B3CF0B650E9A7E34F34D2D2F0DD36127
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.V...8...8...8.......8.....n.8......8......8...9.I.8.....l.8.......8.......8.......8.Rich..8.................PE..L....._S.....................,.......~............@..........................0......<.....@.................................t!..,........7...............>......$2......................... ...........@............................................text...t........................... ..`.rdata..............................@..@.data... 0...@.......,..............@....wixburn8............<..............@..@.tls.................>..............@....rsrc....7.......8...@..............@..@.reloc...B.......D...x..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	Microsoft Cabinet archive data, 5572128 bytes, 14 files, at 0x44 +A "F_CENTRAL_mfc120_x64" +A "F_CENTRAL_mfc120chs_x64", flags 0x4, number 1, extra bytes 20 in head, 369 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	5588256
Entropy (8bit):	7.99767041850619
Encrypted:	true
SSDEEP:	98304:Hg4abEOU/Md/0jHDSSBEnOEEYiCh36RawfXnZGZ+O/nBymG6YvO3ukHkEV6xhJch:A44EOU/Mp0CKCLE7ChqRawcZ+Ensf6Ow
MD5:	0BEEF111C0BFB2062C0BB46AA1370063
SHA1:	BD7528FEA489F81F79D6EFCFE018DA1C6C9B2103
SHA-256:	4FFACA883B53AB6DF5898C7B1E1F02D39CEB33E2061E77A6C4F42984395568C0
SHA-512:	873CE73ABBB6FD228C49870461C48DEAFB967536D0BA3CD21CBC479824553B69FD774DC7C0D2110FEB0E198AAC27390A118E84D925FEF257FDAB21321ED9C430
Malicious:	false
Preview:	MSCF.... .U.....D........................... .U..?..........l...q.....U.......DCL. .F_CENTRAL_mfc120_x64.......U...DCL. .F_CENTRAL_mfc120chs_x64.....@GV...DCL. .F_CENTRAL_mfc120cht_x64..$....V...DCL. .F_CENTRAL_mfc120deu_x64...... X...DCL. .F_CENTRAL_mfc120enu_x64.. ..8.Y...DCL. .F_CENTRAL_mfc120esn_x64..$...?Z...DCL. .F_CENTRAL_mfc120fra_x64......d[...DCL. .F_CENTRAL_mfc120ita_x64.....0.\...DCL. .F_CENTRAL_mfc120jpn_x64......S]...DCL. .F_CENTRAL_mfc120kor_x64......$^...DCL. .F_CENTRAL_mfc120rus_x64...U.(9_...DCL. .F_CENTRAL_mfc120u_x64..f...3....DCL. .F_CENTRAL_mfcm120_x64..f..h.....DCL. .F_CENTRAL_mfcm120u_x64.....8;..CK.}.xT....$K........]...n..]..].@.3.J..X..v%...%.e\.O.bK......! U.BM"..DP.Q{.B........#.....}......g.s.33.N..V%.J....hT..I..#...N.$...r.........s.....w.......1s.9...w.r...q.3.Q0n.....uu..]2u..'...........?.Wi....Jo...?e...7S}...?.R{..R.k./!X.......?....?.........+).......Gc-......$=.y.x..E...5..$=....T..S.l.]j..1."I. ."qJ.....N.........3g7..Q...I

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\cab5046A8AB272BF37297BB7928664C9503

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	Microsoft Cabinet archive data, 1018378 bytes, 5 files, at 0x44 +A "F_CENTRAL_msvcp120_x64" +A "F_CENTRAL_msvcr120_x64", flags 0x4, number 1, extra bytes 20 in head, 80 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1034506
Entropy (8bit):	7.9961086563023605
Encrypted:	true
SSDEEP:	24576:0oyrq0XyESRH8bAWElH8ffJjZXfOBJtTHO:0oyrqzbRuRElWxjZPONu
MD5:	8A8D47DCEA8F149B188D55EE80C2EA2D
SHA1:	DFDB1EAC5EACF6B094897D12699970CC02CDFA6C
SHA-256:	9B805FFEE2DAEAB2F0A074026D07CE1050CA0B20778D1C8A649FE07241CCFA65
SHA-512:	EF081B2B401A779FB374874D26C65C4C7D2E70C980946E343C135DEA67C3C78B1134FB3D69FB1366C5E88B729490B99250304AEA5413ECE9AE6D29690D520A3F
Malicious:	false
Preview:	MSCF............D................................?..............P.............DCL. .F_CENTRAL_msvcp120_x64...........DCL. .F_CENTRAL_msvcr120_x64..Z..@.....DCL. .F_CENTRAL_vcamp120_x64..p.... ...DCL. .F_CENTRAL_vccorlib120_x64.......%...DCL. .F_CENTRAL_vcomp120_x64....o.4..CK.}.x.E.xO2.&......`.qU6.P0.NH"=f.......w....s......x.......xL.$..! ......t!...^U....p....../.N...w.wT5.7W... ..G..a.....3.g...=..(.....u&...G..>.YT\|...w;'N..{..['9.K.q.~.3k.H....6.Wbb.d..C.N.....P.i.cL.t..0..K....;..=..0~.......>N..O....s.u(]G.>...$!/[.n.?N.`...Y.p..CL.0."......j..y&...1................u.Io._Z..n.F..._........@{AE.4....uw..r.".^8..H.[......qBQ...aa\...J.p.q..!....a.@]...&x'.B..c.O..\.,ap.;.^.L.\.c..B?.......b.D#..p........x.b<....M..^.D.!...p...n.....D%..."4.....*.7..Nx..........jZ<>.yz.....@v._].+.a.X.1....]#..S.7d[....5.7..t..#.....:.%.$.S......9...:....e.4...x....D../...).....c...#......a.c..b....x:.t.;..z#.......:\|. ]...+N.....u7..-.&y.......F,z..N.s....

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcRuntimeAdditional_x64

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005., Template: x64;1033, Revision Number: {0990E7AB-85D7-456A-B8F8-1E1E56A29571}, Create Time/Date: Sat Oct 5 11:36:18 2013, Last Saved Time/Date: Sat Oct 5 11:36:18 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.7908315301004905
Encrypted:	false
SSDEEP:	3072:gJRJyjFGJvLIcXcSqviQICInggp/lVNmbQ8K:vSIcXgvi37k
MD5:	03FF53F29935C047D7630297E17B96E1
SHA1:	6F922B2D00A6C3274B39F0161C9B89C7AEFA9EB5
SHA-256:	F2C8327F44A0B47619AF5B47D37A90D0F3F7C61D94768AEFE8D8ADFC84A8ED55
SHA-512:	93F5CCB7B276CB089E511201417F522B34E8F7794CEFA8A24440C22B03C8AF81602852E42AC13BEF6078A212D746FB22E76CA72BFC8D185757FCB4B88CBF89B6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcRuntimeMinimum_x64

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005., Template: x64;1033, Revision Number: {FE26E34E-F44B-4B4D-A2C9-878D87759F44}, Create Time/Date: Sat Oct 5 11:36:26 2013, Last Saved Time/Date: Sat Oct 5 11:36:26 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.731930109143771
Encrypted:	false
SSDEEP:	3072:qPSJyjFGJvLIcXcSqviQICInggioVNmzM+8:0SIcXgvi3L8
MD5:	6DC9B26E10641A0D15DCC60A26B38906
SHA1:	68AD317CD51C85AAFECD11E765823B39E0EE952E
SHA-256:	25284A481A749AA531682505AAAFDCFA929318E9970EF94B64EBDACC3A089490
SHA-512:	9312DD991FA80113D2732A53E85EF3762D89812F64626FF37B1213694FD2E27B7304FAD06FC7FA161BE6F377206BEB6CE88609E4D161A24E6927F59FDF7DD8D3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1028\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	19250
Entropy (8bit):	3.864921893310236
Encrypted:	false
SSDEEP:	384:4SZpPZ/3iBY72U+qpHZiehErmuszMZ+sDtfnDTy+8vmp2:4epx/S57w5Hh1hUVVDo
MD5:	EFA0E0316DBE1D01B04DB8AE55216E89
SHA1:	99E9A3879E14465D3ABE47E03A0EB52ECB7C1FCC
SHA-256:	D5147EE2BA7826D5B68E0DC10FC2AC95079F89C38264C5648D924DEC9290D085
SHA-512:	B544D5C585981DDADF1822403FFF5A4765031C2B484AB88A821C626B88CA3286269B1914E2F39B7D25AE748B69C8BC8D5CE7141BF72ACACC09E1888F623C3E38
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\froman\fprq2\fcharset136 PMingLiU;}{\f2\fswiss\fprq2\fcharset0 Segoe UI;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue0;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\sb120\sa120\cf1\b\f0\fs20 MICROSOFT \f1\'b3\'6e\'c5\'e9\'b1\'c2\'c5\'76\'b1\'f8\'b4\'da\f0\par..\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120 MICROSOFT VISUAL STUDIO 2015 \f1\'a5\'5b\'ad\'c8\'a1\'42\f0 VISUAL STUDIO SHELL \f1\'a9\'4d\f0 C++ REDISTRIBUTABLE\par..\pard\sb120\sa120\b0\f1\'a5\'bb\'b1\'c2\'c5\'76\'b1\'f8\'b4\'da\'ac\'4f\'a1\'40\'b6\'51\'a5\'ce\'a4\'e1\'bb\'50\f0 Microsoft Corporation (\f1\'a9\'ce\'a8\'e4\'c3\'f6\'ab\'59\'a5\'f8\'b7\'7e\'a1\'41\'b5\'f8\'a1\'40\'b6\'51\'a5\'ce\'a4\'e1\'a9\'d2\'a9\'7e\'a6\'ed\'aa\'ba\'a6\'61\'c2\'49\'a6\'d3\'a9\'77\f0 ) \f1\'a4\'a7\'b6\'a1\'a6\'a8\'a5\'df\'aa\'ba

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1028\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.163758160900388
Encrypted:	false
SSDEEP:	48:c5DiTlOtMes9T/JhDXsA9EHSniarRFeOrw8N3mZNNTN2N08CEjMUWFPmDlTKJKy2:uDiTlFrDDsA9tfHP8+8nhM0WamzqDFqD
MD5:	472ABBEDCBAD24DBA5B5F5E8D02C340F
SHA1:	974F62B5C2E149C3879DD16E5A9DBB9406C3DB85
SHA-256:	8E2E660DFB66CB453E17F1B6991799678B1C8B350A55F9EBE2BA0028018A15AD
SHA-512:	676E29378AAED25DE6008D213EFA10D1F5AAD107833E218D71F697E728B7B5B57DE42E7A910F121948D7B1B47AB4F7AE63F71196C747E8AE2B4827F754FC2699
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">....</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ................. ......................../passive \| /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ............./log log.txt - .........

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1029\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11775
Entropy (8bit):	5.279979878308355
Encrypted:	false
SSDEEP:	192:FfsG7On1Fxe9Si9uCEBmFkyw9njfdml6t2VJOpwLXFxjjT+TTCjG+soSXjqZ71eM:aG7cPe9SiukkDjclQ2LOpw2TGjGrjYK2
MD5:	FD8353F3BC88A47B8880B59A5DAD3F03
SHA1:	22E908EF2DD80221CDE6C2BB1AE27099C5F5697D
SHA-256:	2428E8BA8FC9648422333B6B4B92FB476741FC1022DE7CB59D030EC35CC21AC7
SHA-512:	44FF2DF62CB7381EB247800CA4B9566747E1A7A2A2321A002D7F49681ECBC5E797C91B56EA80B99565D3ACFCD38DD1444C616A7E17F5F4D2923E6124E99EB7F0
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\colortbl ;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 LICEN\u268?N\'cd PODM\'cdNKY PRO SOFTWARE SPOLE\u268?NOSTI MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 DOPL\u327?KY PRO MICROSOFT VISUAL STUDIO 2015, SOFTWARE VISUAL STUDIO SHELL A C++ REDISTRIBUTABLE\par..\pard\nowidctlpar\sb120\sa120\b0 Tyto licen\u269?n\'ed podm\'ednky p\u345?edstavuj\'ed smlouvu mezi spole\u269?nost\'ed Microsoft Corporation (nebo n\u283?kterou z\~jej\'edch afilac\'ed v\~z\'e1vislosti na tom, kde bydl\'edte) a\~v\'e1mi. Vztahuj\'ed se na v\'fd\'9ae uveden\'fd software. Podm\'ednky se rovn\u283?\'9e vztahuj\'ed na jak\'e9koli slu\'9eby Microsoft nebo aktualizace pro software, pokud se na slu\'9eby nebo aktualizace nevztahuj\'ed odli\'9an\'e9 podm\'ednky.\par..\pard\brdrt\brdrs\brdrw10\brsp20 \nowidc

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1029\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3333
Entropy (8bit):	5.370651462060085
Encrypted:	false
SSDEEP:	48:c5DiTlOtesM6H2hDdxHOjZxsaIIy3Iy5sDMN3mkNFN7NwcfiPc3hKPnWZLF0hKqZ:uDiTlVxxHOy/9xXfpZJYnL8xK2S
MD5:	16343005D29EC431891B02F048C7F581
SHA1:	85A14C40C482D9351271F6119D272D19407C3CE9
SHA-256:	07FB3EC174F25DFBE532D9D739234D9DFDA8E9D34F01FE660C5B4D56989FA779
SHA-512:	FF1AE9C21DCFB018DD4EC82A6D43362CB8C591E21F45DD1C25955D83D328B57C8D454BBE33FBC73A70DADF1DFB3AE27502C9B3A8A3FF2DA97085CA0D9A68AB03
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instala.n. program [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da nastaven.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive \| /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz. mo.nost. je zobrazen. u.ivatelsk.ho rozhran. a v.ech v.zev...../noresta

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1031\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	12146
Entropy (8bit):	5.128850756720655
Encrypted:	false
SSDEEP:	192:cfj4zX2QaegOWQVa9MexKc1lzqQqE30PLdrAKfZ0wXodM3JXnGVveyOejIURMrRu:9zGQaegxma9nV/n3+KdM3JXGVWyOejIW
MD5:	B4A1F60A329E18DD44C19F91E19E9A0D
SHA1:	9A27B68A23BE4AA2CBD1F0F4D4616DF52A74134F
SHA-256:	C017EDFE3B0D308E20FBF3DE8795FD4451A530475A2D0EE0824E166045EADFB7
SHA-512:	D7E571B66271F82C275FE7B83C67679352B9B37AACBC13692346F8D56D01F4C61001B46C64F118F3165DE39B5F6DD625703996E1A181743BFDF2263F50707067
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1031\b\f0\fs20 MICROSOFT-SOFTWARE-LIZENZBESTIMMUNGEN\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 ADD-ONs ZU MICROSOFT VISUAL STUDIO 2015, VISUAL STUDIO SHELLS und C++ REDISTRIBUTABLE \par..\pard\nowidctlpar\sb120\sa120\b0 Diese Lizenzbestimmungen sind ein Vertrag zwischen Ihnen und der Microsoft Corporation (bzw. abh\'e4ngig von Ihrem Wohnsitz einem mit Microsoft verbundenem Unternehmen). Sie gelten f\'fcr die oben genannte Software. Die Bestimmungen gelten ebenso f\'fcr jegliche von Microsoft angebotenen Dienste oder Updates f\'fcr die Software, sofern diesen keine anderen Bestimmungen beiliegen.\par..\pard\brdrt\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\b WENN SIE DIESE LIZENZBESTIMMUNGEN EINHALTEN, VERF\'dc

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1031\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	5.094097800535488
Encrypted:	false
SSDEEP:	48:c5DiTlOZuesXJhDEVTORNxSMoZN3mteNSiNGNsZuiAXEqicMwhPXbhu9KwKlK8Kq:uDiTl3N7xSbu0N8+AhSNnm
MD5:	561F3F32DB2453647D1992D4D932E872
SHA1:	109548642FB7C5CC0159BEDDBCF7752B12B264C0
SHA-256:	8E0DCA6E085744BFCBFF46F7DCBCFA6FBD722DFA52013EE8CEEAF682D7509581
SHA-512:	CEF8C80BEF8F88208E0751305DF519C3D2F1C84351A71098DC73392EC06CB61A4ACA35182A0822CF6934E8EE42196E2BCFE810CC859965A9F6F393858A1242DF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] - Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und alle Eingab

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1036\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	12019
Entropy (8bit):	5.040545489557448
Encrypted:	false
SSDEEP:	192:bOfw2cN7a0Xoz2S6Zw9GUSUQQGgAJArX/WFf+4QWi1hAWR73cmQZFFx0+k0btIUk:bucBa0Xoz2SmwDx/qf+41if9R7MmQvFe
MD5:	6F70759DF32F212DBB65464258ECEEAF
SHA1:	F8C597E00968431A66DCDD79A8DE95705976D39E
SHA-256:	C7F03DA5D9A7F689B8DCBD507FF0B3FA98DABA55616F902E5E47E9839B753E1F
SHA-512:	99309C17AF1A323AB905A3B610B46B9CE9201CF7083103D990CC4C6B509F28743D99A9BC17DFA7E89EDE4496BAC30FD86C9356ABA9F292BFBF591CE6B6B7EF3E
Malicious:	false
Preview:	{\rtf1\fbidis\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}{\f1\fswiss\fprq2\fcharset177 Tahoma;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\ltrpar\nowidctlpar\sb120\sa120\lang1036\b\f0\fs20 TERMES DU CONTRAT DE LICENCE LOGICIEL MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \ltrpar\nowidctlpar\sb120\sa120\lang1033 COMPL\'c9MENTS MICROSOFT VISUAL STUDIO\~2015, VISUAL STUDIO SHELL et C++ REDISTRIBUTABLE\par..\pard\ltrpar\nowidctlpar\sb120\sa120\lang1036\b0 Les pr\'e9sents termes du contrat de licence constituent un contrat entre Microsoft Corporation (ou en fonction du lieu o\'f9 vous vivez, l\rquote un de ses affili\'e9s) et vous. Ils s\rquote appliquent au logiciel vis\'e9 ci-dessus. Les termes s\rquote appliquent \'e9galement \'e0 tout service et \'e0 toute mise \'e0 jour Microsoft pour ce logiciel, \'e0 moins que d\rquote autres termes n\rquote accom

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1036\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3366
Entropy (8bit):	5.0912204406356905
Encrypted:	false
SSDEEP:	48:c5DiTlO1BesgKLhD1K8cocDSN3m4NlN2ZfNmXL8ePZFcZkLPqUf9fQKRLKeKqZfj:uDiTlABzH1/qt4qgcXY
MD5:	7B46AE8698459830A0F9116BC27DE7DF
SHA1:	D9BB14D483B88996A591392AE03E245CAE19C6C3
SHA-256:	704DDF2E60C1F292BE95C7C79EE48FE8BA8534CEB7CCF9A9EA68B1AD788AE9D4
SHA-512:	FC536DFADBCD81B42F611AC996059A6264E36ECF72A4AEE7D1E37B87AEFED290CC5251C09B68ED0C8719F655B163AD0782ACD8CE6332ED4AB4046C12D8E6DBF6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler.?</String>.. <String Id="HelpHeader">Aide du programme d'installation</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du groupe dans le r.pertoire. Install est l'option par d.faut...../passive \| /quiet - affiche une interface minimale, sans invite, ou n'affiche ni interface.. ni invite. Par d.faut, l'interface et toutes les invites sont affich.es...../norestart - supprime toutes les tentatives de red.

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1040\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11154
Entropy (8bit):	4.973186760735321
Encrypted:	false
SSDEEP:	192:cf8Pm1xkySJfhCkzgUzCTIS/Xhd6Imfy0P/KMK0L0zSdU1ZV/cO/92:A1x3CfhCGgUeTjd6TrKxnz2U1ZV/Jl2
MD5:	1D07E27F97CE22A58780A04227BE6465
SHA1:	2FCD519823F1664C59A959ACBEE37093EC94F62E
SHA-256:	F1214784C57AA3323426AF64D132045970717994EBA500B25283684DC1ADEBAA
SHA-512:	D66965269C9EA755266F9A76221528213648E2AA7AB2E6917BE356ECE279ACF69D0C1982FE3C4B8BD1BB79A094ABE98AE6578C6F6EC311D46CD2950390B23FCC
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1040\b\f0\fs20 CONDIZIONI DI LICENZA SOFTWARE MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 ADD-ON DI MICROSOFT VISUAL STUDIO 2015, VISUAL STUDIO SHELL e C++ REDISTRIBUTABLE\par..\pard\nowidctlpar\sb120\sa120\b0 Le presenti condizioni di licenza costituiscono il contratto tra Microsoft Corporation (o, in base al luogo di residenza del licenziatario, una delle sue consociate) e il licenziatario, Le presenti condizioni si applicano al software di cui sopra. Le condizioni si applicano inoltre a qualsiasi servizio o aggiornamento di Microsoft relativo al software, a meno che questo non sia accompagnato da condizioni differenti.\par..\pard\brdrt\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\b QUALORA IL LICENZI

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1040\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3319
Entropy (8bit):	5.019774955491369
Encrypted:	false
SSDEEP:	48:c5DiTlO1eesy+hD9BOtBFv5Vo8BbQhMNDJN3msNlNohNNz+wcPclM+PAoYKp+K/u:uDiTlfQvo8WutJ/s9FHNOJp
MD5:	D90BC60FA15299925986A52861B8E5D5
SHA1:	FADFCA9AB91B1AB4BD7F76132F712357BD6DB760
SHA-256:	0C57F40CC2091554307AA8A7C35DD38E4596E9513E9EFAE00AC30498EF4E9BC2
SHA-512:	11764D0E9F286B5AA7B1A9601170833E462A93A1E569A032FCBA9879174305582BD42794D4131B83FBCFBF1CF868A8D5382B11A4BD21F0F7D9B2E87E3C708C3F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . Install...../passive \| /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita viene visualizzata l'intera interfaccia utente e tutti i prompt...../norestart - annulla quals

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1041\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	32348
Entropy (8bit):	3.6789762165847035
Encrypted:	false
SSDEEP:	384:mR9uNGmkDfeg7PIlzAtXrZ4cprgU1fftG2:mvuNGhCg7PIqtX94pSl
MD5:	0D9DD57746D5609494B35314FA88FD93
SHA1:	8A7A57681813AE27F9579427B086685143073D13
SHA-256:	AC0D8E0EAAB1875909A6A6F106A37CD7468F87F71887A44263F5F0178F99C40B
SHA-512:	E365C8416C70581BB31629B8EC62C6581539A80C7A4C06D489C64978D84C55B37DAC72C09D1A89A2344E07F0F59BEB4F371D9C78F92D9903F431B3F0B94BBAF8
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset128 MS PGothic;}{\f1\fswiss\fprq2\fcharset0 Tahoma;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue0;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67\f1 \f0\'83\'5c\'83\'74\'83\'67\'83\'45\'83\'46\'83\'41\f1 \f0\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f1 MICROSOFT VISUAL STUDIO 2015 \f0\'83\'41\'83\'68\'83\'49\'83\'93\'81\'41\f1 VISUAL STUDIO SHELL\f0\'81\'41\'82\'a8\'82\'e6\'82\'d1\f1 C++ \f0\'8d\'c4\'94\'d0\'95\'7a\'89\'c2\'94\'5c\'83\'70\'83\'62\'83\'50\'81\'5b\'83\'57\f2\par..\pard\nowidctlpar\sb120\sa120\b0\f0\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67\f1

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1041\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3959
Entropy (8bit):	5.955167044943003
Encrypted:	false
SSDEEP:	96:uDiTlDuB1n+RNmvFo6bnpojeTPk0R/vueX5OA17IHdGWz:5uB1+gD1DU4EdGE
MD5:	DC81ED54FD28FC6DB6F139C8DA1BDED6
SHA1:	9C719C32844F78AAE523ADB8EE42A54D019C2B05
SHA-256:	6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
SHA-512:	FD759C42C7740EE9B42EA910D66B0FA3F813600FD29D074BB592E5E12F5EC09DB6B529680E54F7943821CEFE84CE155A151B89A355D99C25A920BF8F254AA008
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.. <Control Control="UninstallButton" X="270" Y="237" Width="120" Height="23"/>.. <Control Control="RepairButton" X="187" Y="237" Width="80" Height="23"/>.. .. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ............ ......... .........................

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1042\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	29329
Entropy (8bit):	3.8105626152255763
Encrypted:	false
SSDEEP:	768:FNhEWb6M6tjwqaCspiJJghACBXC+t6yIBdOHdhDNTJ:FngwqaL
MD5:	F6E7A2A05EFB4413295C156A179578A3
SHA1:	91036034CA0BBD9A30BFC0BC2045791D57E94005
SHA-256:	DCEFD9B37D78F37ED8AAEF70AC2BFCDE441DCFB97469A6AA6AF89C1FFADBF814
SHA-512:	029AA788A5B6E0194D5A52005CF0327C375196E54F7EBBCE2758A3E6684D6DDF6765519564C272ABF5EBEBEAA5A1B4B3C3F0DC9B5377DF151DCA825FEC02DBDF
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fswiss\fprq2\fcharset0 Tahoma;}{\f1\fswiss\fprq2\fcharset129 Gulim;}{\f2\froman\fprq2\fcharset0 Times New Roman;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT \f1\'bc\'d2\'c7\'c1\'c6\'ae\'bf\'fe\'be\'ee\f0 \f1\'bb\'e7\'bf\'eb\'b1\'c7\f0 \f1\'b0\'e8\'be\'e0\'bc\'ad\f2\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f0 MICROSOFT VISUAL STUDIO 2015 \f1\'c3\'df\'b0\'a1\f0 \f1\'b1\'e2\'b4\'c9\f0 , VISUAL STUDIO SHELL \f1\'b9\'d7\f0 C++ \f1\'c0\'e7\'b9\'e8\'c6\'f7\f0 \f1\'b0\'a1\'b4\'c9\f0 \f1\'c6\'d0\'c5\'b0\'c1\'f6\f0 \f2\par..\pard\nowidctlpar\sb120\sa120\b0\f1\'ba\'bb\f0 \f1\'bb\'e7\'bf\'eb\'b1\'c7\f0 \f1\'b0\'e8\'be\'e0\'c0\'ba\f0 Microsoft Corporation(\f1\'b6\'c7\'b4\'c2\f0 \f1\'b0\'c5\'c1\'d6\f0 \f1\'c1\'f6\'bf\'aa\'bf\'a1\

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1042\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3249
Entropy (8bit):	5.985100495461761
Encrypted:	false
SSDEEP:	48:c5DiTlO4TesKOwhDNJCkt1NhEN3m/NFNkbKNdExpVgUnqx6IPaRc0KoUK9TKz0KR:uDiTlUJJCsgqf6YVoz4uU5vI54U5TY
MD5:	B3399648C2F30930487F20B50378CEC1
SHA1:	CA7BDAB3BFEF89F6FA3C4AAF39A165D14069FC3D
SHA-256:	AD7608B87A7135F408ABF54A897A0F0920080F76013314B00D301D6264AE90B2
SHA-512:	C5B0ECF11F6DADF2E68BC3AA29CC8B24C0158DAE61FE488042D1105341773166C9EBABE43B2AF691AD4D4B458BF4A4BF9689C5722C536439CA3CDC84C0825965
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] .. ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive \| /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... ........../norestart - .. .... .. .... ...

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1045\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13213
Entropy (8bit):	5.403831385196401
Encrypted:	false
SSDEEP:	384:7qW9Y+vh+nXb9i/aGtD4EvwdKr6tryb3kfFl/C6eSee6VeYTiojkYyRg4Ri2:2W9Y+J+Xb0/amD1vGKrN3kNlq6eSee6+
MD5:	A0D88589A339E57E412AB01E763D6A27
SHA1:	E4B954832036D98943F2380DCCE636473A84F9D5
SHA-256:	898D5CA01A3271D97350D06A6CCDB8803A176BB42BAF7E2C8F76C9037235CA8E
SHA-512:	504E3939E96EC78E59ECDA356B463B2E54AEB94026B97669428730ACB202D73DB510FC9C6B5060AC48DD564E0DD9896E1B65AB7E1D30C58C9F2A954CB585D704
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 POSTANOWIENIA LICENCYJNE DOTYCZ\u260?CE OPROGRAMOWANIA MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 DODATKI DO MICROSOFT VISUAL STUDIO 2015, VISUAL STUDIO SHELL oraz PAKIET REDYSTRYBUCYJNY C++ \par..\pard\nowidctlpar\sb120\sa120\b0 Niniejsze postanowienia licencyjne stanowi\u261? umow\u281? mi\u281?dzy Microsoft Corporation (lub, w zale\u380?no\u347?ci od miejsca zamieszkania Licencjobiorcy, jednym z podmiot\'f3w stowarzyszonych Microsoft Corporation) a Licencjobiorc\u261?. Postanowienia te dotycz\u261? oprogramowania okre\u347?lonego powy\u380?ej. Niniejsze postanowienia maj\u261? r\'f3wnie\u380? zastosowanie do wszelkich us\u322?ug i aktualizacji Microsoft dla niniejszego oprogramowania, z wyj\u26

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1045\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3212
Entropy (8bit):	5.268378763359481
Encrypted:	false
SSDEEP:	48:c5DiTlOPesar4hDo7zGriQjDCN3mDNN0NrsNGl3vxkIP2hUdKLK0KbK4n6W0sfNM:uDiTlusPGriQw8n2rOij4JsU
MD5:	15172EAF5C2C2E2B008DE04A250A62A1
SHA1:	ED60F870C473EE87DF39D1584880D964796E6888
SHA-256:	440B309FCDF61FFC03B269FE3815C60CB52C6AE3FC6ACAD14EAC04D057B6D6EA
SHA-512:	48AA89CF4A0B64FF4DCB82E372A01DFF423C12111D35A4D27B6D8DD793FFDE130E0037AB5E4477818A0939F61F7DB25295E4271B8B03F209D8F498169B1F9BAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalator [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Instalator . Pomoc</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive \| /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wietlany interfejs u.ytkownika oraz wszystkie monity...../norestart - Pom

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1046\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10200
Entropy (8bit):	5.026102753317644
Encrypted:	false
SSDEEP:	192:cfIn4uC7alIE/M/A5LERZLtgEyNjnOFRMuwLCEjlHRJ+/a/3an2L7B72:L4uC7al7MI5LyptgrN72ACEj5R4a/q2I
MD5:	137A9579BA2E02EBB87817440FCBDCB9
SHA1:	FE033A175D4F0C766B95D67D5DA933C608323159
SHA-256:	42DC678EF9D5E4E147BF178FFE2FA3CD4BBBF9C904872B4E344D8BB22C473ED5
SHA-512:	601D98C7994EA569CF5D0C74D4357503773CCE1EC1D1701FC363FB66AA003C968900CD56A0702B3E8661DA157367755B40D473FA870800936B02980B021931C8
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang1046\b\f0\fs20 TERMOS DE LICEN\'c7A PARA SOFTWARE MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 COMPLEMENTOS DO MICROSOFT VISUAL STUDIO 2015, VISUAL STUDIO SHELLS e C++ REDISTRIBUTABLE \par..\pard\nowidctlpar\sb120\sa120\b0 Os presentes termos de licen\'e7a constituem um acordo entre a Microsoft Corporation (ou, dependendo do local no qual voc\'ea esteja domiciliado, uma de suas afiliadas) e voc\'ea. Eles se aplicam ao software indicado acima. Os termos tamb\'e9m se aplicam a quaisquer servi\'e7os ou atualiza\'e7\'f5es da Microsoft para o software, exceto at\'e9 a extens\'e3o de que eles tenham termos diferentes.\par..\pard\brdrt\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\b SE VOC\'ca CONCORDAR COM ESTE

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1046\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	5.150868216959352
Encrypted:	false
SSDEEP:	48:c5DiTlO5es/4ThDzmU6lDj4N3mBl0N+NWNP4hHCc9skPDXeKKeK9KfKt4eJ2RQdg:uDiTlJhJGl2UsZMLe6
MD5:	BE27B98E086D2B8068B16DBF43E18D50
SHA1:	6FAF34A36C8D9DE55650D0466563852552927603
SHA-256:	F52B54A0E0D0E8F12CBA9823D88E9FD6822B669074DD1DC69DAD6553F7CB8913
SHA-512:	3B7C773EF72D40A8B123FDB8FC11C4F354A3B152CF6D247F02E494B0770C28483392C76F3C222E3719CF500FE98F535014192ACDDD2ED9EF971718EA3EC0A73E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [diret.rio - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive \| /quiet - exibe a IU m.nima sem nenhum prompt ou n.o exibe nenhuma IU e.. nenhum prompt. Por padr.o, a IU e todos os prompts s.o exibidos...../norestart - suprime qualquer tentativa de reiniciar. Por padr.o, a IU perguntar. antes de reiniciar

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1049\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	54812
Entropy (8bit):	3.5769726207436507
Encrypted:	false
SSDEEP:	768:44WXgSXqZQ3HWhIU9U70GWEnc4vNf1p3D9JaBaX0:Ig
MD5:	EFF73C35DB2D6AC9F29D1B633C984A95
SHA1:	05E1A450FD077607612AA0506143140CCC8017B9
SHA-256:	F00A2A67106CA3BADB4C233951A262EC0A9BBA3151E1D8DA0362DCADA7928DCD
SHA-512:	1D89C50B2B2EA63DD464268DAB4272991D51E2D27A407440585BE855D86E06B5982F685D797E8F7917E75512F72CC1496FF5F21466B4A649ABA43458D8DBE8B8
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20\u1059?\u1057?\u1051?\u1054?\u1042?\u1048?\u1071? \u1051?\u1048?\u1062?\u1045?\u1053?\u1047?\u1048?\u1054?\u1053?\u1053?\u1054?\u1043?\u1054? \u1057?\u1054?\u1043?\u1051?\u1040?\u1064?\u1045?\u1053?\u1048?\u1071? \u1053?\u1040? \u1048?\u1057?\u1055?\u1054?\u1051?\u1068?\u1047?\u1054?\u1042?\u1040?\u1053?\u1048?\u1045? \u1055?\u1056?\u1054?\u1043?\u1056?\u1040?\u1052?\u1052?\u1053?\u1054?\u1043?\u1054? \u1054?\u1041?\u1045?\u1057?\u1055?\u1045?\u1063?\u1045?\u1053?\u1048?\u1071? MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\u1044?\u1054?\u1055?\u1054?\u1051?\u1053?\u1048?\u1058?\u1045?\u1051?\u1068?\u1053?\u1067?\u1045? \u1050?\u1054?\u1052?\u1055?\u1054?\u1053?\u1045?\u1053?\u1058?\u1067? MICROSOFT VI

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1049\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	5.444436038992627
Encrypted:	false
SSDEEP:	48:c5DiTlDhQt9esbrohDTWJt49kAr7DHN3m5GNDCNvNLIkflhrWncPingGdZwK1Kqp:uDiTlDYVgmt4xJ88k193ipzjvL
MD5:	17C652452E5EE930A7F1E5E312C17324
SHA1:	59F3308B87143D8EA0EA319A1F1A1F5DA5759DD3
SHA-256:	7333BC8E52548821D82B53DBD7D7C4AA1703C85155480CB83CEFD78380C95661
SHA-512:	53FD207B96D6BCF0A442E2D90B92E26CBB3ECC6ED71B753A416730E8067E831E9EB32981A9E9368C4CCA16AFBCB2051483FDCFC474EA8F0D652FCA934634FBE8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.... <String Id="Caption">......... ......... [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [.......] - ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......... .. ......... - ............../passive \| /quiet - ........... ....

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1055\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	12669
Entropy (8bit):	5.215620365946286
Encrypted:	false
SSDEEP:	384:D7KDYYCGJLDHXpbKir98UqvgL2oQH/np2:D+DYYCGhDkir98UqvG2xfo
MD5:	362F60F539B629BF59021003F426583C
SHA1:	C9DBA340889AAFD07996A8BFCAB7C14F404E07A6
SHA-256:	1E602773F3071636E0F9C6B27037B7B4094DC26F7C2FABCDF3287BC9BCAA8652
SHA-512:	10F475BB075EBC597CFE1D2333F9B4B26109FEC974E4517E9F77BC30D609ED47619F4347124274F85E9277B14EF52D7863D311BDC4176E7AE7FCB009420B15C1
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT YAZILIM L\u304?SANSI KO\u350?ULLARI\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 MICROSOFT VISUAL STUDIO 2015 EKLENT\u304?LER\u304?, VISUAL STUDIO SHELLS ve C++ YEN\u304?DEN DA\u286?ITILAB\u304?L\u304?R \par..\pard\nowidctlpar\sb120\sa120\b0 Bu lisans ko\u351?ullar\u305?, Microsoft Corporation (veya ya\u351?ad\u305?\u287?\u305?n\u305?z yere g\'f6re bir ba\u287?l\u305? \u351?irketi) ile sizin aran\u305?zda yap\u305?lan s\'f6zle\u351?meyi olu\u351?turur. Bu ko\u351?ullar, yukar\u305?da ad\u305? ge\'e7en yaz\u305?l\u305?m i\'e7in ge\'e7erlidir. Ko\u351?ullar, yaz\u305?l\u305?m i\'e7in t\'fcm Microsoft hizmetleri veya g\'fcncelle\u351?tirmeleri i\'e7in, beraberlerinde farkl\u305? ko\u351?ullar bulunmad\

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\1055\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	5.280530692056262
Encrypted:	false
SSDEEP:	48:c5DiTlOaesHEqhDTHV4zVy6oBzdp0DYK2GP2ZmN3majyNXNoNKQXVvChcPc+WKb0:uDiTl3PHcIflKNTPgdi12xgg
MD5:	DEFBEA001DC4EB66553630AC7CE47CCA
SHA1:	90CED64EC7C861F03484B5D5616FDBCDA8F64788
SHA-256:	E5ABE3CB3BF84207DAC4E6F5BBA1E693341D01AEA076DD2D91EAA21C6A6CB925
SHA-512:	B3B7A22D0CDADA21A977F1DCEAF2D73212A4CDDBD298532B1AC97575F36113D45E8D71C60A6D8F8CC2E9DBF18EE1000167CFBF0B2E7ED6F05462D77E0BCA0E90
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive \| /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.r.nt.lenir...../norestart - yeniden ba.lama denemelerini engeller. Varsay.lan olarak UI yeniden ba.l

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\2052\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	19329
Entropy (8bit):	3.8703778033292844
Encrypted:	false
SSDEEP:	192:/fUqPyOjNt/cu55b6ja24mGIUMSDt+6+nnyqBy5V8KwLb6K68lk5x25oz5Fuzy3M:7vCuWjZM+V58LicFVcSwZfG8PW2
MD5:	31AFEC54446E496CE2A1D1CD3B257738
SHA1:	E2B4F4CF493929AD01EDB33D9034F9129A15742E
SHA-256:	63F463F0ACE41FA088ACFB70F501DB47E3B83600DB31538D8DABA010E6B83D42
SHA-512:	8F2BC3343109CE6C0E3EF9E81CFFE96A70A56D5C5C28EE3ED2F933189818269C06A9DCF3B8783CC1AE0B379AA53A899CD6AAA59BE7A9E0F9E0D51E587A533829
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fprq2\fcharset134 SimSun;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Tahoma;}{\f3\froman\fprq2\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue0;\red0\green0\blue255;}..{\stylesheet{ Normal;}{\s1 heading 1;}{\s2 heading 2;}}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20\'ce\'a2\'c8\'ed\'c8\'ed\'bc\'fe\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\f1\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\f2 MICROSOFT VISUAL STUDIO 2015 ADD-ON\f0\'a1\'a2\f2 VISUAL STUDIO SHELLS \f0\'ba\'cd\f2 C++ REDISTRIBUTABLE\par..\pard\nowidctlpar\sb120\sa120\b0\f0\'d5\'e2\'d0\'a9\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\'ca\'c7\'ce\'a2\'c8\'ed\'b9\'ab\'cb\'be\'a3\'a8\'bb\'f2\'c4\'fa\'cb\'f9\'d4\'da\'b5\'d8\'b5\'c4\'ce\'a2\'c8\'ed\'b9\'ab\'cb\'be\'b5\'c4\'b9\'d8\'c1\'aa\'b9\'ab\'cb\'be\'a3\'a9\'d3\'eb\'c4\'fa\'d6\'ae\'bc\'e4\'b4\'ef\'b3\'c9\'b5\'c4\'d0\'ad\'d2\'e9\

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\2052\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	6.135205733555905
Encrypted:	false
SSDEEP:	48:c5DiTlOtKesi+hDtkQf7lz+W0gopN3m5+3cNONeN1ra8vWqPtlTKxKUTKlKXRoR+:uDiTlV5kQR9GLeE0ZxV6gIV
MD5:	3D1E15DEEACE801322E222969A574F17
SHA1:	58074C83775E1A884FED6679ACF9AC78ABB8A169
SHA-256:	2AC8B7C19A5189662DE36A0581C90DBAD96DF259EC00A28F609B644C3F39F9CA
SHA-512:	10797919845C57C5831234E866D730EBD13255E5BF8BA8087D53F1D0FC5D72DC6D5F6945DBEBEE69ACC6A2E20378750C4B78083AE0390632743C184532358E10
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ..................... UI.../log log.txt - ............. %TEMP% ...

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\3082\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10616
Entropy (8bit):	5.050611165428319
Encrypted:	false
SSDEEP:	192:cfqxQ7CQx761A3OfrH+JawfEXiTe2ESf+aQjk6weerXTRVJnR8HYdWsk21HvBY2:9xQ7v7663Ofi4Nyp2fkcCjHwpcPBY2
MD5:	64F1444D27E3F3489F057E7280E9C973
SHA1:	3DDC843D2021F62994C6ED35EBC8A193C4045994
SHA-256:	55929413B6A530F8C4ACBB1E7EEE81FB9ED0BD64AF5CD26D6F5637CEDFAF0A2D
SHA-512:	8D9AC8300C5A6815D2AFA02A54F23CB3A8B28192FA504C26F747FA3D4E70DEB55F8C19CA4ABF6E93856BCD1F1D9636A95E4E8F134D8D1E4ECC4081579F5B27CB
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue0;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\lang3082\b\f0\fs20 T\'c9RMINOS DE LICENCIA DEL SOFTWARE DE MICROSOFT\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 COMPLEMENTOS DE MICROSOFT\~VISUAL\~STUDIO\~2015, SHELLS DE VISUAL\~STUDIO Y C++\~REDISTRIBUTABLE\par..\pard\nowidctlpar\sb120\sa120\b0 Los presentes t\'e9rminos de licencia constituyen un contrato entre Microsoft Corporation (o, en funci\'f3n de donde resida, una de sus filiales) y usted. Se aplican al software antes mencionado. Los t\'e9rminos tambi\'e9n se aplican a cualquier servicio o actualizaci\'f3n de Microsoft para el software, excepto en la medida que tengan t\'e9rminos diferentes.\par..\pard\brdrt\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\b SI CUMPLE CON ESTOS T\'c9RMINOS DE LICENCIA, DISPONDR

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\3082\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.0491645049584655
Encrypted:	false
SSDEEP:	48:c5DiTlO/esS6VGhDv4tiUiyRUqzC4U+aD6N3m7xNh1NWNGbPz+9o3PWeKK9K9KfT:uDiTlxouUTiySqyIwz9sgxqvjIk8
MD5:	47F9F8D342C9C22D0C9636BC7362FA8F
SHA1:	3922D1589E284CE76AB39800E2B064F71123C1C5
SHA-256:	9CBB2B312C100B309A1B1495E84E2228B937612885F7A642FBBD67969B632C3A
SHA-512:	E458DF875E9B0622AEBE3C1449868AA6A2826A1F851DB71165A872B2897CF870CCF85046944FF51FFC13BB15E54E9D9424EC36CAF5A2F38CE8B7D6DC0E9B2363
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar la operaci.n?</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. La opci.n predeterminada es la instalaci.n...../passive \| /quiet - muestra una IU m.nima sin solicitudes o no muestra ninguna IU ni.. solicitud. De forma predeterminada, se muestran la IU y todas las solicitudes...../norestart - elimina cualquier intento

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\BootstrapperApplicationData.xml

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (561), with CRLF line terminators
Category:	dropped
Size (bytes):	12352
Entropy (8bit):	3.722986329159822
Encrypted:	false
SSDEEP:	192:X001Ks1sDprApBixLUX0nzLG0LGm6s67mcJ60626m60V60Z6rFBL5LYLVLOlLYLm:XPIsolo0zJamcGVEp2E29
MD5:	92606440AB8BA761A3E9B291F03D2181
SHA1:	F1109649B5B2E692F69539F34BB21F12E50A7AD5
SHA-256:	BF16D6BB90582A87EF4BCAE91948BFD04BC1AF5CA153F288917334AFFDEACA42
SHA-512:	86FEF47891054873840DCEDBBCEA30C04B3DE559F3E5B9D49146EBF290AD4FBE26AB95E43696A0D2C8D8FB2815DAE20E4B27B9A382DDDB777E92FFDE3092C2FE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.U.x.B.l.o.c.k.e.r. .S.h.o.r.t.N.a.m.e.=.".M.i.n.i.m.u.m.O.S.L.e.v.e.l.". .T.y.p.e.=.".S.t.o.p.". .C.o.n.d.i.t.i.o.n.=.".N.O.T.(.(.V.e.r.s.i.o.n.N.T. .&.g.t.;. .v.6...1.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.6...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).).". .D.i.s.p.l.a.y.T.e.x.t.=.".#.l.o.c...M.i.n.i.m.u.m.O.S.L.e.v.e.l.". ./.>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T.6.4. .&.g.t.;.=. .v.6...0. .O.R. .(.V.e.r.s.i.o.n.N.T.6.4. .=. .v.5...2. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .X.P. .S.P.1. .(.

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\license.rtf

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	8863
Entropy (8bit):	5.133375715016848
Encrypted:	false
SSDEEP:	192:gfrZvSwTLavuAWZEFDe/yfefEabbdSysDlCsnA+vM6SH82:OvSw/aWAWZEFDeqfmlrClCsnAeMPc2
MD5:	EBA5FAA2129CAFEC630B82ADAE942AA9
SHA1:	52BA1E75ACCBEF329F64EA75111666F643D8987C
SHA-256:	4D7B2ABAAB1C0D46260E5D48AD4CE4BBC3EC02C660838A9A578F1BEAD68D6B35
SHA-512:	2BC372D51FF28BE5A7D8A957E3D98093D5CD8F88EFA5DAD914D6D5313CABBFBD1E93FFF7BA46FF1ED90F9074F4D03CF8A244B9D22BCEF88C562FF577921CBA8B
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\deflang1033\deflangfe1033{\fonttbl{\f0\fnil\fcharset0 Segoe UI;}}..{\colortbl ;\red0\green0\blue255;\red0\green32\blue96;\red0\green0\blue0;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\nowidctlpar\sb120\sa120\b\f0\fs20 MICROSOFT SOFTWARE LICENSE TERMS\par..\pard\brdrb\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120 MICROSOFT VISUAL STUDIO 2015 ADD-ONs, VISUAL STUDIO SHELLS and C++ REDISTRIBUTABLE \par..\pard\nowidctlpar\sb120\sa120\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software, except to the extent those have different terms.\par..\pard\brdrt\brdrs\brdrw10\brsp20 \nowidctlpar\sb120\sa120\b IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW.\par..\pard\nowidctlpar\fi-357\li357\sb120\sa120\tx360 1.\tab INSTALLATION AND USE RIGHTS. \b

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\logo.png

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:	24:q36cnTKM/3kTIQiBmYKHeQWalGt1Sj9kYIt1uZ+bYOQe0IChR95aW:qqiTKMPuUBm7eQJGtYJM1uZCVszaW
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\thm.wxl

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:	48:c5DiTl/+desK19hDUNKwsqq8+JIDxN3mt7NlN1NVvAdMcgLPDHVXK8KTKjKnSnYF:uDiTl/BbTxmup/vrxATd
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\thm.xml

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5881
Entropy (8bit):	5.175177119212422
Encrypted:	false
SSDEEP:	96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
MD5:	0056F10A42638EA8B4BEFC614741DDD6
SHA1:	61D488CFBEA063E028A947CB1610EE372D873C9F
SHA-256:	6B1BA0DEA830E556A58C883290FAA5D49C064E546CBFCD0451596A10CC693F87
SHA-512:	5764EC92F65ACC4EBE4DE1E2B58B8817E81E0A6BC2F6E451317347E28D66E1E6A3773D7F18BE067BBB2CB52EF1FA267754AD2BF2529286CF53730A03409D398E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="64" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="80" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader)</T

C:\Users\user\AppData\Local\Temp\{e46eca4f-393b-40df-9f49-076faf788d83}\.ba1\wixstdba.dll

Download File

Process:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120832
Entropy (8bit):	6.2760527819182705
Encrypted:	false
SSDEEP:	1536:nw7WzpopAuJhsVuThs5cXyeM6JUOfPGSpeBxm946ITADDwYkH/1d9chyP7iN6p:pmAuJhAyZFpem90iw//1d9chwG6
MD5:	4D20A950A3571D11236482754B4A8E76
SHA1:	E68BD784AC143E206D52ECAF54A7E3B8D4D75C9C
SHA-256:	A9295AD4E909F979E2B6CB2B2495C3D35C8517E689CD64A918C690E17B49078B
SHA-512:	8B9243D1F9EDBCBD6BDAF6874DC69C806BB29E909BD733781FDE8AC80CA3FFF574D786CA903871D1E856E73FD58403BEBB58C9F23083EA7CD749BA3E890AF3D2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................x=....x...... .....0.....n..x.....x8....x9....x>...Rich..........................PE..L....NjT...........!.....4...................P...............................0......h.....@.............................................l....................... ...0S.................................@............P...............................text....2.......4.................. ..`.rdata...d...P...f...8..............@..@.data..../..........................@....rsrc...l...........................@..@.reloc..J ......."..................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\64f258.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005., Template: x64;1033, Revision Number: {FE26E34E-F44B-4B4D-A2C9-878D87759F44}, Create Time/Date: Sat Oct 5 11:36:26 2013, Last Saved Time/Date: Sat Oct 5 11:36:26 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.731930109143771
Encrypted:	false
SSDEEP:	3072:qPSJyjFGJvLIcXcSqviQICInggioVNmzM+8:0SIcXgvi3L8
MD5:	6DC9B26E10641A0D15DCC60A26B38906
SHA1:	68AD317CD51C85AAFECD11E765823B39E0EE952E
SHA-256:	25284A481A749AA531682505AAAFDCFA929318E9970EF94B64EBDACC3A089490
SHA-512:	9312DD991FA80113D2732A53E85EF3762D89812F64626FF37B1213694FD2E27B7304FAD06FC7FA161BE6F377206BEB6CE88609E4D161A24E6927F59FDF7DD8D3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\64f25b.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005., Template: x64;1033, Revision Number: {FE26E34E-F44B-4B4D-A2C9-878D87759F44}, Create Time/Date: Sat Oct 5 11:36:26 2013, Last Saved Time/Date: Sat Oct 5 11:36:26 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.731930109143771
Encrypted:	false
SSDEEP:	3072:qPSJyjFGJvLIcXcSqviQICInggioVNmzM+8:0SIcXgvi3L8
MD5:	6DC9B26E10641A0D15DCC60A26B38906
SHA1:	68AD317CD51C85AAFECD11E765823B39E0EE952E
SHA-256:	25284A481A749AA531682505AAAFDCFA929318E9970EF94B64EBDACC3A089490
SHA-512:	9312DD991FA80113D2732A53E85EF3762D89812F64626FF37B1213694FD2E27B7304FAD06FC7FA161BE6F377206BEB6CE88609E4D161A24E6927F59FDF7DD8D3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\64f25c.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005., Template: x64;1033, Revision Number: {0990E7AB-85D7-456A-B8F8-1E1E56A29571}, Create Time/Date: Sat Oct 5 11:36:18 2013, Last Saved Time/Date: Sat Oct 5 11:36:18 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.7908315301004905
Encrypted:	false
SSDEEP:	3072:gJRJyjFGJvLIcXcSqviQICInggp/lVNmbQ8K:vSIcXgvi37k
MD5:	03FF53F29935C047D7630297E17B96E1
SHA1:	6F922B2D00A6C3274B39F0161C9B89C7AEFA9EB5
SHA-256:	F2C8327F44A0B47619AF5B47D37A90D0F3F7C61D94768AEFE8D8ADFC84A8ED55
SHA-512:	93F5CCB7B276CB089E511201417F522B34E8F7794CEFA8A24440C22B03C8AF81602852E42AC13BEF6078A212D746FB22E76CA72BFC8D185757FCB4B88CBF89B6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\64f25f.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2013 x64 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005., Template: x64;1033, Revision Number: {0990E7AB-85D7-456A-B8F8-1E1E56A29571}, Create Time/Date: Sat Oct 5 11:36:18 2013, Last Saved Time/Date: Sat Oct 5 11:36:18 2013, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML (3.7.1623.0), Security: 2
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.7908315301004905
Encrypted:	false
SSDEEP:	3072:gJRJyjFGJvLIcXcSqviQICInggp/lVNmbQ8K:vSIcXgvi37k
MD5:	03FF53F29935C047D7630297E17B96E1
SHA1:	6F922B2D00A6C3274B39F0161C9B89C7AEFA9EB5
SHA-256:	F2C8327F44A0B47619AF5B47D37A90D0F3F7C61D94768AEFE8D8ADFC84A8ED55
SHA-512:	93F5CCB7B276CB089E511201417F522B34E8F7794CEFA8A24440C22B03C8AF81602852E42AC13BEF6078A212D746FB22E76CA72BFC8D185757FCB4B88CBF89B6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIF594.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	6077
Entropy (8bit):	5.7623497329043225
Encrypted:	false
SSDEEP:	96:ULxdpwNzdpEOkR18Ub6QL8M8M8M8M8Obb8RcNIQWSefrYWPdpEbN8eedp6eW4Og2:g8ZBRcIrDo7eAPWk
MD5:	1125B12142DBCA692E2DE13947564BA8
SHA1:	B9E6B469C3FB6676C9BD8D4E9F42BB000A1815FF
SHA-256:	1A47EB07C8AC1EBA8E772DC382A28E9CFFF0C87F9A883A1371BE4ADA03DA6574
SHA-512:	EF811375563C1AF5A66649269D63F661B7FC4730F2757DB9EE8E4528678DB632344C9268F1893CA59512627DBBACDC63EEA52417A447B526586FBAFB8B85DCD3
Malicious:	false
Preview:	...@IXOS.@.....@P..X.@.....@.....@.....@.....@.....@......&.{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005..vc_runtimeMinimum_x64.msi.@.....@.R...@.....@........&.{FE26E34E-F44B-4B4D-A2C9-878D87759F44}.....@.....@.....@.....@.......@.....@.....@.......@....:.Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{BC1F4291-6F0A-38EB-984E-C2E555837FE1}@.02:\SOFTWARE\Microsoft\VisualStudio\12.0\VC\Runtimes\x64\Version.@.......@.....@.....@......&.{E5B92048-5859-4AF1-AEAD-B97EBF00B087} .C:\Windows\system32\msvcr120.dll.@.......@.....@.....@......&.{570C624B-D57C-4CD1-9013-1B80C800093B} .C:\Windows\system32\msvcp120.dll.@.......@.....@.....@......&.{14E8634F-8AEA-4CD1-AC48-BEBFDA18523A}#.C:\Windows\system32\vccorlib120.dll.@.......@.....@.....@......&.

C:\Windows\Installer\MSIF97D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	10023
Entropy (8bit):	5.711191824108294
Encrypted:	false
SSDEEP:	192:gvpqO1leceYPSNhYiS+iifiG1i0viQTexA1vI3XNdyHWu43T:gBqO1ledYPSNhg64XD8Wf
MD5:	93FAA0953E980003CE1CD9B03B9FFDBB
SHA1:	B401A4B880661EAEF0A3DC0A5A8608B0879760E7
SHA-256:	F49B844DAF7DE3E0B2A22910D96440E29429686F0E8D938AA8BD7E49C5E9602A
SHA-512:	2586B136D66BB16E7560B5EEF16D5D19D78B21F59BD645839AE5537A8167BBB4908DBCF565F4136C54FA469B570B3E9FEAB45C44A73DB9892D86ACAA44ACB272
Malicious:	false
Preview:	...@IXOS.@.....@P..X.@.....@.....@.....@.....@.....@......&.{929FBD26-9020-399B-9A7A-751D61F0B942}=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005..vc_runtimeAdditional_x64.msi.@.....@.R...@.....@........&.{0990E7AB-85D7-456A-B8F8-1E1E56A29571}.....@.....@.....@.....@.......@.....@.....@.......@....=.Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{191E6DE4-E7B2-3CE9-B48B-25D0FFF3D88E}@.02:\SOFTWARE\Microsoft\VisualStudio\12.0\VC\Runtimes\x64\Version.@.......@.....@.....@......&.{E70078E7-D25B-421C-A415-0AB472053F72}..C:\Windows\system32\mfc120.dll.@.......@.....@.....@......&.{7D2EA505-A879-4E71-8632-F3DE9B679CE6}..C:\Windows\system32\mfc120u.dll.@.......@.....@.....@......&.{1F74928D-AA17-468C-A7D7-6A730A8DB25B}..C:\Windows\system32\mfcm120.dll.@.......@.....@.....@......

C:\Windows\Installer\SourceHash{929FBD26-9020-399B-9A7A-751D61F0B942}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2083015136561481
Encrypted:	false
SSDEEP:	12:JSbX72FjxsXAlfLIlHuRpWBhG7777777777777777777777777ZDHFbOSJ4+Yp8D:JuUIwUiFOSJkcF
MD5:	4B0B882FB9C6FF01381892AD5863E519
SHA1:	269C99BDE569C87B2A6595D7A015C87271E4DC80
SHA-256:	A1F4CC6E88A55C6EE1AB32A8B822B2E97E0FA7B9DBABAA43BD6AF923CA387503
SHA-512:	18A370BCD8DB67E2A5779E822B693A0856A6F2713F336D94674A494B40D1574DFCAB92EE46E7F57A13CE68B604762B231C6AA9658B8DDD62E670A2915A1AB82B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.2065834198928789
Encrypted:	false
SSDEEP:	12:JSbX72Fj4sfsXAlfLIlHuRpZhG7777777777777777777777777ZDHFubeJesalp:JpaUIwEcq4sYicF
MD5:	B36957CBB1E0D3B2B03FE93E7B7D30DA
SHA1:	3F7130E703636EE78C5BEE6CF7B174680138E3FF
SHA-256:	0FF234287F57F0970BAC5B8562A3D7F9116843C8CB715A74FAE354885A4F6522
SHA-512:	D564778A9FB6A561185CC6E2152FA726FAC2E7CDA2BBA7C0D5F4F49793F066F0CDBF5AC5FB3B0280EB655D73970F736CAFAFB0A572F309418105E98ADB6F4321
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5606129635753057
Encrypted:	false
SSDEEP:	48:+8PhKuRc06WXiZjT54od96RLjxL4x3wSmRSqdHBIAmU0SIV8Zmc:xhK13jTz9aLVL4xAVRDKA+J8Zmc
MD5:	648DFED862A25640DA4EC2CC33B8A1EA
SHA1:	AE4309B88377ECA7EDB8CEE206A39256F13410F9
SHA-256:	BFF1A2AB297D1CC18E26CA317CE8C35BF02C800775C489E14AA60AA23D4753F4
SHA-512:	322EC139117917FF60BEF7B2DE28A42DE954D6581E99CA69A82BC9466EBDE9F65DB6A7895EB909148CD26F64DDC83B43AB311856F5E8C7FD9AD7B179726EC9A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375178442151037
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau/:zTtbmkExhMJCIpErO
MD5:	1ED5D16FF9EABCB4F357DDB65DB4A957
SHA1:	262F25CCBEA1038C7A210CDFE6334A22169DEF94
SHA-256:	E1FEE223090CC0FE5F307DA7BF0CB6CBBE959349B840185A19544772678F0124
SHA-512:	3D8C283BD1004A408DBA12092C6A16C9EB71C633CB48B4C973C593DDE11EF16C001E3127881B1EB71FAFC867134B87601084AF1E51CA1622019C7DBD98CEB782
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\drivers\vstor2-mntapi20-shared.sys

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38320
Entropy (8bit):	6.786073447859868
Encrypted:	false
SSDEEP:	768:xhugSWs0GilsRvMbrF9e3FnG/ywOuu/OKiyVFwp23+zjE:qgfsHc/qFGqwOx2KiyV50E
MD5:	701F6FB77B31ED04321108C264D04DE0
SHA1:	422B55BB76305C10D8D491F600EDDE6865F2E9E9
SHA-256:	ADE2410D00A9667B4003BB9ECFE7F64621151246F44CD3A55BF322BEE950181C
SHA-512:	95A87EC1D9918496E80CAC60CBE3B468089B190DB1B44569B39AD139CD4D61EB42E1D39B6651CADDA548589C2B12B31258BC09506C06C56AF97BA550701A0E25
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................J.....J...................J..........................Rich...........................PE..d...%.}X.........."......D.................................................................................................................d...(............p.......X...=..........`Q...............................................P..`............................text....<.......>.................. ..h.rdata.......P.......B..............@..H.data...H....`.......H..............@....pdata.......p.......J..............@..HINIT.................L.............. ....rsrc................R..............@..B.reloc...............V..............@..B................................................................................................................................................................................................................

C:\Windows\System32\mfc120chs.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46248
Entropy (8bit):	6.135373688897719
Encrypted:	false
SSDEEP:	768:KdzvsXN+ptLkrHyTby9XVLv+8i94HMpuWR:+z0XN+ptLUHCbyBVLv+8HrW
MD5:	58BBC79A32110C948466CAE4315E0E1B
SHA1:	AA130D3C040BE702A6EC20EE6949529C2A3BF0B1
SHA-256:	75BC225D5AF5E8F267EE940A722AEA1696A969FAE777994881D3ACE490D97BF0
SHA-512:	93B34D22ECF567DFD962A0C100581B4DD1B7C3C3B098F44090BAA8F0DA428E908B829391B4D5567836FD307FD551CA2FAD40F93DF8AEE6F64BA87D9BA6693725
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." .........t............................................................`............................................................. s...........v...>...........................................................................................rsrc... s.......t..................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120cht.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46248
Entropy (8bit):	6.175910557379163
Encrypted:	false
SSDEEP:	768:fefucVI4TA7kn4TJVM3i/EhKX8iEHTTi:wucVI4TA4noVM3XhKX8tTTi
MD5:	C38C69B5A41B667654244E53F1A814C8
SHA1:	20555F17E7073AB06A151B4E48E7A08AB9D93A7E
SHA-256:	829871005A8BB56838F1EE22D786070E87BDCCF9204A07612D6505004D29A5F0
SHA-512:	E982D8EA039B4F481C1C2A33FC4305B86118FD0F364F852BA5F0D415352E46EFEAB3E6D67522381F5FBF1C744DB4D596AD7202CF729E4795A65BC4199DAC4FA9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." .........t......................................................[T....`.............................................................Hs...........v...>...........................................................................................rsrc...Hs.......t..................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120deu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74920
Entropy (8bit):	4.756035033790749
Encrypted:	false
SSDEEP:	1536:eVPidQr0UZqnn0BDLWPu6V4aGCWRZ+e0petNSaQhp0vcsjsr8gWt8C1dCuf9y8K0:eVidQr0UZqnnSLWPu6V4aGCWRZX0bhpY
MD5:	C5EBC101E92D1849A7B3880047FDBCA8
SHA1:	0577B78FA1FC550989E0E412E1CA4C39BC6F3E26
SHA-256:	9CC7EE7335777AA1EB393EAB8BFE5250C0F2FED10AC3A7C58EE3C4EF9662F6D8
SHA-512:	302B2C9B7071E8B5FABBB75C1B82ED7565925B55D0C05E735E68F3D8754519D9C049C028B9A30AED4E1865E756DEEF49AE293BA6C31FC90884F98D877AADFBB9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`.............................................................H................>...........................................................................................rsrc...H...........................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120enu.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65192
Entropy (8bit):	4.8999531962025005
Encrypted:	false
SSDEEP:	768:TyijcBEhCgyEO6B1CLPLNq5f/nWHBNheOU2fd528iPlHZsTDyN:TRzfyEO6B8PLNYf/nWHNTdc8qZsTDyN
MD5:	1708B225DAE258B847A447628C6A7A5D
SHA1:	C1337818DBA48C18C17BD9D231CC996CE73D161C
SHA-256:	87554AF8B85815F5ABA84933DE6809D76E1C1BFEAD70B2FDC7439E5A6B5302EB
SHA-512:	17E8D7CF07E1FECC2F2BEED8DE53CD4CF22232C988816F9A41B42F8FB23F323A15629B897A09AF75EDC135DD4F317855A8F4026A110F6ED22FF8A431A1AF2ED0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120esn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	73896
Entropy (8bit):	4.7300024182207325
Encrypted:	false
SSDEEP:	768:Dw0KnBU6fN6rg/PKuCOCF3OKWRElJRZRIvpt+8i2LvHfIcH6n:twq6fN68/PKuFm3OKWkRZRIr+89zNan
MD5:	5FB33B2CED7AA5D69707EB31C4D4B7AF
SHA1:	6D9F59B14829C425D5EB3943E5704EBA341A5134
SHA-256:	09F4506791B162CB14039FA3C656358E55089995534626F8E7FAC0B4C66C3BBD
SHA-512:	7B95DD952872DF943110997A08E362DE03DB4D8383E626F4DD3930E78E6137076F9E2E2F2938693D647893D87E9F8FAD12C9D4D78159A675A7A4B23BFBD8A6F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120fra.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74920
Entropy (8bit):	4.740550737279396
Encrypted:	false
SSDEEP:	768:y26iNYajZELmOYImN8YxAaTafCp5eFQZmZUjyyyyyyyyyyyyyyyUGQFUbWo2NemV:yNuqLmOQA2SCHj0jY+8dBx
MD5:	EDF43FB1F708B1D5ECF6AF64B2106275
SHA1:	C5DEB6320BEA70FFA8CF67664F5BACE47D992A3C
SHA-256:	0FCF915499D7A0DF41D115E3D578310B6F5CF1C17956C08C3A42340F08B87646
SHA-512:	C20EB350A046AD566E2AE7916596E4BA72E300E78C088F4B982A16733DFCC322E218284AC133E2A9C079C9D770FA4F0DB4F7A445061495D4209250AC71CC13C8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`.............................................................x................>...........................................................................................rsrc...x...........................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120ita.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72872
Entropy (8bit):	4.737269819960536
Encrypted:	false
SSDEEP:	768:XuE6XaCyqbK15MS1igDGxNIlW3gyCQQQjeqS1hDsiiUWTVq8iB3HHNpuWu:Gass5MS1igSxNIlW37oETE8umN
MD5:	729AC7C4146890693FC7F8AAF8D20539
SHA1:	0394FEEF49CF0A5C60451527B3A2CAA0D6E51C52
SHA-256:	6884B0886E3001D08A38A9C4CEC196A6A8AEC348BB24CD4FD91A05F120103341
SHA-512:	8281F095C8C56FC6A8D4BBF39B155B7EC02466AA89606B917DD3237E623F7DBF95020456C69A88A3C15B4478B14F6EBD81A21F366EBB78A6C7C310D8133B33AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`.............................................................`................>...........................................................................................rsrc...`...........................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120jpn.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	53928
Entropy (8bit):	5.97139967075836
Encrypted:	false
SSDEEP:	768:YanVn/eGtJxtr10/euKRHIWC8iNah0HbpuW9:nnp/eg/uMY82Iu
MD5:	3C976744835F3DD9D6EF459A650B3E30
SHA1:	80CC70F77CCBA3602A0D11ABF0C98CBFFFDEEAAF
SHA-256:	57DFF553B1608EA493F69697178C378E74D68B472B14D52A9EB1AD627DFBD54D
SHA-512:	D60EBD0094319A2FFDA01397D577A4A6AA538C96F879794DB95AA0518D4DA62C64737F03F8B243672607429DADC7BC680F1C662FB1BB2F2B259DC4F36DC281CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." .................................................................(....`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120kor.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	53416
Entropy (8bit):	6.098181898861317
Encrypted:	false
SSDEEP:	768:ozO54LQTNtQraHniJNB2I7Cvqt8iqqHvkaz:v51TNthniJv2I7Cvqt8Ysaz
MD5:	46ABA46ED83A1CD9C8E6B5B7076D2F7D
SHA1:	7889B34C82EE63F4C11B5BA160B699F4346D693B
SHA-256:	DED612342B84998C1D8681746C81F970F15B31DB4928118C743B9D24510B820A
SHA-512:	B5F230B791D35E7D0296311AA6D7695FBE1E21E86FA41E5E96DC578C86A0BBABB438730398FD314CFB8D99C56B8188EC6A45F77CB4C7D9CFE7AE1F6280710112
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ......................................................................`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\mfc120rus.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70824
Entropy (8bit):	5.284986668872065
Encrypted:	false
SSDEEP:	768:dZq/gFXOv9GuqN9TMIVhtZ3FckD+SjN8iNsH/KspuWO:K6XOv9OhTVh8wGSL
MD5:	F6E6EBB21B23EB772930732288451936
SHA1:	251D39E307FE5230AC510956D3FFE23FF63F2037
SHA-256:	1AD8F734737AFB18FF78D211351FFBE422196C5F6591407E53082E0F68A89FFC
SHA-512:	B16823C3D07C2AD271E216BA1494F34CDEE503C58AD48FAC7001D8BE5BF7E51B37685816BC7B38CBB6C8E0C59F97A7FCC876FD96DB8AE6235BA8D166259F0DFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9y.9y.9y..(..8y..(..8y.Rich9y.........PE..d.....OR.........." ................................................................Ah....`..............................................................................>...........................................................................................rsrc...............................@..@....................................................8.......P.......8.......(.......@....................>..X....................>..p....>.......?.......?.......?.......?.......?.......?.......?..0....A..H....B..`... B..x...AB......BB......CB......VB......lB.......B.......B.. ....B..8....x..P....x..h....x.......x.......~.......~.......~....................<.....................(.......@.......X.......p...........!.......(.......).......*.......,.......-...........0.../...H.......`.......x...........................

C:\Windows\System32\vcamp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	481952
Entropy (8bit):	5.988082434617548
Encrypted:	false
SSDEEP:	6144:iU0XBBJv5MQmJxQDe2T0gnsWo0PdHK5P5ZImCKTR10tKe3D17KQMc2FqpPM0tOAO:iNDP0ghMxCKROKeVKxjF+PJ1q
MD5:	182B2AA59F75B2A6F74E7B518E3D8383
SHA1:	32EA5A8B93187C39FBE5FC0D362B625C74A468D6
SHA-256:	EF3F1A0FA0ABA642A4735E99814E7A218FB1D43E0CDDC90CE63C62486BF5D384
SHA-512:	5890996E728705C614118AC19421D8EA2012A044205B36EC0DE5E4CC02DE56AFC5BF78A61824663E0F2C4850E2F6823EF59ADB5ACE2C65AA1E16F1C68AAF5AAF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..\............T.<......W&.....T.>.....T.......T.........*.............T.......T.=.....T.:.......v.....T.?.....Rich............................PE..d.....OR.........." .........B.......@.......................................P...........`.........................................0;..$8..Ts..........8$.......:.......>...@......................................@...p............................................text............................... ..`.rdata..............................@..@.data...H=.......8...z..............@....pdata...:.......<..................@..@.rsrc...8$.......&..................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Windows\System32\vcomp120.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137376
Entropy (8bit):	6.230586249062871
Encrypted:	false
SSDEEP:	3072:J7jlPQfmOYa0clSifLdmEkHHJprdHZfgjmsGQsGCxN0BfrMW7pQb/FW8xOi:4f11SikEkJprd5yrGQ1f0/DOi
MD5:	FD7F0D239E2227244F10E309C322E167
SHA1:	1F8C667DF810FED8FB42A6680A15465AC1E288EB
SHA-256:	AE710D6670D922FBBF0ADCBEC743FE75E572CF21CF7579FAF5F347A606C37CBB
SHA-512:	F726F5EF9175163F5BA6A96C95C9AAC38DAE354BA1289EB714C522B9E3CF5DD49EFD09B3FD548016B0FF702EC8B1E0B2570226844BC6405F794E4069B0B5A5D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nB..#.L#.L#.Llr(L.#.Llr)LM#.Llr.L"#.L...L/#.L#.LL#.Llr,L$#.Llr.L+#.Llr.L+#.Llr.L+#.LRich*#.L................PE..d.....OR.........." .................Z....................................... .......=....`.................................................X...<...............$........>..........P3..............................`...p............0...............................text...G........................... ..`.rdata...z...0...\|... ..............@..@.data...,:..........................@....pdata..$...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1ED0CDFA3A663D46.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5606129635753057
Encrypted:	false
SSDEEP:	48:+8PhKuRc06WXiZjT54od96RLjxL4x3wSmRSqdHBIAmU0SIV8Zmc:xhK13jTz9aLVL4xAVRDKA+J8Zmc
MD5:	648DFED862A25640DA4EC2CC33B8A1EA
SHA1:	AE4309B88377ECA7EDB8CEE206A39256F13410F9
SHA-256:	BFF1A2AB297D1CC18E26CA317CE8C35BF02C800775C489E14AA60AA23D4753F4
SHA-512:	322EC139117917FF60BEF7B2DE28A42DE954D6581E99CA69A82BC9466EBDE9F65DB6A7895EB909148CD26F64DDC83B43AB311856F5E8C7FD9AD7B179726EC9A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF20B13ED5A46CFD6A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2448816209684825
Encrypted:	false
SSDEEP:	48:11CuVNb0FXiyT5TIudFmvk6sx0LSmRSqdHBIAmU0SIpZ9mv:bCPfT9zFfPxGVRDKA+lZ9
MD5:	B7060CBCF20021B42BDF6889B10D88EA
SHA1:	BA7052CBC9BE50F9357A500B192BA3C5CAA9CA0B
SHA-256:	C0DBA9EA7D4CE4F8AAEDB68DBD23FEF951B69E01BF1ED036F34318BA4F172F22
SHA-512:	97A6C18EDCEB0514CB0B6D5F741313B2E6899845285B533A286BB6BEA1EEE58BB442F39EBBDC322207F37B7806035042174124979B24B6D84B2D67BFD1FE6563
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2F7825B6A1632856.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2448816209684825
Encrypted:	false
SSDEEP:	48:11CuVNb0FXiyT5TIudFmvk6sx0LSmRSqdHBIAmU0SIpZ9mv:bCPfT9zFfPxGVRDKA+lZ9
MD5:	B7060CBCF20021B42BDF6889B10D88EA
SHA1:	BA7052CBC9BE50F9357A500B192BA3C5CAA9CA0B
SHA-256:	C0DBA9EA7D4CE4F8AAEDB68DBD23FEF951B69E01BF1ED036F34318BA4F172F22
SHA-512:	97A6C18EDCEB0514CB0B6D5F741313B2E6899845285B533A286BB6BEA1EEE58BB442F39EBBDC322207F37B7806035042174124979B24B6D84B2D67BFD1FE6563
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4064E05D88689530.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.55646028551134
Encrypted:	false
SSDEEP:	48:N8PhKuRc06WXiljT54udFmvk6sx0LSmRSqdHBIAmU0SIpZ9mv:whK1LjTlFfPxGVRDKA+lZ9
MD5:	85F793BD33A80FC52BFD981466EE362B
SHA1:	C21E084CDB7F1BAA3EC2867D8FFBEDB39764E9EE
SHA-256:	56912F4205A5AA3A93F6031EB8B8BFF7747F5D7CF60A0A800EC3DA81A420F7F9
SHA-512:	5C0408721A1C79262C31C185AFD62BB05E04C2EF4971B8CD74F4E2C24F007C0FD4E66BA8136191A473C4D267B27C8C20195184D6DB44E2576C7A0730F962C8E3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF41904B734E93B5F2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.13355056760604592
Encrypted:	false
SSDEEP:	48:+ZmckVmSRSmRSqdHBIAmUgjxMd96RLjxLQ:+Zmc2mYVRDKAaxs9aLVL
MD5:	BD0A0C1643EA6F0835446EB453E86F96
SHA1:	19E55C098F97511F10429A5274FF7EDAD17D5E36
SHA-256:	7097E8EAF6737F774BB93323D725C89C0BB62043231657D5CE16CDD3610854FB
SHA-512:	8EA3426E107C346AFE275CC3A72034821CEEC602C4C914FA91D9FFF2D5166F184742585E820B737F595A3C54E10A4EE50A566F170140A5D424EADC10BE7407A8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4FB675D4343A66D4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5BFF47EAC34AE126.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2448816209684825
Encrypted:	false
SSDEEP:	48:11CuVNb0FXiyT5TIudFmvk6sx0LSmRSqdHBIAmU0SIpZ9mv:bCPfT9zFfPxGVRDKA+lZ9
MD5:	B7060CBCF20021B42BDF6889B10D88EA
SHA1:	BA7052CBC9BE50F9357A500B192BA3C5CAA9CA0B
SHA-256:	C0DBA9EA7D4CE4F8AAEDB68DBD23FEF951B69E01BF1ED036F34318BA4F172F22
SHA-512:	97A6C18EDCEB0514CB0B6D5F741313B2E6899845285B533A286BB6BEA1EEE58BB442F39EBBDC322207F37B7806035042174124979B24B6D84B2D67BFD1FE6563
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5C89FC4524B029B4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5DB394C7BE65B253.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6273930158FA6726.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10213395772452796
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKOuq+kpxEoHeM9RalSfIsa+QliVky6lJl0t/:50i8n0itFzDHFubeJesalS/a+QDr01
MD5:	E8CE189EA22F5871DCEC4C2175FA7B3F
SHA1:	5E9CD251EDEBD52B123751CBE2E2EFCC8EF3D324
SHA-256:	488C2F1F5C09F8E35FAFF56A5C69B7CB204B66C01CABB23214BE031A0590275C
SHA-512:	B8F4EE8D67710FF37B46B99283EB93B5336E97FD2AFA922FD8325F3570F6043571DA56E66F505049EBC93B0145F93EEB6860ACD66DBD908DB333D74C91FB6CC0
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6B415F51396B138E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6E25CDFE56AB2CED.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7CB20637BA7FDB2F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2479975107641463
Encrypted:	false
SSDEEP:	48:tLCufNb0FXiOT5TIod96RLjxL4x3wSmRSqdHBIAmU0SIV8Zmc:tC57T9l9aLVL4xAVRDKA+J8Zmc
MD5:	E211537228EA786B57617F550E0CD339
SHA1:	177D321A60BD2C5DFE3501F6ADB0189650B9E3F0
SHA-256:	2EA536699095CC8F302A3419F0BA09FF1DAD74007D59DEA6DC632B7B66CF9497
SHA-512:	353212F063A3D1C077F9DD61821A89C44BE1B8FF94D42417CFF7E5F3D323B2CA5AC3EEA527C4B0EFC6FC15322E927C96CAEADAD6AE617365C74E03ED43006A10
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7F6B2EA59D255DC8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF81190C071D3F5224.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA220BC115BF5EE0C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.13183608428357052
Encrypted:	false
SSDEEP:	48:emv2ZbdSRSmRSqdHBIAmURjx3dFmvk6y:ePZpYVRDKAzxtFf
MD5:	CC1AD2DD8105B77F3DF2FDA7C2285A12
SHA1:	9B2A120DEA07E6D304440D27D519C04BD0314A01
SHA-256:	88324176989235A04AF020F0FAE57521B0D7553D3C3651C11C14737FBDCF378E
SHA-512:	69B7EB75DE0525758956FBC48FC158F5C8B8392FDC0F9EF4BF14BCBDABFCAF2AF31BE770EE898DF849F136B550989B0C180BEB0402A2535510213B99F324CFE7
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA45C5A87F02E8805.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10291969417758479
Encrypted:	false
SSDEEP:	6:xPLG7iVCnLG7iVrKOzPLHKOUChUtV7w/QYM9TEkjuDiAmPlIVky6l80t/:50i8n0itFzDHFbOSJ4+Yp801
MD5:	E17A37C452A8FE282F34B77028C00494
SHA1:	120916072CFF00B9AF422758A1BE37189E34CEA9
SHA-256:	A6D1980A3923B3C548013AB71745DD7978724A67C6EA3002AB7E74D5783EFA81
SHA-512:	A1CCCB30DC3D894C52A8CC070A7991F6C872ABE1A6B454C06C08BA3054FF8954E3A407DFB0F28B2A013A8468AE0BF8052ACB70B6C1B47C5B99657B2BEA6DEE3B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAC508EA015BA8E99.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB6CD0B4A6E3703E9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB7B704FB726FEEA1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2479975107641463
Encrypted:	false
SSDEEP:	48:tLCufNb0FXiOT5TIod96RLjxL4x3wSmRSqdHBIAmU0SIV8Zmc:tC57T9l9aLVL4xAVRDKA+J8Zmc
MD5:	E211537228EA786B57617F550E0CD339
SHA1:	177D321A60BD2C5DFE3501F6ADB0189650B9E3F0
SHA-256:	2EA536699095CC8F302A3419F0BA09FF1DAD74007D59DEA6DC632B7B66CF9497
SHA-512:	353212F063A3D1C077F9DD61821A89C44BE1B8FF94D42417CFF7E5F3D323B2CA5AC3EEA527C4B0EFC6FC15322E927C96CAEADAD6AE617365C74E03ED43006A10
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC33A75C755FF963D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2479975107641463
Encrypted:	false
SSDEEP:	48:tLCufNb0FXiOT5TIod96RLjxL4x3wSmRSqdHBIAmU0SIV8Zmc:tC57T9l9aLVL4xAVRDKA+J8Zmc
MD5:	E211537228EA786B57617F550E0CD339
SHA1:	177D321A60BD2C5DFE3501F6ADB0189650B9E3F0
SHA-256:	2EA536699095CC8F302A3419F0BA09FF1DAD74007D59DEA6DC632B7B66CF9497
SHA-512:	353212F063A3D1C077F9DD61821A89C44BE1B8FF94D42417CFF7E5F3D323B2CA5AC3EEA527C4B0EFC6FC15322E927C96CAEADAD6AE617365C74E03ED43006A10
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC3FD91E8C01D084D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE84AE1E77412CBFC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.55646028551134
Encrypted:	false
SSDEEP:	48:N8PhKuRc06WXiljT54udFmvk6sx0LSmRSqdHBIAmU0SIpZ9mv:whK1LjTlFfPxGVRDKA+lZ9
MD5:	85F793BD33A80FC52BFD981466EE362B
SHA1:	C21E084CDB7F1BAA3EC2867D8FFBEDB39764E9EE
SHA-256:	56912F4205A5AA3A93F6031EB8B8BFF7747F5D7CF60A0A800EC3DA81A420F7F9
SHA-512:	5C0408721A1C79262C31C185AFD62BB05E04C2EF4971B8CD74F4E2C24F007C0FD4E66BA8136191A473C4D267B27C8C20195184D6DB44E2576C7A0730F962C8E3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEC3130DD10466341.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5606129635753057
Encrypted:	false
SSDEEP:	48:+8PhKuRc06WXiZjT54od96RLjxL4x3wSmRSqdHBIAmU0SIV8Zmc:xhK13jTz9aLVL4xAVRDKA+J8Zmc
MD5:	648DFED862A25640DA4EC2CC33B8A1EA
SHA1:	AE4309B88377ECA7EDB8CEE206A39256F13410F9
SHA-256:	BFF1A2AB297D1CC18E26CA317CE8C35BF02C800775C489E14AA60AA23D4753F4
SHA-512:	322EC139117917FF60BEF7B2DE28A42DE954D6581E99CA69A82BC9466EBDE9F65DB6A7895EB909148CD26F64DDC83B43AB311856F5E8C7FD9AD7B179726EC9A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (837)
Category:	downloaded
Size (bytes):	842
Entropy (8bit):	5.177119263985405
Encrypted:	false
SSDEEP:	24:MiTYix0+e/QqBHslgT9lCuABuoB7HHHHHHHYqmffffffo:y+0QqKlgZ01BuSEqmffffffo
MD5:	EEA35622EA2DC61CD80C0D8F7B613036
SHA1:	1D37D1690A4B01FB87D902174EB85D235A2AB193
SHA-256:	545E4F673D713668D4E06A08ECD6321BD6B0CBB325C9E2805CD86658D9341351
SHA-512:	785C32B4585A4A1A9EDF76E49ECEC535A877DC7424BC1E123D6DEA4B1763AC8A3CB006FB78478E099B7A64D137E949C1508B3993352B56D1BC3AE48CB045A49A
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["philly pretzel factory free pretzel day","hearthstone battlegrounds patch notes","miami dolphins nfl draft picks","apple iphone 16 pro max","new smyrna beach florida explosion","american horror story delicate ending","chicago bears draft caleb williams","starbucks drinks half off"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

\Device\ConDrv

Download File

Process:	C:\Windows\System32\findstr.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	2.394281147713395
Encrypted:	false
SSDEEP:	3:rN7:R
MD5:	96132D1C57EFDD17346DAA089949FBC5
SHA1:	FE4CD1A130874F0F05F203FF5F02DCA95210D36B
SHA-256:	EF2715E4B8447CEE08E6075E90BED35E0637B80CB2A9B9B8A2842E2A47C74D06
SHA-512:	34A5CC4176A746744284A3D2224F86D1A493A816622A2E978A71D771CC6B584C74B642BAD92752261D895613F03D33C3F3151BF97F56A52EA9A91C02F21F8395
Malicious:	false
Preview:	64-bit ...

\Device\Null

Download File

Process:	C:\Windows\System32\sc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	122
Entropy (8bit):	4.7381372398275685
Encrypted:	false
SSDEEP:	3:3JQycnQk2HwDHmzgYVhovoUWMMABhDHEKpKBWRr7ZOBFHDHna:PcnQkUwTmxVQoPMxDHEKsgRHZOBFjHa
MD5:	6BBCFD360C0797E6650F0D3CB1C36109
SHA1:	E22B5F6A4654134D687A3908464E67FAA23D84FF
SHA-256:	DF023CA139E8DCB21F0D4A603B34AF95F980C1E388C97E4735DD698D0329113C
SHA-512:	0281C1CC1B104C73F130068A905E37B75F3C3A40884D3E2CC421AEAF6A3C6B938393894FE750FA7DE44B9D0A25F9B3C11BB386FD133B3D710A549632ED9EA604
Malicious:	false
Preview:	[SC] EnumQueryServicesStatus:OpenService FAILED 1060:....The specified service does not exist as an installed service.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.996760224594817
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	starwindconverter.exe
File size:	40'311'016 bytes
MD5:	f9545db50cc40988b62b49ffce2874be
SHA1:	12af954da045061b75c15322fa6f761bab09a787
SHA256:	3018ec56677e92e472fad392c390b606b9e8c93927766a900ab808e9e791882a
SHA512:	b49ae0273cb81a04228e741ea0576986c0f50cb500d8e4f31c15e17f65df5c66582b641af08817bced081de73c50d0e53e7d3200608515adaf564a7d4700fc82
SSDEEP:	786432:BAREEk61HFRTOD8cet2A+IAudir7ooXhYqxDybBBkXHABFe9N3AFJy3m:BL61lRTGj42A+IALsqx3XOM7kum
TLSH:	60973371AA835162C22BD3F16ECAD6B576AC4CA470E75050F817BFAD91DE0F08B482DD
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	073970c4c071231f

Static PE Info

General

Entrypoint:	0x40aa98
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	2fb819a19fe4dee5c03e8c6a79342f79

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	18/03/2022 00:00:00 12/03/2025 23:59:59
Subject Chain	CN=StarWind Software Inc., O=StarWind Software Inc., L=Beverly, S=Massachusetts, C=US, SERIALNUMBER=4622652, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	4913CA78CC77560D04A0910135332130
Thumbprint SHA-1:	F406B38E7F576528F095C7990BD17C42494756CD
Thumbprint SHA-256:	F94CA43AC433306052BAA10B77E7ABD12B9ADB88358F4E634F929DFDD96F7380
Serial:	0BB6C3EE98C30DD60AC16C2743C6E64C

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007F4B41107813h
call 00007F4B41108A1Ah
call 00007F4B41108D81h
call 00007F4B4110919Ch
call 00007F4B4110B13Bh
call 00007F4B4110DAD2h
call 00007F4B4110DC39h
xor eax, eax
push ebp
push 0040B169h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040B132h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040D014h]
call 00007F4B4110E70Bh
call 00007F4B4110E2F6h
cmp byte ptr [0040C234h], 00000000h
je 00007F4B4110F1EEh
call 00007F4B4110E808h
xor eax, eax
call 00007F4B41108509h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007F4B4110B74Bh
mov edx, dword ptr [ebp-10h]
mov eax, 0040DE30h
call 00007F4B411078AAh
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040DE30h]
mov dl, 01h
mov eax, 00407808h
call 00007F4B4110C006h
mov dword ptr [0040DE34h], eax
xor edx, edx
push ebp
push 0040B0EAh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F4B4110E766h
mov dword ptr [0040DE3Ch], eax
mov eax, dword ptr [0040DE3Ch]
cmp dword ptr [eax+0Ch], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe000	0x97c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x4745c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x266c680	0x5268
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11000	0x0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x10000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0xa1d0	0xa200	b7ea439d9c6d5ec722056c9243fb3054	False	0.6025028935185185	data	6.643749028594943	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xc000	0x250	0x400	9b2268ed5360951559d8041925d025fb	False	0.3037109375	data	2.740124513017086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xd000	0xe94	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xe000	0x97c	0xa00	df5f31e62e05c787fd29eed7071bf556	False	0.41796875	data	4.486076246232586	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x10000	0x18	0x200	14dfa4128117e7f94fe2f8d7dea374a0	False	0.05078125	data	0.190488766434666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x11000	0x91c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x4745c	0x47600	e8a51e93d847bd0682bb8e1f667be344	False	0.05206737084063047	data	1.929971021192952	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x12354	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.03774743320413054
RT_ICON	0x5437c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.1370331950207469
RT_ICON	0x56924	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.1925422138836773
RT_ICON	0x579cc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2721631205673759
RT_STRING	0x57e34	0x2f2	data			0.35543766578249336
RT_STRING	0x58128	0x30c	data			0.3871794871794872
RT_STRING	0x58434	0x2ce	data			0.42618384401114207
RT_STRING	0x58704	0x68	data			0.75
RT_STRING	0x5876c	0xb4	data			0.6277777777777778
RT_STRING	0x58820	0xae	data			0.5344827586206896
RT_RCDATA	0x588d0	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x588fc	0x3e	data	English	United States	0.8225806451612904
RT_VERSION	0x5893c	0x4f4	data	English	United States	0.305205047318612
RT_MANIFEST	0x58e30	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetVersion, GetUserDefaultLangID, GetSystemInfo, GetSystemDirectoryA, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 17:49:03.000041008 CEST	49675	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:49:17.157377005 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:17.157463074 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:17.157574892 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:17.200315952 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:17.200360060 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:17.832709074 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:17.832838058 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:17.837351084 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:17.837382078 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:17.837734938 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:17.890662909 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:18.624975920 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:18.672115088 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029457092 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029480934 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029499054 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029512882 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029521942 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029527903 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029619932 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:19.029675961 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029740095 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:19.029767036 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:19.029829979 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029905081 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:19.029920101 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.029946089 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:19.030018091 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:20.521435976 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:20.521507025 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:49:20.521543980 CEST	49731	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:49:20.521564007 CEST	443	49731	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:00.905450106 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:00.905920982 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:00.905957937 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:00.906023979 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:00.934701920 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:00.934717894 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:01.375344992 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:01.484091043 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:01.484164953 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:01.589118004 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:01.589147091 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:01.589487076 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:01.589574099 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:01.590095997 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:01.590122938 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:01.591248035 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:01.591253996 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:01.984996080 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:02.218461990 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:02.218787909 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:02.218919992 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:03.187581062 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:04.619051933 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:04.619081020 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:04.619137049 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:04.620090961 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:04.620105982 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.238445997 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.238512993 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.267268896 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.267294884 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.267668009 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.390173912 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.432142973 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.687566996 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:05.856760979 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856785059 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856791973 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856818914 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856833935 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856848955 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856852055 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.856868982 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856877089 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856897116 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856904030 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.856904030 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856920004 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.856920958 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.856945038 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.856971025 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.857031107 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.861310005 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.861335993 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:05.861354113 CEST	49738	443	192.168.2.4	20.114.59.183
Apr 26, 2024 17:50:05.861361027 CEST	443	49738	20.114.59.183	192.168.2.4
Apr 26, 2024 17:50:10.500086069 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:20.140702963 CEST	49672	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:30.253376961 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:30.253417969 CEST	443	49737	173.222.162.32	192.168.2.4
Apr 26, 2024 17:50:30.253453970 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:30.253468037 CEST	49737	443	192.168.2.4	173.222.162.32
Apr 26, 2024 17:50:37.752167940 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.752191067 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:37.752240896 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.752464056 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.752489090 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:37.752547026 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.752732038 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.752746105 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:37.752882004 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.752897024 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:37.767110109 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.767148972 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:37.767209053 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.767379045 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.767393112 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:37.767775059 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.767787933 CEST	443	49745	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:37.767839909 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.767995119 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:37.768006086 CEST	443	49745	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:38.088705063 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:38.097398043 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:38.139404058 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:38.239926100 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:38.240117073 CEST	443	49745	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:38.256309032 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:38.337537050 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:38.444119930 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:38.444216013 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.278776884 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.278809071 CEST	443	49745	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.279103041 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.279138088 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.279628992 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.279642105 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.279838085 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.279855967 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.280335903 CEST	443	49745	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.280349016 CEST	443	49745	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.280375957 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.280401945 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.280461073 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.281028032 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.281085968 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.283885002 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.283922911 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.283951998 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.284229040 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.284310102 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.284837008 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.284926891 CEST	443	49745	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.285142899 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.285151005 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.285218954 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.285238028 CEST	443	49745	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.286964893 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.287151098 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.290725946 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.290769100 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.290787935 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.290863991 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.291289091 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.291318893 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.333695889 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.333697081 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.358786106 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.358808994 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.548357010 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.548408985 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.548474073 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.548500061 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.552500963 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.552567005 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.685466051 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.685578108 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.685617924 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.685847044 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.685904980 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.728177071 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.728249073 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.728272915 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.728286982 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.728327036 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.742090940 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.742177963 CEST	443	49745	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.742229939 CEST	49745	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.808979988 CEST	49742	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.808991909 CEST	443	49742	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.809711933 CEST	49744	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.809734106 CEST	443	49744	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.812648058 CEST	49743	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.812654972 CEST	443	49743	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.823834896 CEST	49746	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.823860884 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.823921919 CEST	49746	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.824146986 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.824167013 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.824213982 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.824426889 CEST	49746	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.824440956 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:39.824606895 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:39.824619055 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.158011913 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.159725904 CEST	49746	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.159737110 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.160583019 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.160902977 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.163590908 CEST	49746	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.163678885 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.163872004 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.163887024 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.164072037 CEST	49746	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.165373087 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.165430069 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.165893078 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.165971041 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.166018009 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.208122015 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.208136082 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.250876904 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.250895977 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.452666044 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.486094952 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.486217976 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.486263037 CEST	49746	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.486274958 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.486738920 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.486789942 CEST	49746	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.487179995 CEST	49746	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.487194061 CEST	443	49746	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.558259010 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.558327913 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.558367968 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.558374882 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.558410883 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.558463097 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.559134007 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.559199095 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:40.559240103 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.601640940 CEST	49747	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:40.601680994 CEST	443	49747	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:41.703962088 CEST	49750	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:41.703995943 CEST	443	49750	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:41.704112053 CEST	49750	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:41.704318047 CEST	49750	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:41.704336882 CEST	443	49750	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:42.045116901 CEST	443	49750	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:42.140481949 CEST	49750	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:43.173162937 CEST	49750	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:43.173190117 CEST	443	49750	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:43.174675941 CEST	443	49750	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:43.214061022 CEST	49750	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:43.214257002 CEST	443	49750	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:43.432120085 CEST	443	49750	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:43.432167053 CEST	49750	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:52.036223888 CEST	443	49750	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:52.036403894 CEST	443	49750	142.250.64.196	192.168.2.4
Apr 26, 2024 17:50:52.036544085 CEST	49750	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:54.070904970 CEST	49750	443	192.168.2.4	142.250.64.196
Apr 26, 2024 17:50:54.070924997 CEST	443	49750	142.250.64.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 26, 2024 17:49:20.127621889 CEST	138	138	192.168.2.4	192.168.2.255
Apr 26, 2024 17:50:37.543025970 CEST	53	60782	1.1.1.1	192.168.2.4
Apr 26, 2024 17:50:37.625838041 CEST	62912	53	192.168.2.4	1.1.1.1
Apr 26, 2024 17:50:37.626257896 CEST	58453	53	192.168.2.4	1.1.1.1
Apr 26, 2024 17:50:37.744549036 CEST	53	52641	1.1.1.1	192.168.2.4
Apr 26, 2024 17:50:37.751174927 CEST	53	58453	1.1.1.1	192.168.2.4
Apr 26, 2024 17:50:37.751745939 CEST	53	62912	1.1.1.1	192.168.2.4
Apr 26, 2024 17:50:39.941745996 CEST	53	58148	1.1.1.1	192.168.2.4
Apr 26, 2024 17:50:58.547281981 CEST	53	57016	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 26, 2024 17:50:37.625838041 CEST	192.168.2.4	1.1.1.1	0x5691	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 26, 2024 17:50:37.626257896 CEST	192.168.2.4	1.1.1.1	0xae67	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 26, 2024 17:50:37.751174927 CEST	1.1.1.1	192.168.2.4	0xae67	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 26, 2024 17:50:37.751745939 CEST	1.1.1.1	192.168.2.4	0x5691	No error (0)	www.google.com		142.250.64.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

https:

www.bing.com

www.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:49:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BreXLoZztbAKvXo&MD=CkxPD1Rx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 15:49:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5f9d6c7d-b19a-4a0a-93c7-26a40dca3463 MS-RequestId: 5eca7f0e-4221-4faf-bf97-6ef2d6defc1a MS-CV: PiuItZtanUCuWF8a.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 15:49:18 GMT Connection: close Content-Length: 24490
2024-04-26 15:49:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-26 15:49:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49737	173.222.162.32	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:50:01 UTC	2301	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A4109000CC6 X-BM-CBT: 1696420817 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 60 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 0912CF9094994CFA88DE52C6FB19D4E1 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A4109000CC6 X-MSEdge-ExternalExp: bfbwsbrs0830tf,d-thshldspcl40,msbdsborgv2co,msbwdsbi920t1,spofglclicksh-c2,webtophit0r_t,wsbmsaqfuxtc,wsbqfasmsall_t,wsbqfminiserp400,wsbref-t X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=0; DaylightBias=-60; TimeZoneKeyName=GMT Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2236 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=6666694284484FA1B35CCB433D42E997; _SS=SID=193A581F83766B4319784BBF829B6A16&CPID=1696420820117&AC=1&CPH=e5c79613&CBV=39942242; _EDGE_S=SID=193A581F83766B4319784BBF829B6A16; SRCHUID=V=2&GUID=BA43D82178364AEA9C1EE6C32BE93416&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231003; SRCHHPGUSR=SRCHLANG=en&LUT=1696420817741&IPMH=425591ef&IPMID=1696420817913&HV=1696417346; ANON=A=6D8F9DF00282E660E425530EFFFFFFFF; CortanaAppUID=4C9C2B2D0465FD7A42C74C7E93CFB630; MUIDB=6666694284484FA1B35CCB433D42E997
2024-04-26 15:50:01 UTC	2236	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 36 36 36 36 36 39 34 32 38 34 34 38 34 46 41 31 42 33 35 43 43 42 34 33 33 44 34 32 45 39 39 37 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 38 39 32 46 41 30 37 38 38 36 34 31 34 42 44 46 38 45 45 31 37 36 34 41 35 39 46 46 33 39 43 36 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 Data Ascii: <ClientInstRequest><CID>6666694284484FA1B35CCB433D42E997</CID><Events><E><T>Event.ClientInst</T><IG>892FA07886414BDF8EE1764A59FF39C6</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"C
2024-04-26 15:50:02 UTC	479	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: B1E6767B026A47FA919FDEB4075D79F0 Ref B: LAX311000111021 Ref C: 2024-04-26T15:50:02Z Date: Fri, 26 Apr 2024 15:50:02 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.20a6dc17.1714146601.725197b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:50:05 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BreXLoZztbAKvXo&MD=CkxPD1Rx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-26 15:50:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 0a38b8c8-3f9c-49c7-b348-3843a7ac0e5e MS-RequestId: db3201f1-de9b-45f2-aaff-89cb6083f23c MS-CV: WQhbLlMpq0CR8r7Z.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Apr 2024 15:50:04 GMT Connection: close Content-Length: 25457
2024-04-26 15:50:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-26 15:50:05 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	142.250.64.196	443	6204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:50:39 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:50:39 UTC	1703	IN	HTTP/1.1 200 OK Date: Fri, 26 Apr 2024 15:50:39 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-1KdpDVCjfz_n-Z5zvKCA9g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-04-26 15:50:39 UTC	849	IN	Data Raw: 33 34 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 68 69 6c 6c 79 20 70 72 65 74 7a 65 6c 20 66 61 63 74 6f 72 79 20 66 72 65 65 20 70 72 65 74 7a 65 6c 20 64 61 79 22 2c 22 68 65 61 72 74 68 73 74 6f 6e 65 20 62 61 74 74 6c 65 67 72 6f 75 6e 64 73 20 70 61 74 63 68 20 6e 6f 74 65 73 22 2c 22 6d 69 61 6d 69 20 64 6f 6c 70 68 69 6e 73 20 6e 66 6c 20 64 72 61 66 74 20 70 69 63 6b 73 22 2c 22 61 70 70 6c 65 20 69 70 68 6f 6e 65 20 31 36 20 70 72 6f 20 6d 61 78 22 2c 22 6e 65 77 20 73 6d 79 72 6e 61 20 62 65 61 63 68 20 66 6c 6f 72 69 64 61 20 65 78 70 6c 6f 73 69 6f 6e 22 2c 22 61 6d 65 72 69 63 61 6e 20 68 6f 72 72 6f 72 20 73 74 6f 72 79 20 64 65 6c 69 63 61 74 65 20 65 6e 64 69 6e 67 22 2c 22 63 68 69 63 61 67 6f 20 62 65 61 72 73 20 64 72 61 66 74 20 63 Data Ascii: 34a)]}'["",["philly pretzel factory free pretzel day","hearthstone battlegrounds patch notes","miami dolphins nfl draft picks","apple iphone 16 pro max","new smyrna beach florida explosion","american horror story delicate ending","chicago bears draft c
2024-04-26 15:50:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	142.250.64.196	443	6204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:50:39 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	142.250.64.196	443	6204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:50:39 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:50:39 UTC	1843	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGM-ar7EGIjAqkOFqfrWsUuYYc-cHY4mS2DMqZX8MiAbTgaXolWeyzV_Jwf75R-0hkajKDO7EEd0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIz5qvsQYQrsKatgISBGaBmNw Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 15:50:39 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-15; expires=Sun, 26-May-2024 15:50:39 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=kE4w8jVXQIKRBgnq2rSSuaeuj3V2oSTKpqDMdDROtfpQ8ynJq8dNWPI6cgFo4Z4M0m5JoqPofUAZ9lJDVPiOjdefNwcwKWrDPalqZGUDc-424T0yhgswfw6_8_P82oXXUD2LaGrnzZFPtUD6RmGvm8o3nBadhzqNR5DdgtcTsGI; expires=Sat, 26-Oct-2024 15:50:39 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:50:39 UTC	458	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	142.250.64.196	443	6204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:50:39 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-26 15:50:39 UTC	1761	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGM-ar7EGIjDPDwLUDTsFOtyhKJAT5DyNT4-JYGy8AQvI_i61IsKnO-HCW4ZF9DcmjkgW5xqtABsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwIz5qvsQYQyL7KoQISBGaBmNw Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 26 Apr 2024 15:50:39 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-04-26-15; expires=Sun, 26-May-2024 15:50:39 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=513=MYcWBNr2Ael5MzjiFxMtccXcOKcndM8C3EedaIGOD22hSk7ob6okVrEAo9lJ7s3J_UIGCBG94IEb98CCbcPEqkwkpn72xU6jvkZ_ztQ5CG4bH25-tmR2CJuC9FZ-t_6F-T6RfztwgoKv_sh3BFr3wI5eJNeaLkFkxTxLlxYPhAY; expires=Sat, 26-Oct-2024 15:50:39 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:50:39 UTC	417	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	142.250.64.196	443	6204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:50:40 UTC	738	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZjcGM-ar7EGIjDPDwLUDTsFOtyhKJAT5DyNT4-JYGy8AQvI_i61IsKnO-HCW4ZF9DcmjkgW5xqtABsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-15; NID=513=kE4w8jVXQIKRBgnq2rSSuaeuj3V2oSTKpqDMdDROtfpQ8ynJq8dNWPI6cgFo4Z4M0m5JoqPofUAZ9lJDVPiOjdefNwcwKWrDPalqZGUDc-424T0yhgswfw6_8_P82oXXUD2LaGrnzZFPtUD6RmGvm8o3nBadhzqNR5DdgtcTsGI
2024-04-26 15:50:40 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 15:50:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3114 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:50:40 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2024-04-26 15:50:40 UTC	1255	IN	Data Raw: 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 70 43 70 54 76 33 73 49 4f 71 42 74 57 75 2d 68 71 47 59 44 48 5f 73 76 36 4f 5a 4c 5f 49 74 57 6c Data Ascii: ack = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="pCpTv3sIOqBtWu-hqGYDH_sv6OZL_ItWl
2024-04-26 15:50:40 UTC	960	IN	Data Raw: 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e Data Ascii: ogle automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solvin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	142.250.64.196	443	6204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-26 15:50:40 UTC	912	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZjcGM-ar7EGIjAqkOFqfrWsUuYYc-cHY4mS2DMqZX8MiAbTgaXolWeyzV_Jwf75R-0hkajKDO7EEd0yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2024-04-26-15; NID=513=kE4w8jVXQIKRBgnq2rSSuaeuj3V2oSTKpqDMdDROtfpQ8ynJq8dNWPI6cgFo4Z4M0m5JoqPofUAZ9lJDVPiOjdefNwcwKWrDPalqZGUDc-424T0yhgswfw6_8_P82oXXUD2LaGrnzZFPtUD6RmGvm8o3nBadhzqNR5DdgtcTsGI
2024-04-26 15:50:40 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 26 Apr 2024 15:50:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3186 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-04-26 15:50:40 UTC	899	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2024-04-26 15:50:40 UTC	1255	IN	Data Raw: 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 39 35 56 4a 38 46 53 63 78 Data Ascii: <script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="95VJ8FScx
2024-04-26 15:50:40 UTC	1032	IN	Data Raw: 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 Data Ascii: ; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly aft

Target ID:	0
Start time:	17:49:02
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\starwindconverter.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\starwindconverter.exe"
Imagebase:	0x400000
File size:	40'311'016 bytes
MD5 hash:	F9545DB50CC40988B62B49FFCE2874BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:49:03
Start date:	26/04/2024
Path:	C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-DTP8T.tmp\starwindconverter.tmp" /SL5="$10446,40015629,338944,C:\Users\user\Desktop\starwindconverter.exe"
Imagebase:	0x400000
File size:	1'015'912 bytes
MD5 hash:	2356F5F81D797DFA2A9C35E973358693
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:49:44
Start date:	26/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:49:55
Start date:	26/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\StarWind Software\StarWind V2V Converter\lib\vstor2install.bat""
Imagebase:	0x7ff7cd7c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:49:55
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:49:59
Start date:	26/04/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic OS get OSArchitecture
Imagebase:	0x7ff76b290000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:49:59
Start date:	26/04/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr 64
Imagebase:	0x7ff6fdc10000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:50:00
Start date:	26/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query vstor2-mntapi20-shared
Imagebase:	0x7ff7c4990000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:50:00
Start date:	26/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc create vstor2-mntapi20-shared type= kernel start= auto error= normal binpath= System32\drivers\vstor2-mntapi20-shared.sys DisplayName= "Vstor2 MntApi 2.0 Driver (shared)" group= System
Imagebase:	0x7ff7c4990000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:50:00
Start date:	26/04/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start vstor2-mntapi20-shared
Imagebase:	0x7ff7c4990000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:50:00
Start date:	26/04/2024
Path:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe" /quiet
Imagebase:	0x7c0000
File size:	7'194'312 bytes
MD5 hash:	96B61B8E069832E6B809F24EA74567BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:50:00
Start date:	26/04/2024
Path:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.130.exe" /quiet -burn.unelevated BurnPipe.{D7692551-F3D1-4F96-B98C-6EA8EBCE2C29} {99F278BD-B402-4D45-B367-3A71E4C78909} 4116
Imagebase:	0x7c0000
File size:	7'194'312 bytes
MD5 hash:	96B61B8E069832E6B809F24EA74567BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:50:01
Start date:	26/04/2024
Path:	C:\Windows\System32\VSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\vssvc.exe
Imagebase:	0x7ff7bd290000
File size:	1'495'040 bytes
MD5 hash:	875046AD4755396636A68F4A9EDB22A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	17:50:03
Start date:	26/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k swprv
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	17:50:25
Start date:	26/04/2024
Path:	C:\Windows\System32\SrTasks.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Imagebase:	0x7ff7ffc00000
File size:	59'392 bytes
MD5 hash:	2694D2D28C368B921686FE567BD319EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:50:25
Start date:	26/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:50:28
Start date:	26/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff704dc0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	17:50:35
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http:///
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	17:50:35
Start date:	26/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	17:50:36
Start date:	26/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1904,i,7260468871230898073,3398952734327397412,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	17:50:39
Start date:	26/04/2024
Path:	C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" /burn.runonce
Imagebase:	0x7ff70f330000
File size:	461'400 bytes
MD5 hash:	E16E6D68CE1949C9721656390F47CE07
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:50:39
Start date:	26/04/2024
Path:	C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe"
Imagebase:	0xa70000
File size:	461'400 bytes
MD5 hash:	E16E6D68CE1949C9721656390F47CE07
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	17:50:39
Start date:	26/04/2024
Path:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe" /quiet
Imagebase:	0xdb0000
File size:	14'572'000 bytes
MD5 hash:	27B141AACC2777A82BB3FA9F6E5E5C1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:50:40
Start date:	26/04/2024
Path:	C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\StarWind Software\StarWind V2V Converter\vc\vc_redist.x64.140.exe" /quiet -burn.unelevated BurnPipe.{621695C5-B52A-43D6-BAAE-CEAD8A9F5342} {3E01C30D-E9A5-4BF9-AFE0-A4D60C443091} 3452
Imagebase:	0xdb0000
File size:	14'572'000 bytes
MD5 hash:	27B141AACC2777A82BB3FA9F6E5E5C1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.9%
Total number of Nodes:	1541
Total number of Limit Nodes:	24

Executed Functions

Function 00404654 Relevance: 42.2, APIs: 7, Strings: 17, Instructions: 174
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,004048EE,?,?,?,?,00000000,?,0040AAB8), ref: 0040466F
GetVersion.KERNEL32(kernel32.dll,00000000,004048EE,?,?,?,?,00000000,?,0040AAB8), ref: 00404676
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0040468B
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004046B3
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004048B5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004048CB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,kernel32.dll,00000000,004048EE,?,?,?,?,00000000,?,0040AAB8), ref: 004048D6

Strings

cryptbase.dll, xrefs: 004047EE
uxtheme.dll, xrefs: 0040471C
apphelp.dll, xrefs: 00404785
kernel32.dll, xrefs: 0040466A
SetDefaultDllDirectories, xrefs: 00404685
dwmapi.dll, xrefs: 004047CB
SetDllDirectoryW, xrefs: 004046AD
SetProcessDEPPolicy, xrefs: 004048C5
userenv.dll, xrefs: 0040473F
propsys.dll, xrefs: 004047A8
version.dll, xrefs: 00404834
oleacc.dll, xrefs: 00404811
profapi.dll, xrefs: 00404857
SetSearchPathMode, xrefs: 004048AF
comres.dll, xrefs: 0040487A
setupapi.dll, xrefs: 00404762
clbcatq.dll, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcessVersion
String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$kernel32.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
API String ID: 3297890031-2388063882
Opcode ID: 6206738d1768993a266272c574535deacfcb651ff371490375f42cd1ba234e07
Instruction ID: 9e7baa03e94b680687c531d55c537e9110a8ac934c54f9465d7227ec1282235b
Opcode Fuzzy Hash: 6206738d1768993a266272c574535deacfcb651ff371490375f42cd1ba234e07
Instruction Fuzzy Hash: B2611070600149AFDB00FBF6DA8398E77A99F80309B2045BBA604772D6D778EF059B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A018 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 0040A02A
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 0040A035
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 0040A076
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 0040A0A8
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 0040A0B8

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 9ac3e84cebc6f461d525c38fea5a33ab6cb0156132446b09103c7350edb016b4
Instruction ID: f5309bbdda193f62b4be3c179e768a57e3f3f612c04de257546ab44ee606f1f6
Opcode Fuzzy Hash: 9ac3e84cebc6f461d525c38fea5a33ab6cb0156132446b09103c7350edb016b4
Instruction Fuzzy Hash: 142190B1240308ABD6309E69CC85F5777D8DF85354F08493AFAC5E33C2D63DE860866A

Uniqueness

Uniqueness Score: -1.00%

Function 0040565C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040D4C0,00000001,?,00405727,?,00000000,00405806), ref: 0040567A

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7459d56e7c64c485d498697c6eb088ce7aaa21e11ea95b6c07db09bb75ef8263
Instruction ID: d14b50eaf9df709ed1cf3d56deeb77a2084f63d122e7671578114c6bad5e918b
Opcode Fuzzy Hash: 7459d56e7c64c485d498697c6eb088ce7aaa21e11ea95b6c07db09bb75ef8263
Instruction Fuzzy Hash: 68E0D87170021427D711A9699C86EFB735CDB58314F4006BFB909E73C6EDB59E8046ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409520 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004095DE,?,?,?,?,00000000,00000000,?,0040AACC), ref: 00409542
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00409548
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004095DE,?,?,?,?,00000000,00000000,?,0040AACC), ref: 0040955C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00409562

Strings

Wow64RevertWow64FsRedirection, xrefs: 00409552
kernel32.dll, xrefs: 0040953D, 00409557
shell32.dll, xrefs: 0040959F
Wow64DisableWow64FsRedirection, xrefs: 00409538

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 9711803e7e97600f978dac47126909fe1692835b2a3da83a2610dda9fb37f9b7
Instruction ID: 3d1781b746021e9606986d5b6d55f7cbde73f6a932e0ba52378b2443c6d91f24
Opcode Fuzzy Hash: 9711803e7e97600f978dac47126909fe1692835b2a3da83a2610dda9fb37f9b7
Instruction Fuzzy Hash: 79115470908244BEDB01FBA2CD43B5A7B68D784744F204477F501762D3DA7D5E08DA2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF57 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409AE8: GetLastError.KERNEL32(00000000,00409B8B), ref: 00409B0C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AF9E
SetWindowLongA.USER32(00010446,000000FC,Function_00009E00), ref: 0040AFB5

Part of subcall function 00406FCC: GetCommandLineA.KERNEL32(00000000,00407010,?,?,?,?,00000000), ref: 00406FE4

Part of subcall function 00409E8C: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000,00409F5F), ref: 00409EFC
Part of subcall function 00409E8C: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000), ref: 00409F10
Part of subcall function 00409E8C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409F29
Part of subcall function 00409E8C: GetExitCodeProcess.KERNEL32(?), ref: 00409F3B
Part of subcall function 00409E8C: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78), ref: 00409F44

RemoveDirectoryA.KERNEL32(00000000,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0A1
DestroyWindow.USER32(00010446,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0B5

Strings

STATIC, xrefs: 0040AF97
/SL5="$%x,%d,%d,, xrefs: 0040AFF5
InnoSetupLdrWindow, xrefs: 0040AF92

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryErrorExitLastLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 849423697-3001827809
Opcode ID: 08113ef3ce2da518920d8c13058acc363925f6704d668fbfbfd076efd3cb2295
Instruction ID: d96ad4f456555d006dfdd6a111ba55fa130d32b67bbf9cfe256734ebf9c0f5f1
Opcode Fuzzy Hash: 08113ef3ce2da518920d8c13058acc363925f6704d668fbfbfd076efd3cb2295
Instruction Fuzzy Hash: 95413070A006449BD711EBE9EE85B9A77E4EB58304F10427BF514BB2E1C7B89C49CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF42 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AF9E
SetWindowLongA.USER32(00010446,000000FC,Function_00009E00), ref: 0040AFB5

Part of subcall function 00406FCC: GetCommandLineA.KERNEL32(00000000,00407010,?,?,?,?,00000000), ref: 00406FE4

Part of subcall function 00409E8C: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000,00409F5F), ref: 00409EFC
Part of subcall function 00409E8C: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000), ref: 00409F10
Part of subcall function 00409E8C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409F29
Part of subcall function 00409E8C: GetExitCodeProcess.KERNEL32(?), ref: 00409F3B
Part of subcall function 00409E8C: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78), ref: 00409F44

RemoveDirectoryA.KERNEL32(00000000,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0A1
DestroyWindow.USER32(00010446,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0B5

Strings

STATIC, xrefs: 0040AF97
/SL5="$%x,%d,%d,, xrefs: 0040AFF5
InnoSetupLdrWindow, xrefs: 0040AF92

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: 3e82f52e343573e9ee8ccf82fbc097b32b2466bbbc9497f93a956efcdcfa5545
Instruction ID: 22e85acea042a1c9b241f29fbd05952515ad99a43a6683ef4ce3977848861488
Opcode Fuzzy Hash: 3e82f52e343573e9ee8ccf82fbc097b32b2466bbbc9497f93a956efcdcfa5545
Instruction Fuzzy Hash: 00410971A006049BD710EBE9EE85BAA77A4EB58304F10427AF514BB2E1D7789C48CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 00409E8C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000,00409F5F), ref: 00409EFC
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78,00000000), ref: 00409F10
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409F29
GetExitCodeProcess.KERNEL32(?), ref: 00409F3B
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409F84,?,00409F78), ref: 00409F44

Part of subcall function 00409AE8: GetLastError.KERNEL32(00000000,00409B8B), ref: 00409B0C

Strings

D, xrefs: 00409ED6

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 7df226d52587f770460e981b15b5d19bc6ab37567cde566df4420800d0169a2d
Instruction ID: c83664c5db2498e28503e3c1fa1a9009394fa647db11d74ebe1f458a85c7f7ae
Opcode Fuzzy Hash: 7df226d52587f770460e981b15b5d19bc6ab37567cde566df4420800d0169a2d
Instruction Fuzzy Hash: 19113DB16042096ADB00EBE6CC42F9EB7ACEF89714F50017AB604F72C6DA789D048669

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040D41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040D41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040D41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 15ada844baba389fd7ade49cb76aeb00e47773f80fc89bec03b8d509a4e9cc02
Instruction ID: 2a1e8c518b16d72ac75c21d19d034316e64e92064156904d4596c6339aa50fda
Opcode Fuzzy Hash: 15ada844baba389fd7ade49cb76aeb00e47773f80fc89bec03b8d509a4e9cc02
Instruction Fuzzy Hash: 65114274B422805ADB11EBE99EC6F5276689785708F44407FF448B62F2C67CA848CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACB4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040AD18

Strings

.tmp, xrefs: 0040AD5E
@z@, xrefs: 0040ADCC
d~@, xrefs: 0040AE21

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: Message
String ID: .tmp$@z@$d~@
API String ID: 2030045667-2080866987
Opcode ID: 2b85bf55d00087c4ee4d3d53e5bb2d438756d7f2ac1061807f4f56549d36f6d1
Instruction ID: dd76c9251985b1ff4450233ddc9785193850427026a6d5c0e90a1b5537d094b7
Opcode Fuzzy Hash: 2b85bf55d00087c4ee4d3d53e5bb2d438756d7f2ac1061807f4f56549d36f6d1
Instruction Fuzzy Hash: 4B419570A046009FD705EFA5DE91A2A77A5EB59304B11447BF804BB7E1CA79AC04CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACCF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040AD18

Strings

.tmp, xrefs: 0040AD5E
@z@, xrefs: 0040ADCC
d~@, xrefs: 0040AE21

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: Message
String ID: .tmp$@z@$d~@
API String ID: 2030045667-2080866987
Opcode ID: 81bdbc4c120031e8217955485f9b4631603aba5f155e491865d52178ba1ca84f
Instruction ID: bf9d77eae5c07405b3109107b1835c74e23881a639ebcc62aff07684a9841850
Opcode Fuzzy Hash: 81bdbc4c120031e8217955485f9b4631603aba5f155e491865d52178ba1ca84f
Instruction Fuzzy Hash: BF419570B006019FD705EFA5DE92A6A77A5EB59304B10447BF804BB7E1CBB9AC04CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 06c1af3a807ed13e53e556f1551eab319716f56e5b0a099a7904d38b73613604
Instruction ID: 19c161ad1fd1f445befe0ff666437f64548d8e35ccd3b0abec794ae5707e41c3
Opcode Fuzzy Hash: 06c1af3a807ed13e53e556f1551eab319716f56e5b0a099a7904d38b73613604
Instruction Fuzzy Hash: 0421C834E152418AE714EFE59A817153E989B5930DF04817BD504B73E3C67C9A4EC36E

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040D41C,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040D41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 8414f493d6facd55d67710fc415b07d88c3ef9d9c2abb5a5bebd487d02bb0f40
Instruction ID: ca3d82fa79822ebb621977d4c6345e30539334a4bf25a92a69ec079a2ec9ab95
Opcode Fuzzy Hash: 8414f493d6facd55d67710fc415b07d88c3ef9d9c2abb5a5bebd487d02bb0f40
Instruction Fuzzy Hash: F20192B4E442405EE715ABFA9A56B253BA4D789704F1080BFF044F72F2C67C6458C75D

Uniqueness

Uniqueness Score: -1.00%

Function 004097D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,004098BF,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409816
GetLastError.KERNEL32(00000000,00000000,?,00000000,004098BF,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040981F

Strings

.tmp, xrefs: 004097FF

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: bcfdd319b68c6234bb3b3c2b6e0791bb6992f3f2d01426f3b13c32e67b0b1ca6
Instruction ID: 48b9f2fdce89366346d31e95a36bae064327856a755920fc8e2ea7d65379a348
Opcode Fuzzy Hash: bcfdd319b68c6234bb3b3c2b6e0791bb6992f3f2d01426f3b13c32e67b0b1ca6
Instruction Fuzzy Hash: 23211575A10208ABDB05FFE5C8529DFB7B9EB48304F10457BE901B73C2DA789E05CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409978 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?), ref: 00409997
Sleep.KERNEL32(?), ref: 004099A7
GetLastError.KERNEL32(?), ref: 004099BA
GetLastError.KERNEL32(?), ref: 004099C4

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 1c248293a53693e5016b31d34f136ae5d975e0b827204b722e02cf7f87de802c
Instruction ID: 55ccdd2d2ee1bdbcd31af2ea42c7aee1c1b219f05c386506858fe4dd166fe014
Opcode Fuzzy Hash: 1c248293a53693e5016b31d34f136ae5d975e0b827204b722e02cf7f87de802c
Instruction Fuzzy Hash: 6AF090B2A0511856CA25A6AE9881B6FB28CEAC0368714413FFA44F7383D43DDC0152BA

Uniqueness

Uniqueness Score: -1.00%

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040D41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040D41C,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040D41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040D41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: f63e8093b7c21695f3c5f0f727b66ad92d47f8bd02e6a7dbcfb51ec74dbfdd03
Instruction ID: 72c497f3d878e3d6a4a9583ee00a9bb41c235ef620702b970aaba137d6b92855
Opcode Fuzzy Hash: f63e8093b7c21695f3c5f0f727b66ad92d47f8bd02e6a7dbcfb51ec74dbfdd03
Instruction Fuzzy Hash: 2341C2B2E007019FD710CFA9DE8561A7BA0EB58314B15817BD549B73E1D378A849CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00409438 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00409495), ref: 0040946F
GetLastError.KERNEL32(00000000,00000000,00409495), ref: 00409477

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: cef11d40a142b83803210e371880030b93b56e60c6b6d61991ebac398e5bf5ba
Instruction ID: 3a2bfa3924d7da3ec485a5c2eebce42195f764b2344cc107bbad9e5710e02f6c
Opcode Fuzzy Hash: cef11d40a142b83803210e371880030b93b56e60c6b6d61991ebac398e5bf5ba
Instruction Fuzzy Hash: 3EF0AF71A08608ABCB01EFB59C4159EB3A8EB8831476045BBF808F32C3E6395E018599

Uniqueness

Uniqueness Score: -1.00%

Function 0040741C Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 00407426
LoadLibraryA.KERNEL32(00000000,00000000,00407470,?,00000000,0040748E,?,00008000), ref: 00407455

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 7c3291ca482dc4e73124ef6673235b1c1e4da24983ec1cf579c69c8d77eb9c24
Instruction ID: f52ba4a9feec5d4d4615fe406f45eaba014741ff6d770d8a308f032ff20cb8dd
Opcode Fuzzy Hash: 7c3291ca482dc4e73124ef6673235b1c1e4da24983ec1cf579c69c8d77eb9c24
Instruction Fuzzy Hash: 26F08270A14708BEDB025FB68C5282ABAECE749B1475288B6F900A2AD2E53C5820C569

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0EF Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0A1
DestroyWindow.USER32(00010446,0040B0F4,Function_00009E00,00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040B0B5

Part of subcall function 00409978: Sleep.KERNEL32(?), ref: 00409997
Part of subcall function 00409978: GetLastError.KERNEL32(?), ref: 004099BA
Part of subcall function 00409978: GetLastError.KERNEL32(?), ref: 004099C4

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
String ID:
API String ID: 2192421792-0
Opcode ID: 42b787c3d9f5bd55058fd6c8f85d5fac1abeba9ca40111c3c6816528150393fb
Instruction ID: 80fe6e0f7824975e72fa29ef6d7a10d3d2514edd0f005a574200bdc13b2d30de
Opcode Fuzzy Hash: 42b787c3d9f5bd55058fd6c8f85d5fac1abeba9ca40111c3c6816528150393fb
Instruction Fuzzy Hash: C9F0CD70A105009BD725ABA9EE99B2632E5E7A4305F04453AA110BB2F1C7BD9C88CA8D

Uniqueness

Uniqueness Score: -1.00%

Function 00407AE8 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 00407B07
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407B0F

Part of subcall function 00407908: GetLastError.KERNEL32(@z@,004079A6,?,?,020B03AC,?,0040AB3B,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040790B

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 1efacffe01c84972d5e79d9e95937cadebc248d177395cf3b78af7fa5ea4bab0
Instruction ID: 2b235249b0a7ee07bcb8c1d8603e448d3cb6330bb11491e7c51f1e2a1a123f33
Opcode Fuzzy Hash: 1efacffe01c84972d5e79d9e95937cadebc248d177395cf3b78af7fa5ea4bab0
Instruction Fuzzy Hash: 13E092767081005FD610E55DC881A9B33DCDFC53A8F004537B654EB1D1D675B8008366

Uniqueness

Uniqueness Score: -1.00%

Function 00407AA8 Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407ABF
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407ACE

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 62bc4757170e124d293d2e1ae2527044cf5abdc53c736f625f33b9d4ecf98daf
Instruction ID: e15dfe76c2c2153dd18fa5b66318eead10a3336b01bc7908bb5745e2d55223c8
Opcode Fuzzy Hash: 62bc4757170e124d293d2e1ae2527044cf5abdc53c736f625f33b9d4ecf98daf
Instruction Fuzzy Hash: DAE092A17181106EEB20A65E9884F6B67DCCBC9314F04817BF508EB282D6B8DC008777

Uniqueness

Uniqueness Score: -1.00%

Function 00407A40 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 00407A57
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 00407A63

Part of subcall function 00407908: GetLastError.KERNEL32(@z@,004079A6,?,?,020B03AC,?,0040AB3B,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040790B

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 0f363b337b605630cba33b2c75e34e58c088fa0b570b5e63e1fb747f55acf4b7
Instruction ID: b2e9c79a061d94bc6c1ac4e6a69a759f2ef78579472dc31f5d333ffaff30462c
Opcode Fuzzy Hash: 0f363b337b605630cba33b2c75e34e58c088fa0b570b5e63e1fb747f55acf4b7
Instruction Fuzzy Hash: C7E01AB1A002109EEB20EBB58981B5662D89B44364B048576A654DB2C6D274E800CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e3bf9ef34a83e5b8d51b462a41b7d68ce2248d991abf67c6f3f1ae437811ef8b
Instruction ID: 66c3474f10fe082fedccbde799efe3bb5b58ff080b56d2e089ed954f0af67306
Opcode Fuzzy Hash: e3bf9ef34a83e5b8d51b462a41b7d68ce2248d991abf67c6f3f1ae437811ef8b
Instruction Fuzzy Hash: DAF02772B0032017DB2069AA0CC1B536AC59F85B90F1540BBFA4CFF3F9D2B98C0442A9

Uniqueness

Uniqueness Score: -1.00%

Function 004056D0 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405806), ref: 004056EF

Part of subcall function 0040512C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00405149

Part of subcall function 0040565C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040D4C0,00000001,?,00405727,?,00000000,00405806), ref: 0040567A

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: cc3e47e390c1b33211b3d9873ad613d49b391b3cefde462b73c2cd7d0ab13d86
Instruction ID: 82c784cd7830e1ca4cd44457dad2f2fa429cf4e25a926eea24d274db27b93b1b
Opcode Fuzzy Hash: cc3e47e390c1b33211b3d9873ad613d49b391b3cefde462b73c2cd7d0ab13d86
Instruction Fuzzy Hash: C1316F75E00509ABCB00EF95CC819EEB379FF84304F508577E819BB285E739AE058B98

Uniqueness

Uniqueness Score: -1.00%

Function 004079F2 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407A34

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5bc26aafbd8d3cc7e99f1b4789c5f450247a7b7967715b9db18694e2d0d8c5c5
Instruction ID: 042ae40820150c0b4851109f40d588701a9899a67d40570aa5757512981d293a
Opcode Fuzzy Hash: 5bc26aafbd8d3cc7e99f1b4789c5f450247a7b7967715b9db18694e2d0d8c5c5
Instruction Fuzzy Hash: 6FE0ED753442586EE340DAED6D81FA677DC974A714F008132B998DB382D4719D118BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004079F4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407A34

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b99464c5deed90c436ccb8039285842caa459c4cfee6896295820f2cd2136feb
Instruction ID: 8ced2eed2e357b00b36525f681a949bcf9e14530d7ff6951507f50c56b932d1f
Opcode Fuzzy Hash: b99464c5deed90c436ccb8039285842caa459c4cfee6896295820f2cd2136feb
Instruction Fuzzy Hash: 95E0ED753442586EE240DAED6D81F96779C974A714F008122B998DB382D4719D118BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406E2C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406E74,?,?,?,?,00000000,?,00406E89,004071E3,00000000,00407228,?,?,?), ref: 00406E57

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8e258e6088ff2729972a65b025d9916a43b1951ab399dc39633550a2ec6328db
Instruction ID: 5d103c24ca312c86e291a35865c809fd23e08ae6a8f6832d02acb9ca341f4446
Opcode Fuzzy Hash: 8e258e6088ff2729972a65b025d9916a43b1951ab399dc39633550a2ec6328db
Instruction Fuzzy Hash: ADE0E530300308BBD301EE72DC42D0ABBACDB89704B920476B400A26C2D5785E108068

Uniqueness

Uniqueness Score: -1.00%

Function 00407B44 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00407B5B

Part of subcall function 00407908: GetLastError.KERNEL32(@z@,004079A6,?,?,020B03AC,?,0040AB3B,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040790B

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 006c08a2f5d9871c0a1980147acda0c26795bf6e192fd3a261290223f417e960
Instruction ID: 30ae2be02b9f15b9cba2c15a2490e5271afae9e105f225727eb8a6e5b17a7771
Opcode Fuzzy Hash: 006c08a2f5d9871c0a1980147acda0c26795bf6e192fd3a261290223f417e960
Instruction Fuzzy Hash: 3FE06D727081106BD710A65A98C0E5777ECCF85764F00403BB608DB281C574AC01867A

Uniqueness

Uniqueness Score: -1.00%

Function 00407700 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004095C3,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0040771F

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: b9ec76e9ce0cf7c9b11fbb0d22c3d5372d7ad8be8fd57ca1cb8678c9dba0653c
Instruction ID: cd8e50964804133df0be52219a4bf40107040f8cbf32d452899ff663d46cfc84
Opcode Fuzzy Hash: b9ec76e9ce0cf7c9b11fbb0d22c3d5372d7ad8be8fd57ca1cb8678c9dba0653c
Instruction Fuzzy Hash: 7CE04FB1B8830126F62519545C87F7B164E47C0B84F64403B7B50EE3D2DABEB94B429F

Uniqueness

Uniqueness Score: -1.00%

Function 00407B28 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,02370004,0040AEF9,00000000), ref: 00407B2F

Part of subcall function 00407908: GetLastError.KERNEL32(@z@,004079A6,?,?,020B03AC,?,0040AB3B,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040790B

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 879c3aef20c26933657ab209da42f9acde188edf801b45e7798529f352953bc6
Instruction ID: c094c2b5ec81b014f7647aed55f46f5be6f6c9eff784118cc89584b894c57cec
Opcode Fuzzy Hash: 879c3aef20c26933657ab209da42f9acde188edf801b45e7798529f352953bc6
Instruction Fuzzy Hash: AFC04CB1B141045BDB00A6AA85C2A1672DC5A482083404076B504DB247D678F8504755

Uniqueness

Uniqueness Score: -1.00%

Function 00407477 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407495), ref: 00407488

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 3513d2af45e6240a0d0531d222129c39ee3681c2f506e4d79ab3159715fa7836
Instruction ID: fee884e8913e26ea2b20a1c4334648daa9a2c142b99fe0c27f31eb53e83e856d
Opcode Fuzzy Hash: 3513d2af45e6240a0d0531d222129c39ee3681c2f506e4d79ab3159715fa7836
Instruction Fuzzy Hash: C6B09B76A0C2006DE705DEE5645153877D4D7C47103B14877F100D65C1D93C94108519

Uniqueness

Uniqueness Score: -1.00%

Function 00407493 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407495), ref: 00407488

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a150b1ccc28004dcf137bb0f7729195edfbe3cd1821f17504bb802deebb031e2
Instruction ID: c7febe38ef9f985557de65a49c8e3beabd1cb56d23a205183508381f5ecd03fa
Opcode Fuzzy Hash: a150b1ccc28004dcf137bb0f7729195edfbe3cd1821f17504bb802deebb031e2
Instruction Fuzzy Hash: EEA022A8C08008BACE00EEE88080A3C33A82A883003C008E23200B2082C03CE000820B

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00406DBC,?,00406A99,?,?,0040959C,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004095DE), ref: 00406DC2

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: d44d7a6884596ca32ea416b380b4e8946229468d7e659b1743621721cd4621d4
Instruction ID: 95ac89871b9e49aa2ffc5daef894b278f4bc9d8aafa7dca88aae54a0e9e7edad
Opcode Fuzzy Hash: d44d7a6884596ca32ea416b380b4e8946229468d7e659b1743621721cd4621d4
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0040150C Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 00401570

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4069ebeab1ecaaa6227b0d54b40c6f300b7ac340d294d08becb426def254346f
Instruction ID: ed4d65520c00d96bd64096adec8f86249eaccd310614155879460d3c6a05d2ca
Opcode Fuzzy Hash: 4069ebeab1ecaaa6227b0d54b40c6f300b7ac340d294d08becb426def254346f
Instruction Fuzzy Hash: EC21F970608711AFC700DF19C880A5AB7E0EFC4760F14C96AE899AB3A1D374EC45CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040838C Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0040841C

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4fb7b38294bdf3fcfaab8189c6b2d31175aea6f156bf412ec83bea8fb86574a1
Instruction ID: 68aadeca7c52aa1374545c41b60170f14cbd4c45bc0c673343149efe9cc76684
Opcode Fuzzy Hash: 4fb7b38294bdf3fcfaab8189c6b2d31175aea6f156bf412ec83bea8fb86574a1
Instruction Fuzzy Hash: 7B116D716042059BDB00EF19C981B4B37A4AF84359F04847EF998AF2C7DF78D8058B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ae0a35522eec5974c246f826a8cf4d5dbbbccf5172876aab042d95c32cb5ff07
Instruction ID: d2bd3e7102ef9204b91f8816383c595cec19663beeae75bd92b4ab4675e4226e
Opcode Fuzzy Hash: ae0a35522eec5974c246f826a8cf4d5dbbbccf5172876aab042d95c32cb5ff07
Instruction Fuzzy Hash: E401F772A042104BC310AF28DDC092A77D4DB84324F19497ED985B73A1D23B7C0587A8

Uniqueness

Uniqueness Score: -1.00%

Function 004079C4 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004079D4

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b39bb4760bd10523e8477a282be401f25cebef3596302d631dfd489199f81fc2
Instruction ID: 1333f047c66b0d9688efca9d11da816c999e90cdcd736c06211d3ba452c28d9f
Opcode Fuzzy Hash: b39bb4760bd10523e8477a282be401f25cebef3596302d631dfd489199f81fc2
Instruction Fuzzy Hash: B4D0A7D1B00A6007E315F2BF498964B92C85F88655F08843BF685E73D1D67CAC00D38D

Uniqueness

Uniqueness Score: -1.00%

Function 00408334 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00408319), ref: 0040834B

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 230c808500062b5c35cb01985a317edf3050be8cd861299b6b1c2025d975cd45
Instruction ID: 2902acfab023b9b2f0de86f7a78627cda5d54dfc4b924a21aa22279fbea0049e
Opcode Fuzzy Hash: 230c808500062b5c35cb01985a317edf3050be8cd861299b6b1c2025d975cd45
Instruction Fuzzy Hash: 64D002B17553046FDB90EEB94DC5B0237D87B48700F14457A6E44EB2C6F775D8008B14

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004098E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004098F7
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004098FD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409916
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040993D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 00409942
ExitWindowsEx.USER32(00000002,00000000), ref: 00409953

Strings

SeShutdownPrivilege, xrefs: 0040990F

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 76c26366ab73d400da16d1d616fb3f23b1dfff142f9860e5fbeddd1887b8e56a
Instruction ID: c716305aa6b255ea0f8bf04b803605974c64d9a32ef9e4c16490a57abd096404
Opcode Fuzzy Hash: 76c26366ab73d400da16d1d616fb3f23b1dfff142f9860e5fbeddd1887b8e56a
Instruction Fuzzy Hash: 17F062B0284302B6E610AAB18C07F2722885B81B18F40493EB711F52C3D7BDD904866F

Uniqueness

Uniqueness Score: -1.00%

Function 0040A0D4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 0040A0DE
SizeofResource.KERNEL32(00000000,00000000,?,0040AB53,00000000,0040B0EA,?,00000001,00000000,00000002,00000000,0040B132,?,00000000,0040B169), ref: 0040A0F1
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040AB53,00000000,0040B0EA,?,00000001,00000000,00000002,00000000,0040B132,?,00000000), ref: 0040A103
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040AB53,00000000,0040B0EA,?,00000001,00000000,00000002,00000000,0040B132), ref: 0040A114

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 5a5895066e8623d9c04d621fb25767811aface55f1ffab09d7e5ea7dbda8e6a9
Instruction ID: 6e0ad9993521ca4487a6dc9182c9ec88a9d7ecf9898e216691337b01ea42cf55
Opcode Fuzzy Hash: 5a5895066e8623d9c04d621fb25767811aface55f1ffab09d7e5ea7dbda8e6a9
Instruction Fuzzy Hash: 92E0EA9078970725EAA136E608D6B6B10884BB578EF40113ABB14B92C3DDBC8C14516E

Uniqueness

Uniqueness Score: -1.00%

Function 004056A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004058AA,?,?,?,00000000,00405A5C), ref: 004056BB

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6c93c86b5f3b9f7a8269726404ed0fa1fa14f48feaf77c0ba1f6e5dd371dd8fd
Instruction ID: 0ac2273093169a9723f5a49d7def2a1a0e4efde15c2d8dcba0568209acb81ea7
Opcode Fuzzy Hash: 6c93c86b5f3b9f7a8269726404ed0fa1fa14f48feaf77c0ba1f6e5dd371dd8fd
Instruction Fuzzy Hash: 34D05EA631E6502AE310519B2D85EBB4EACCAC57A4F54483BF64CD7252D2248C069776

Uniqueness

Uniqueness Score: -1.00%

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 9ed56ef6959dd8920af8b6d924cbc2bc4732ada3ba303b98172f22f33df6bd3d
Instruction ID: 8398a6df79db6557de4560d78939933842e781e1ed99b38cfbf2fd723ed8f470
Opcode Fuzzy Hash: 9ed56ef6959dd8920af8b6d924cbc2bc4732ada3ba303b98172f22f33df6bd3d
Instruction Fuzzy Hash: 3BE04F21E0010A42C704ABA5CD435FDF7AEAB95604F044172A418E92E0F631C252C748

Uniqueness

Uniqueness Score: -1.00%

Function 00408888 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 388b29b0a79f5f19ed4b4953a6a76f47c3e14b9604a8131d453ab3a085cd796f
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: BC32E675E04219DFCB14CF99CA80A9DBBB2BF88314F24816AD855B7385DB34AE42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004074A0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,004075A5,?,00000000,00409DB8), ref: 004074C9
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004074CF
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,004075A5,?,00000000,00409DB8), ref: 0040751D

Strings

GetUserDefaultUILanguage, xrefs: 004074BF
kernel32.dll, xrefs: 004074C4
Locale, xrefs: 0040750C
.DEFAULT\Control Panel\International, xrefs: 004074F4
Control Panel\Desktop\ResourceLocale, xrefs: 0040752C

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 7c066b870a361991bc0752fcd93cb8768e255443e349242cb7f15e42003cd7d9
Instruction ID: b0f7b576ff72b1c2059ac61aa9c71175e867ef76c41006bc9f97b140b7c9741a
Opcode Fuzzy Hash: 7c066b870a361991bc0752fcd93cb8768e255443e349242cb7f15e42003cd7d9
Instruction Fuzzy Hash: 02215470E04209BBDB00EAE5CC55ADE77A8AB44304F508877A900F36C1E77CBA01C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405814 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405A5C,?,?,?,?,00000000,00000000,00000000,?,00406A3B,00000000,00406A4E), ref: 0040582E

Part of subcall function 0040565C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040D4C0,00000001,?,00405727,?,00000000,00405806), ref: 0040567A

Part of subcall function 004056A8: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004058AA,?,?,?,00000000,00405A5C), ref: 004056BB

Strings

m/d/yy, xrefs: 004058FD
:mm, xrefs: 00405A10
mmmm d, yyyy, xrefs: 0040591F
:mm:ss, xrefs: 00405A2A
AMPM, xrefs: 004059F9

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: f64dfcc9beea8e06f9a7216c135bb3ef8748e57adf0d60dccc58cc6af9805412
Instruction ID: 1f8fb3564ea85801462352e9f704d9e8acf1e4fd8595550e023c4eac14c4b858
Opcode Fuzzy Hash: f64dfcc9beea8e06f9a7216c135bb3ef8748e57adf0d60dccc58cc6af9805412
Instruction Fuzzy Hash: 2B513E34B006486BDB00FAA58C81A8F77A9DB99304F50857BA515BB3C6CA3DDA098F5C

Uniqueness

Uniqueness Score: -1.00%

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: a67f2483392f3a9295a6f421ec51b00ba0520a603cf3575c2b5e933881db78c1
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: a67f2483392f3a9295a6f421ec51b00ba0520a603cf3575c2b5e933881db78c1
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040A128 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 0040A15D

Strings

The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 0040A141
Setup, xrefs: 0040A14D

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: Message
String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
API String ID: 2030045667-3271211647
Opcode ID: ff94df1eb2564fec58b9a221cc3fe3b9cf965a2b136f430670f36a0b3f2e2132
Instruction ID: 9b5d989b58a55d658cadae164e54e3781760331d38193a884cd145b826483737
Opcode Fuzzy Hash: ff94df1eb2564fec58b9a221cc3fe3b9cf965a2b136f430670f36a0b3f2e2132
Instruction Fuzzy Hash: 87E065302443087EE312EA629C13F5E7BACE789B54F614477F500B55C1D6795E10D46D

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040AAAE), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,0040AAAE), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2812984770.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2812938377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813035540.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2813066424.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starwindconverter.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: 4ac654993ecb6f0c10b1cacd39e13426f3fb1ace3b4aa0046ecf3c9b516135ec
Instruction ID: daea45a2aa12e23edc1a75ca5ccfa9dec32d0aab9986280789c112b27ba3568a
Opcode Fuzzy Hash: 4ac654993ecb6f0c10b1cacd39e13426f3fb1ace3b4aa0046ecf3c9b516135ec
Instruction Fuzzy Hash: 3AC0027894134055D764AFF69E497047594A74930DF40443FA20C7A1F1D67C460A6BDD

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: starwindconverter.tmpPID: 5944, Parent PID: 6880COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	110

Executed Functions

Function 00471688 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 961COMMON

Download Yara Rule

Strings

User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00471E76
Version of our file: (none), xrefs: 00471ADC
Will register the file (a type library) later., xrefs: 00472502
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00471CA4
Couldn't read time stamp. Skipping., xrefs: 00471D15
Version of existing file: (none), xrefs: 00471CDA
Existing file is a newer version. Skipping., xrefs: 00471BE2
Will register the file (a DLL/OCX) later., xrefs: 0047250E
Non-default bitness: 64-bit, xrefs: 0047188F
Installing the file., xrefs: 00471EE9
InUn, xrefs: 0047213F
, xrefs: 00471BAF, 00471D80, 00471DFE
.tmp, xrefs: 00471F97
Version of existing file: %u.%u.%u.%u, xrefs: 00471B5C
Skipping due to "onlyifdestfileexists" flag., xrefs: 00471EDA
Time stamp of existing file: %s, xrefs: 00471A0B
I, xrefs: 00471688
-- File entry --, xrefs: 004716DB
Dest file exists., xrefs: 0047199B
Time stamp of our file: (failed to read), xrefs: 00471987
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00471CB0
Same time stamp. Skipping., xrefs: 00471D35
Failed to strip read-only attribute., xrefs: 00471EB3
Dest filename: %s, xrefs: 00471874
Skipping due to "onlyifdoesntexist" flag., xrefs: 004719AE
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00471C95
Stripped read-only attribute., xrefs: 00471EA7
Time stamp of existing file: (failed to read), xrefs: 00471A17
Same version. Skipping., xrefs: 00471CC5
Existing file is protected by Windows File Protection. Skipping., xrefs: 00471DCC
Uninstaller requires administrator: %s, xrefs: 0047216F
Incrementing shared file count (32-bit)., xrefs: 00472594
Existing file has a later time stamp. Skipping., xrefs: 00471DAF
Incrementing shared file count (64-bit)., xrefs: 0047257B
Version of our file: %u.%u.%u.%u, xrefs: 00471AD0
Time stamp of our file: %s, xrefs: 0047197B
Non-default bitness: 32-bit, xrefs: 0047189B
Dest file is protected by Windows File Protection., xrefs: 004718CD
User opted not to overwrite the existing file. Skipping., xrefs: 00471E2D
Installing into GAC, xrefs: 004726FA

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.$I
API String ID: 0-4118084788
Opcode ID: c14e226d9891336989dafe503ecccccce581ef0ae42d4d4c3c1148ce2efd792b
Instruction ID: 6bf2baeb3a70bced245c17dd6e1df6b1677c078c0e18323f60fd28fe4f0ee562
Opcode Fuzzy Hash: c14e226d9891336989dafe503ecccccce581ef0ae42d4d4c3c1148ce2efd792b
Instruction Fuzzy Hash: 73927134A042889FDB11DFA9C585BDDBBF4AF05304F1480ABE848BB392D7789E45DB19

Uniqueness

Uniqueness Score: -1.00%

Function 0042E4EC Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(0049B788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E526
GetVersion.KERNEL32(00000000,0042E6D0,?,0049B788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E543
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E6D0,?,0049B788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E55C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E562
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E6D0,?,0049B788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E577
FreeSid.ADVAPI32(00000000,0042E6D7,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E6CA

Strings

advapi32.dll, xrefs: 0042E557
CheckTokenMembership, xrefs: 0042E552

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: bec140b171ea519891e8f75e6984b41f13cc792e2a5660a755a4f82e4b8777e7
Instruction ID: 33373ee259e646c263c3edb0d375fd355344fbe6f0fea3053a31bb261822ccd7
Opcode Fuzzy Hash: bec140b171ea519891e8f75e6984b41f13cc792e2a5660a755a4f82e4b8777e7
Instruction Fuzzy Hash: 33518371B44619AEDB10EAE69842B7F77ACDB19304FD4047BB500F72C2D57CD904876A

Uniqueness

Uniqueness Score: -1.00%

Function 00450994 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 76
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,00450AB1,?,?,?,?,00000000,00000000), ref: 004509BF

Part of subcall function 00450964: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0045097C

LoadLibraryA.KERNEL32(00000000,00000000,00450AB1,?,?,?,?,00000000,00000000), ref: 004509FB
GetProcAddress.KERNEL32(00000000,RmStartSession), ref: 00450A19
GetProcAddress.KERNEL32(00000000,RmRegisterResources), ref: 00450A2E
GetProcAddress.KERNEL32(00000000,RmGetList), ref: 00450A43
GetProcAddress.KERNEL32(00000000,RmShutdown), ref: 00450A58
GetProcAddress.KERNEL32(00000000,RmRestart), ref: 00450A6D
GetProcAddress.KERNEL32(00000000,RmEndSession), ref: 00450A82

Strings

RmRestart, xrefs: 00450A62
RmStartSession, xrefs: 00450A0E
RmGetList, xrefs: 00450A38
RmEndSession, xrefs: 00450A77
Rstrtmgr.dll, xrefs: 004509E8
RmShutdown, xrefs: 00450A4D
RmRegisterResources, xrefs: 00450A23

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 2754715182-3419246398
Opcode ID: d8d5ff48d6aa38830af6a9e8a73036221bb65f2481768552fb853932befe92ab
Instruction ID: 7e76809d132c55fa29070b713de61cc7a3e08993567f6b48a797f9432d6667d5
Opcode Fuzzy Hash: d8d5ff48d6aa38830af6a9e8a73036221bb65f2481768552fb853932befe92ab
Instruction Fuzzy Hash: 58212AB4A00304AEE710FBA5EC86A6E77F8E764755F50053BB810A71A3D6789D49CB1C

Uniqueness

Uniqueness Score: -1.00%

Function 0042405C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe6f3cab85cb6cd94dd259e2a1688b0505dda5d67cc9468b745cf4902a0b6c1d
Instruction ID: 43e49367b0b6739e18dd975752e7d81306140be7a57883210305ee73c05c6530
Opcode Fuzzy Hash: fe6f3cab85cb6cd94dd259e2a1688b0505dda5d67cc9468b745cf4902a0b6c1d
Instruction Fuzzy Hash: 59E16E30704124EFD710DB6AE685A5DB7F4EF84314FA540A6F6859B392CB38EE81DB09

Uniqueness

Uniqueness Score: -1.00%

Function 00422CAC Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 00422E44
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,0042300E), ref: 00422E54

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 50d217a044accfbb6ff9672ceaa0ff858f3e4d17f8446c7d09d6d8818b0f9199
Instruction ID: bacc4b86db7cb1d0e13acf93141a7ddfdaa0ad6c2af5cb9121abc77d57b19b6c
Opcode Fuzzy Hash: 50d217a044accfbb6ff9672ceaa0ff858f3e4d17f8446c7d09d6d8818b0f9199
Instruction Fuzzy Hash: 1B916270B14254AFD700DBA9DB46F9E77F4AB04304F5600B6F904AB292C7B8AE01AB58

Uniqueness

Uniqueness Score: -1.00%

Function 00468034 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1649windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004971B4: GetWindowRect.USER32(00000000), ref: 004971CA

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 004683DD

Part of subcall function 0041DB00: GetObjectA.GDI32(?,00000018,004683F6), ref: 0041DB2B

Part of subcall function 00467E10: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467EB3
Part of subcall function 00467E10: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467ED9
Part of subcall function 00467E10: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467F30

Part of subcall function 004677CC: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00468491,00000000,00000000,00000000,0000000C,00000000), ref: 004677E4

Part of subcall function 00497438: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00497442

Part of subcall function 0042F188: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042F1E4
Part of subcall function 0042F188: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042F201

Part of subcall function 00497104: GetDC.USER32(00000000), ref: 00497126
Part of subcall function 00497104: SelectObject.GDI32(?,00000000), ref: 0049714C
Part of subcall function 00497104: ReleaseDC.USER32(00000000,?), ref: 0049719D

Part of subcall function 00497428: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00497432

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00469080
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00469091
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 004690A9

Strings

, xrefs: 0046849E
(Default), xrefs: 00469692
STOPIMAGE, xrefs: 004683D2

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadProcRectReleaseSelectSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 616467991-770201673
Opcode ID: 533b5b9c69d50d4e3bf7389d015b08925e7f9e5915c964b06be795d887c19e03
Instruction ID: 80892e57212ece105f8354d293749779e47711168eff5a6823bea21c9da9ff55
Opcode Fuzzy Hash: 533b5b9c69d50d4e3bf7389d015b08925e7f9e5915c964b06be795d887c19e03
Instruction Fuzzy Hash: 90F2E7786005108FCB00EB69D8D9F9977F5BF89304F1542BAE5049B36ADB78EC46CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 004565A8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,004566E7), ref: 004565D8
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004565DE
GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,004566C5,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,004566E7), ref: 00456634

Strings

GetDiskFreeSpaceExA, xrefs: 004565CE
kernel32.dll, xrefs: 004565D3

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: 25df71702425412e55e0ebe1ec94dd27c79a220fb61393adf873e88db180ab3d
Instruction ID: b48cc3d91c9fc3d8a1033014b63779c50d18bc65ef0bc06e4cd1291adb105b9d
Opcode Fuzzy Hash: 25df71702425412e55e0ebe1ec94dd27c79a220fb61393adf873e88db180ab3d
Instruction Fuzzy Hash: A2417471A00249AFCF01EFA5C8829EFBBB8EF48304F514567F800F7252D6795D098B69

Uniqueness

Uniqueness Score: -1.00%

Function 00476120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0047628A,?,?,0049E1E4,00000000), ref: 00476179
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,0047628A,?,?,0049E1E4,00000000), ref: 00476256
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,0047628A,?,?,0049E1E4,00000000), ref: 00476264

Strings

unins???.*, xrefs: 00476163
unins, xrefs: 004761CC

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 4d6b4c78c27d307665df1e659c75eb40dbe6a289c02ca47561d52f2f5fb83ddd
Instruction ID: eb89464c752a784b36226a23c26c23c5edadcf818cb3280f2000aa581376a5b5
Opcode Fuzzy Hash: 4d6b4c78c27d307665df1e659c75eb40dbe6a289c02ca47561d52f2f5fb83ddd
Instruction Fuzzy Hash: 11312E70600548ABDB50EB65CC81ADEBBADDB45314F5180F6A84CAB3A6DB389F418F58

Uniqueness

Uniqueness Score: -1.00%

Function 004531A4 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00453207,?,?,-00000001,00000000), ref: 004531E1
GetLastError.KERNEL32(00000000,?,00000000,00453207,?,?,-00000001,00000000), ref: 004531E9

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 1201cac6feb998a2fb112764d438cb0eb727cdb5a4391e78fe092c8218b0a9ce
Instruction ID: d0bf465202dae3429285692917932fac375c13b7b10a14b33624456fe0da4cd4
Opcode Fuzzy Hash: 1201cac6feb998a2fb112764d438cb0eb727cdb5a4391e78fe092c8218b0a9ce
Instruction Fuzzy Hash: FEF02371A046047BCB10DF7AAC0145EF7ACDB4577675046BBFC14D3291DB784F088558

Uniqueness

Uniqueness Score: -1.00%

Function 004089B8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049D4C4,00000001,?,00408A83,?,00000000,00408B62), ref: 004089D6

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 40f9e6ad7b9874a9b05efedc53f019727417c817c0661ecad43f37488e602a1d
Instruction ID: 37d1d3aac47cb6b8cd62020f591dd9ac8cec50bf03644e7f1bddec785b1dbc63
Opcode Fuzzy Hash: 40f9e6ad7b9874a9b05efedc53f019727417c817c0661ecad43f37488e602a1d
Instruction Fuzzy Hash: 63E0227170021452C315A91A8C82AFAB24C9B18314F00427FB948E73C3EDB89E8042ED

Uniqueness

Uniqueness Score: -1.00%

Function 00423FD4 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,004245A1,?,00000000,004245AC), ref: 00423FFE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 15ec92afe3337674697e5aaff926351660f6d808b83c1ecc1d592f8d8ff41db7
Instruction ID: 626c949ff67c0b5daba62b8ffba664747ea83a29b03f4787c3cb7294a8149fcf
Opcode Fuzzy Hash: 15ec92afe3337674697e5aaff926351660f6d808b83c1ecc1d592f8d8ff41db7
Instruction Fuzzy Hash: 9CF0B379205608AF8B40DF99C588D4ABBE8AB4C260B058295B988CB321C234EE808F94

Uniqueness

Uniqueness Score: -1.00%

Function 00455D38 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 00455D4E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: aa3a47175e92b859a3c3631cc0a30abc799c89e82c4a450a6b7a51612d703bec
Instruction ID: 82cf1e81aeab4cdf4c711474db213eebdc1b2e178f500b1422eacd8e28b83923
Opcode Fuzzy Hash: aa3a47175e92b859a3c3631cc0a30abc799c89e82c4a450a6b7a51612d703bec
Instruction Fuzzy Hash: 0AD0C27230460063C700AAA99C826AA359C8B84305F00883F3CC5DA2C3EABDDA4C5696

Uniqueness

Uniqueness Score: -1.00%

Function 0046FE70 Relevance: 75.8, APIs: 1, Strings: 42, Instructions: 512
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046FC5C: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,VtG,?,0049E1E4,?,0046FF73,?,00000000,00470532,?,_is1), ref: 0046FC7F

RegCloseKey.ADVAPI32(?,00470539,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,00470584,?,?,0049E1E4,00000000), ref: 0047052C

Strings

Inno Setup: Setup Type, xrefs: 00470021
Inno Setup: User Info: Serial, xrefs: 004700E8
DisplayIcon, xrefs: 0047018B
Contact, xrefs: 004702E7
HelpLink, xrefs: 00470290
" /SILENT, xrefs: 004701F2
MajorVersion, xrefs: 00470397
URLUpdateInfo, xrefs: 004702AD
DisplayVersion, xrefs: 0047021C
URLInfoAbout, xrefs: 00470256
EstimatedSize, xrefs: 004704A9
Inno Setup: User Info: Organization, xrefs: 004700D3
Inno Setup: Icon Group, xrefs: 0046FFC5
NoRepair, xrefs: 0047034C
_is1, xrefs: 0046FECC
Inno Setup: Setup Version, xrefs: 0046FF61
Readme, xrefs: 004702CA
HelpTelephone, xrefs: 00470273
InstallLocation, xrefs: 0046FFB6
Publisher, xrefs: 00470239
QuietUninstallString, xrefs: 004701FF
Inno Setup: Selected Components, xrefs: 00470040
VersionMajor, xrefs: 004703BB
Inno Setup: User, xrefs: 00470002
Inno Setup: Deselected Tasks, xrefs: 004700A6
RegisterPreviousData, xrefs: 004704E2
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046FEC6
ModifyPath, xrefs: 00470324
VersionMinor, xrefs: 004703CD
MinorVersion, xrefs: 004703A9
Inno Setup: Selected Tasks, xrefs: 00470087
Comments, xrefs: 00470304
Inno Setup: User Info: Name, xrefs: 004700BE
NoModify, xrefs: 00470338
Inno Setup: Deselected Components, xrefs: 0047005F
Inno Setup: Language, xrefs: 0047010F
UninstallString, xrefs: 004701C5
Inno Setup: No Icons, xrefs: 0046FFE3
Inno Setup: App Path, xrefs: 0046FF96
DisplayName, xrefs: 0047016E
5.5.9 (a), xrefs: 0046FF66
InstallDate, xrefs: 0047036B

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.5.9 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor$_is1
API String ID: 3132538880-2925550972
Opcode ID: 8a4856762a7f54e9e7dbe266fb10d92975e5fb00b3b4287c00a604127d4451c6
Instruction ID: 8dffaa2781584bc6e947bd791be20880efee78ab32c439a28404737c84d0984c
Opcode Fuzzy Hash: 8a4856762a7f54e9e7dbe266fb10d92975e5fb00b3b4287c00a604127d4451c6
Instruction Fuzzy Hash: F8124F34A00108DBDB04EB55E991ADE77F5EF48304F60807BE804AB3A5EB79BD45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004063F4 Relevance: 42.2, APIs: 7, Strings: 17, Instructions: 174
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 0040640F
GetVersion.KERNEL32(kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 00406416
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0040642B
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00406453
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406655
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040666B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 00406676

Strings

SetDefaultDllDirectories, xrefs: 00406425
setupapi.dll, xrefs: 00406502
comres.dll, xrefs: 0040661A
userenv.dll, xrefs: 004064DF
propsys.dll, xrefs: 00406548
profapi.dll, xrefs: 004065F7
cryptbase.dll, xrefs: 0040658E
SetSearchPathMode, xrefs: 0040664F
uxtheme.dll, xrefs: 004064BC
dwmapi.dll, xrefs: 0040656B
apphelp.dll, xrefs: 00406525
clbcatq.dll, xrefs: 0040663D
SetDllDirectoryW, xrefs: 0040644D
SetProcessDEPPolicy, xrefs: 00406665
kernel32.dll, xrefs: 0040640A
version.dll, xrefs: 004065D4
oleacc.dll, xrefs: 004065B1

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcessVersion
String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$kernel32.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
API String ID: 3297890031-2388063882
Opcode ID: 7c5204fbbc2168c2f62eadc490ed385a4cfd672bd01c7cc457884a48157f0828
Instruction ID: 52ceb319b1b10a2745084cc2a18598c2ecefae742a63aceaaee3a2f28509b87b
Opcode Fuzzy Hash: 7c5204fbbc2168c2f62eadc490ed385a4cfd672bd01c7cc457884a48157f0828
Instruction Fuzzy Hash: 7061F130A00109EBCB01FBA6D982D8E77B9AB44709B214077B405772E6DB3DEF199B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00456DD4 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

756FE550.OLE32(0049BA74,00000000,00000001,0049B774,?,00000000,0045717F), ref: 00456E1A
756FE550.OLE32(0049B764,00000000,00000001,0049B774,?,00000000,0045717F), ref: 00456E40
SysFreeString.OLEAUT32(00000000), ref: 00456FF7

Strings

CoCreateInstance, xrefs: 00456E4B
%ProgramFiles(x86)%\, xrefs: 00456ECA
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 00456F8D
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 00456FDC
IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 00457066
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 00456F59
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 0045702E
IPropertyStore::Commit, xrefs: 0045707F
IPersistFile::Save, xrefs: 004570FE
{pf32}\, xrefs: 00456EBA
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 004570A0

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: E550$FreeString
String ID: %ProgramFiles(x86)%\$CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)${pf32}\
API String ID: 491012016-2363233914
Opcode ID: 07d5a5579f8ca6652d0c1b29a29510edaaf9d516a664dc31519823db798bd8dc
Instruction ID: 02ec3099c1e013a4d2a6014e0405d8002507ef7a0ca247d1a979c15f6e32810c
Opcode Fuzzy Hash: 07d5a5579f8ca6652d0c1b29a29510edaaf9d516a664dc31519823db798bd8dc
Instruction Fuzzy Hash: 57B18071A04204AFDB11DFA9D845B9E7BF8AF08706F5440B6F904E7262DB38DD48CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00484E68 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00484E79
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00484E86
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00484E94
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00484E9C
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00484EA8
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00484EC9
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00484EDC
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00484EE2
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00484EF9

Strings

IsWow64Process, xrefs: 00484E96
advapi32.dll, xrefs: 00484ED7
RegDeleteKeyExA, xrefs: 00484ED2
kernel32.dll, xrefs: 00484E74
GetNativeSystemInfo, xrefs: 00484E80
GetSystemWow64DirectoryA, xrefs: 00484EC3

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: cd68709e737b022a93ba3f5ff6983bcc42b0d1d8f8071fae57a82298f7546d18
Instruction ID: 19f93fc1e60286517b98713993879556ba5b021e510ed05db2a10d1898c9039d
Opcode Fuzzy Hash: cd68709e737b022a93ba3f5ff6983bcc42b0d1d8f8071fae57a82298f7546d18
Instruction Fuzzy Hash: E8110351109353A4E721B3796E46B7F25889B8031CF080C7F7B84666C6EA7CC845833F

Uniqueness

Uniqueness Score: -1.00%

Function 00469A0C Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,00469C26,?,?,00000001,00000000,00000000,00469C41,?,00000000,00000000,?), ref: 00469C0F

Strings

Inno Setup: Setup Type, xrefs: 00469B1E
Inno Setup: User Info: Organization, xrefs: 00469BDE
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00469A6B
Inno Setup: App Path, xrefs: 00469ACE
Inno Setup: No Icons, xrefs: 00469AF7
Inno Setup: Selected Components, xrefs: 00469B2E
Inno Setup: User Info: Serial, xrefs: 00469BF1
Inno Setup: User Info: Name, xrefs: 00469BCB
Inno Setup: Deselected Components, xrefs: 00469B50
Inno Setup: Deselected Tasks, xrefs: 00469B9D
Inno Setup: Selected Tasks, xrefs: 00469B7B
%s\%s_is1, xrefs: 00469A89
Inno Setup: Icon Group, xrefs: 00469AEA

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 5e5dd39b6a47d0f604a579e9d91520aca6f3566102ff8285c504ff9a2ddc14f1
Instruction ID: c7de7197f4a769c9e7c3cd52df4c64fbb683598124d789e1de9a85ab418445f9
Opcode Fuzzy Hash: 5e5dd39b6a47d0f604a579e9d91520aca6f3566102ff8285c504ff9a2ddc14f1
Instruction Fuzzy Hash: C4519430A006089BCB15DB66D941BEEB7F9EF49304F5084BAE84067395E7B8AF01CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00473AA0 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042CC54: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CC78

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00473C58
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00473D73
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00473D89
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00473DAE

Strings

Dest filename: %s, xrefs: 00473BFA
{group}\, xrefs: 00473AFA
Successfully created the icon., xrefs: 00473D4D
target.lnk, xrefs: 00473DF8
Creating the icon., xrefs: 00473C6D
Desktop.ini, xrefs: 00473E2F
.lnk, xrefs: 00473B2C
.pif, xrefs: 00473B4F, 00473CED
.url, xrefs: 00473B72

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Creating the icon.$Desktop.ini$Dest filename: %s$Successfully created the icon.$target.lnk${group}\
API String ID: 971782779-2902529204
Opcode ID: e54a508a62dfe029f21a25df3b69d4e56c56f2154e951fb1d55b97ecab692537
Instruction ID: 9b31a6288a8d0ad81c732a29d19026b8086b57763a6276d7ac4447936d78ea7d
Opcode Fuzzy Hash: e54a508a62dfe029f21a25df3b69d4e56c56f2154e951fb1d55b97ecab692537
Instruction Fuzzy Hash: EBD11374A00148ABDB11DFA9D582BDDBBF4AF08305F50806AF804B7392D778AE45DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0047D978 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DCE8: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,0045451C,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D), ref: 0042DCFB

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042DD40: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,004542C2,00000000,00454365,?,?,00000000,00000000,00000000,00000000,00000000,?,00454755,00000000), ref: 0042DD5A
Part of subcall function 0042DD40: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042DD60

SHGetKnownFolderPath.SHELL32(0049BD44,00008000,00000000,?,00000000,0047DC4C), ref: 0047DB52
757283B0.OLE32(?,0047DB95), ref: 0047DB88

Part of subcall function 0042D658: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DE8E,00000000,0042DF20,?,?,?,0049D62C,00000000,00000000), ref: 0042D683

Strings

Failed to get path of 64-bit Common Files directory, xrefs: 0047DB18
Common Files, xrefs: 0047DAB1
cmd.exe, xrefs: 0047DC06
SystemDrive, xrefs: 0047D9DF
Failed to get path of 64-bit Program Files directory, xrefs: 0047DAE9
CommonFilesDir, xrefs: 0047DA7A, 0047DAF6
COMMAND.COM, xrefs: 0047DC27
\Program Files, xrefs: 0047DA67
ProgramFilesDir, xrefs: 0047DA40, 0047DAC7

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Directory$757283AddressEnvironmentFolderHandleKnownModulePathProcSystemVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 795111782-544719455
Opcode ID: 6ec6ff986ef5dd5265772e09c3445ba75f4a3d0a7ec86f160005d9c17a7e769a
Instruction ID: 0fe7c2c5921331aa3b985ab989dbf77b3a087c61dea5e3792aec770f31e1cce1
Opcode Fuzzy Hash: 6ec6ff986ef5dd5265772e09c3445ba75f4a3d0a7ec86f160005d9c17a7e769a
Instruction Fuzzy Hash: A061B234E24204AFDB11EFA6D84269E7B78EF84318F51C57BE404AB391D77CAA41CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0047E184 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047E2B1

Strings

2, xrefs: 0047E1F3
SHFOLDERDLL, xrefs: 0047E22F
shfolder.dll, xrefs: 0047E1BF
SHGetFolderPathA, xrefs: 0047E2A6
Failed to load DLL "%s", xrefs: 0047E294
_isetup\_shfoldr.dll, xrefs: 0047E222
shell32.dll, xrefs: 0047E24F
Failed to get address of SHGetFolderPath function, xrefs: 0047E2C2

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressDirectoryProcSystem
String ID: 2$Failed to get address of SHGetFolderPath function$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 996212319-3422985891
Opcode ID: 2ee55fa07f5402e21f3b06f2d1869faf56609dd587cb054fbf2c8bfa1446e0f1
Instruction ID: 9758cc0716918fe71002c31ee1435c1447d2ac946059de1b269defc554b01a12
Opcode Fuzzy Hash: 2ee55fa07f5402e21f3b06f2d1869faf56609dd587cb054fbf2c8bfa1446e0f1
Instruction Fuzzy Hash: C9415830A00119DFDB10DFA6C9415DE77B8FB48309F50C9BBE414A7252D7389E05CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00423CC4 Relevance: 15.1, APIs: 10, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F814: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041F1F4,?,00423CDF,0042405C,0041F1F4), ref: 0041F832

GetClassInfoA.USER32(00400000,00423ACC), ref: 00423CEF
RegisterClassA.USER32(0049B630), ref: 00423D07
GetSystemMetrics.USER32(00000000), ref: 00423D29
GetSystemMetrics.USER32(00000001), ref: 00423D38
SetWindowLongA.USER32(004108B0,000000FC,00423ADC), ref: 00423D94
SendMessageA.USER32(004108B0,00000080,00000001,00000000), ref: 00423DB5
GetSystemMenu.USER32(004108B0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C,0041F1F4), ref: 00423DC0
DeleteMenu.USER32(00000000,0000F030,00000000,004108B0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C,0041F1F4), ref: 00423DCF
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,004108B0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00423DDC
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,004108B0,00000000,00000000,00400000,00000000,00000000,00000000), ref: 00423DF2

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID:
API String ID: 183575631-0
Opcode ID: a2c02cc2165dcaf8367acf6641f6e6fd3fefd979ebd8238a53b3443abb8769c0
Instruction ID: 7df3f4c256e16cf88ed5bb8a347b5b3a25df550de305930316ee8fcfc6e0617b
Opcode Fuzzy Hash: a2c02cc2165dcaf8367acf6641f6e6fd3fefd979ebd8238a53b3443abb8769c0
Instruction Fuzzy Hash: 203164B17502106AEB10AF65DC86F6A3698D714709F60017AFA40EF2D7C6BDED40476D

Uniqueness

Uniqueness Score: -1.00%

Function 00482C40 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00482DFD
FreeLibrary.KERNEL32(00000000), ref: 00482E11
SendNotifyMessageA.USER32(00010446,00000496,00002710,00000000), ref: 00482E83

Strings

Restarting Windows., xrefs: 00482E5E
Not restarting Windows because Setup is being run from the debugger., xrefs: 00482E32
DeinitializeSetup, xrefs: 00482CF9
Deinitializing Setup., xrefs: 00482C5E
GetCustomSetupExitCode, xrefs: 00482C9D

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 9c2bbffa538aa2e5b055a523d915f2d38be36e5908d6c0a026212498e4b0fc52
Instruction ID: 87ca8a1097935e6c4637b022688acffdd958b69fb8a4991d3dc3ea9519d40e2c
Opcode Fuzzy Hash: 9c2bbffa538aa2e5b055a523d915f2d38be36e5908d6c0a026212498e4b0fc52
Instruction Fuzzy Hash: F851AA30600200EFD711EF6AD949B6E7BE4EB19718F51897BE800D72A1DBB89C45CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042FA00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042FA2F
GetFocus.USER32 ref: 0042FA37
RegisterClassA.USER32(0049B7AC), ref: 0042FA58
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042FB2C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042FA96
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042FADC
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042FAED
SetFocus.USER32(00000000,00000000,0042FB0F,?,?,?,00000001,00000000,?,00458B4E,00000000,0049D62C), ref: 0042FAF4

Strings

TWindowDisabler-Window, xrefs: 0042FA8F, 0042FAD5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: fec87ca07d7290a4a57da710bc1ddf3081f88a8d4dfe440d170acd63eb0d43c3
Instruction ID: be32ada46e774ba6914a87ad40c025b2c9e25f6d11d521099bf08b28c91ad89a
Opcode Fuzzy Hash: fec87ca07d7290a4a57da710bc1ddf3081f88a8d4dfe440d170acd63eb0d43c3
Instruction Fuzzy Hash: E121B570B40720BAE210EB65EC03F1A76B4EB04B04FA1813BF504BB2D1D7B96C1487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00473950 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00473A11,?,?,?,00000008,00000000,00000000,00000000,?,00473C6D,?,?,00000000,00473EF0), ref: 00473974

Part of subcall function 0042D1E4: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042D25A

Part of subcall function 004073A0: DeleteFileA.KERNEL32(00000000,0049D62C,00499FD9,00000000,0049A02E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073AB

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00473A11,?,?,?,00000008,00000000,00000000,00000000,?,00473C6D), ref: 004739EB
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00473A11,?,?,?,00000008,00000000,00000000,00000000), ref: 004739F1

Strings

{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 004739AD
desktop.ini, xrefs: 00473988
CLSID2, xrefs: 0047399E
target.lnk, xrefs: 004739C9
.ShellClassInfo, xrefs: 004739A3

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: c5ee601f3e9953c735d8bf0a71158fe3e64be6cf92b19d5fab08f93ca351b12b
Instruction ID: bfb262a57c212aacfed1a05d1298e64af55acb3d3cb9d0523fd91374b550827c
Opcode Fuzzy Hash: c5ee601f3e9953c735d8bf0a71158fe3e64be6cf92b19d5fab08f93ca351b12b
Instruction Fuzzy Hash: 8F11D3B07006047BD701EA698C83AAE73ACDB48715F50813BB844A72C1DB3C9F02961D

Uniqueness

Uniqueness Score: -1.00%

Function 00453934 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 56libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004539F2,?,?,?,?,00000000,00000000,?,0049A4EE), ref: 00453956
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0045395C
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004539F2,?,?,?,?,00000000,00000000,?,0049A4EE), ref: 00453970
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453976

Strings

Wow64RevertWow64FsRedirection, xrefs: 00453966
shell32.dll, xrefs: 004539B3
Wow64DisableWow64FsRedirection, xrefs: 0045394C
kernel32.dll, xrefs: 00453951, 0045396B

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 82da2a28b5003144a588bfd6711196aeba7955ca25a5e24eec6645e80d453e72
Instruction ID: a193a4472c2853cf72940ff7690ab9972ac4b2f80f688c1a00737a0c34b4483d
Opcode Fuzzy Hash: 82da2a28b5003144a588bfd6711196aeba7955ca25a5e24eec6645e80d453e72
Instruction Fuzzy Hash: B211E3B0A00244BBDB00EF66DC03F5E7BA8D70475AF60447BF84166282D6BC9F088A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00467E10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467EB3
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467ED9

Part of subcall function 00467D4C: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00467DE7
Part of subcall function 00467D4C: DestroyCursor.USER32(00000000), ref: 00467DFD

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467F30
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467F91
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467FB7

Strings

shell32.dll, xrefs: 00467F14
c:\directory, xrefs: 00467EAE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll
API String ID: 3376378930-1375355148
Opcode ID: 5f39b0330533c07a7ed62396f03ad1b0497855389b17cb99d84a9eecbd47350c
Instruction ID: adf232676f9dc8545d434ff73a7213ff4163269ef5d9f53791e9b27a0c2465ea
Opcode Fuzzy Hash: 5f39b0330533c07a7ed62396f03ad1b0497855389b17cb99d84a9eecbd47350c
Instruction Fuzzy Hash: 64516D70644208AFD750EF65CC85FDEBBA8EB48308F1085A7F5089B391DA399E85CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00430DE0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430DE8
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430DF7
GetCurrentThreadId.KERNEL32 ref: 00430E11
GlobalAddAtomA.KERNEL32(00000000), ref: 00430E32

Strings

WndProcPtr%.8X%.8X, xrefs: 00430E23
commdlg_FindReplace, xrefs: 00430DF2
commdlg_help, xrefs: 00430DE3

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 50811bd1b0b0bc88e10382fd261453b7235327efbd1eb80bce93881789032006
Instruction ID: dd09876b0f9c3184917b018614b917cdad608ae665b29eb2c15b2e3af62d5cdc
Opcode Fuzzy Hash: 50811bd1b0b0bc88e10382fd261453b7235327efbd1eb80bce93881789032006
Instruction Fuzzy Hash: 98F082B09483409ED300EF26890371A7AE0AB58708F404F3FB48CA2291D7399910CB1F

Uniqueness

Uniqueness Score: -1.00%

Function 00455778 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00455994,00455994,?,00455994,00000000), ref: 00455922
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00455994,00455994,?,00455994), ref: 0045592F

Part of subcall function 004556E4: WaitForInputIdle.USER32(?,00000032), ref: 00455710
Part of subcall function 004556E4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00455732
Part of subcall function 004556E4: GetExitCodeProcess.KERNEL32(?,?), ref: 00455741
Part of subcall function 004556E4: CloseHandle.KERNEL32(?,0045576E,00455767,?,?,?,00000000,?,?,00455943,?,?,?,00000044,00000000,00000000), ref: 00455761

Strings

.cmd, xrefs: 00455823
cmd.exe" /C ", xrefs: 00455855
D, xrefs: 004558C0
COMMAND.COM" /C , xrefs: 0045588C
.bat, xrefs: 00455808

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 3aef928493a85a336b4fdc45b2ef872796c76b537a4fe3cf952342f788ba9a48
Instruction ID: 19165e213e9236b89a5b086241af4e71530f18fc7e42ed674525c8849c01d6f6
Opcode Fuzzy Hash: 3aef928493a85a336b4fdc45b2ef872796c76b537a4fe3cf952342f788ba9a48
Instruction Fuzzy Hash: F4514A7060074DABDB11EF96C892BEEBBB9AF44315F50403BF804BB282D77C99198759

Uniqueness

Uniqueness Score: -1.00%

Function 00423ADC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 00423B6C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00419436,00000000,?,?,?,00000001), ref: 00423B99
OemToCharA.USER32(?,?), ref: 00423BAC
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00419436,00000000,?,?,?,00000001), ref: 00423BEC

Strings

2, xrefs: 00423B3A
MAINICON, xrefs: 00423B61

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: 5bb029359a14fe80b98f3d31a1bddee7a09f53b94ef6d4528e1ea31487fdaa44
Instruction ID: e5d3831d9b5483d4bbbd2f836839ca6b10e9aa02fde8f17f2ef2fb4492c3d901
Opcode Fuzzy Hash: 5bb029359a14fe80b98f3d31a1bddee7a09f53b94ef6d4528e1ea31487fdaa44
Instruction Fuzzy Hash: 6031A271A042549ADB10EF29C8C57C67BE8AF14308F4045BAE844DB383D7BED988CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00496DF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00496E01

Part of subcall function 0041A638: CreateFontIndirectA.GDI32(?), ref: 0041A6F7

SelectObject.GDI32(00000000,00000000), ref: 00496E23
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,004973A1), ref: 00496E37
GetTextMetricsA.GDI32(00000000,?), ref: 00496E59
ReleaseDC.USER32(00000000,00000000), ref: 00496E76

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00496E2E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: aae36943e4c039aea34424998f68ade3a8833365680bc7432fe66356b3d4646c
Instruction ID: 569e85929f3d385eaff6f9e1b1d1d5c6dd8a65a34f46b30b3a8bef4bdf425d44
Opcode Fuzzy Hash: aae36943e4c039aea34424998f68ade3a8833365680bc7432fe66356b3d4646c
Instruction Fuzzy Hash: 36018476A04608AFDB05DBE9CC41F5FB7ECDB49704F11047ABA04E7281D678AE008B68

Uniqueness

Uniqueness Score: -1.00%

Function 00419388 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 0041938D
GlobalAddAtomA.KERNEL32(00000000), ref: 004193AE
GetCurrentThreadId.KERNEL32 ref: 004193C9
GlobalAddAtomA.KERNEL32(00000000), ref: 004193EA

Part of subcall function 00423518: GetDC.USER32(00000000), ref: 0042356E
Part of subcall function 00423518: EnumFontsA.GDI32(00000000,00000000,004234B8,004108B0,00000000,?,?,00000000,?,00419423,00000000,?,?,?,00000001), ref: 00423581
Part of subcall function 00423518: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423589
Part of subcall function 00423518: ReleaseDC.USER32(00000000,00000000), ref: 00423594

Part of subcall function 00423ADC: LoadIconA.USER32(00400000,MAINICON), ref: 00423B6C
Part of subcall function 00423ADC: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00419436,00000000,?,?,?,00000001), ref: 00423B99
Part of subcall function 00423ADC: OemToCharA.USER32(?,?), ref: 00423BAC
Part of subcall function 00423ADC: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00419436,00000000,?,?,?,00000001), ref: 00423BEC

Part of subcall function 0041F568: GetVersion.KERNEL32(?,00419440,00000000,?,?,?,00000001), ref: 0041F576
Part of subcall function 0041F568: SetErrorMode.KERNEL32(00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F592
Part of subcall function 0041F568: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F59E
Part of subcall function 0041F568: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F5AC
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F5DC
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F605
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F61A
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F62F
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F644
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F659
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F66E
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F683
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F698
Part of subcall function 0041F568: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F6AD

Strings

ControlOfs%.8X%.8X, xrefs: 004193DB
Delphi%.8X, xrefs: 0041939F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: e4565b8fba9480968b1ec32b488455297d6f31b702462cc9ec0cccc8cb2a2db4
Instruction ID: 7870b9ea93aa7f75565cd31cdf92f475c288cd9ab0443d66b722f1effdfa130a
Opcode Fuzzy Hash: e4565b8fba9480968b1ec32b488455297d6f31b702462cc9ec0cccc8cb2a2db4
Instruction Fuzzy Hash: 8D112C70A182419AC300FF36D44279A7AE09BA430CF50893FF488AB3A1DB3D9D458B5E

Uniqueness

Uniqueness Score: -1.00%

Function 00413A8C Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413AB4
GetWindowLongA.USER32(?,000000F0), ref: 00413ABF
GetWindowLongA.USER32(?,000000F4), ref: 00413AD1
SetWindowLongA.USER32(?,000000F4,?), ref: 00413AE4
SetPropA.USER32(?,00000000,00000000), ref: 00413AFB
SetPropA.USER32(?,00000000,00000000), ref: 00413B12

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: a72ee32d6cac1f66b8d23ea34dc7313db56b2b1373a44c7e0100784739caab29
Instruction ID: a594f7604add2a8bfce9427623ad02c9736cb33a5a72341fbb506abd62de3718
Opcode Fuzzy Hash: a72ee32d6cac1f66b8d23ea34dc7313db56b2b1373a44c7e0100784739caab29
Instruction Fuzzy Hash: 0811CC75500244BFDF00DF99ED88E9A3BE8EB09364F104276B914DB2E1D739D990CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049D420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049D420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049D420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: a09964db7d5e1398f2afb7250b5a8c8ddfedb2b5ecba3fe18733cc428a63f314
Instruction ID: 86217af8f0c65890f5da76d4fe10d609cc5e2f7049d93a5e71f2b830536aceac
Opcode Fuzzy Hash: a09964db7d5e1398f2afb7250b5a8c8ddfedb2b5ecba3fe18733cc428a63f314
Instruction Fuzzy Hash: 7A11BF70E003405AEB15AB659D82B267BE4976570CF44007BF50067AF1D77CB840C76E

Uniqueness

Uniqueness Score: -1.00%

Function 004730AC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,00000000,00000000,0047327D,I,?,?,I,00000000,0047346D,?,00000000,?,00000000,?,00473639), ref: 00473259
FindClose.KERNEL32(000000FF,00473284,0047327D,I,?,?,I,00000000,0047346D,?,00000000,?,00000000,?,00473639,?), ref: 00473277
FindNextFileA.KERNEL32(000000FF,00000000,00000000,0047339F,I,?,?,I,00000000,0047346D,?,00000000,?,00000000,?,00473639), ref: 0047337B
FindClose.KERNEL32(000000FF,004733A6,0047339F,I,?,?,I,00000000,0047346D,?,00000000,?,00000000,?,00473639,?), ref: 00473399

Strings

I, xrefs: 004730E9, 00473123, 004732E0

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: I
API String ID: 2066263336-1966777607
Opcode ID: 8b65bf247db3295ca275b67f998f10653201df018fbb24eda57c1ca99500e988
Instruction ID: 1af051264105f0c3ac5173717805306f181c97d1b343904b0a5707565e1f6f82
Opcode Fuzzy Hash: 8b65bf247db3295ca275b67f998f10653201df018fbb24eda57c1ca99500e988
Instruction Fuzzy Hash: F2C13C7490425DAFCF11DFA5C881ADEBBB9FF49304F5081AAE808A3351D7399A46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00455E74 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045600B,?,00000000,0045604B), ref: 00455F51

Strings

PendingFileRenameOperations, xrefs: 00455EF0
WININIT.INI, xrefs: 00455F80
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455ED4
PendingFileRenameOperations2, xrefs: 00455F20

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: e9f5ec5d9a922d6e804977622206966c4fc0cebec45bda16100918fe35222916
Instruction ID: cd3286cbb97796e9ecd700c4ab963dac99c65abdd87cbf21601b40f17af9d083
Opcode Fuzzy Hash: e9f5ec5d9a922d6e804977622206966c4fc0cebec45bda16100918fe35222916
Instruction Fuzzy Hash: 1551B930E001089FDB11EF61DC51ADEB7B9EF44705F5085BBE804A72D2DB39AE45CA58

Uniqueness

Uniqueness Score: -1.00%

Function 0047DEA0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047DFF6,?,?,00000000,0049D62C,00000000,00000000,?,00499E21,00000000,00499FCA,?,00000000), ref: 0047DF33
GetLastError.KERNEL32(00000000,00000000,00000000,0047DFF6,?,?,00000000,0049D62C,00000000,00000000,?,00499E21,00000000,00499FCA,?,00000000), ref: 0047DF3C

Strings

_isetup, xrefs: 0047DF1E
Created temporary directory: , xrefs: 0047DED5
\_setup64.tmp, xrefs: 0047DFAE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: 11c41cff4b2e26d29b59e317b5d01f68a09a239768e9d902b03435ecaad13ccb
Instruction ID: ecaa8d991a706e785fb0a456308ec2ceb04ba6e672c042181299f5b248b5f278
Opcode Fuzzy Hash: 11c41cff4b2e26d29b59e317b5d01f68a09a239768e9d902b03435ecaad13ccb
Instruction Fuzzy Hash: A2414634A101099BCB01EF95DC81ADEB7B9EF44309F50847BE901B7392DB38AE05CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042E294 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042E2A0
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042E43B,00000000,0042E453,?,?,?,?,00000006,?,00000000,00499145), ref: 0042E2BB
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E2C1

Strings

RegDeleteKeyExA, xrefs: 0042E2B1
advapi32.dll, xrefs: 0042E2B6

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: ec6d5e68239a8fd64e2f61c23397c604527ea817bc29ae7d62183104243c5598
Instruction ID: a3ecee3a08e4bdafa542c89306e26d0a5ab5c090d3d5ae483566a3001d088d92
Opcode Fuzzy Hash: ec6d5e68239a8fd64e2f61c23397c604527ea817bc29ae7d62183104243c5598
Instruction Fuzzy Hash: B8E065B0740234EAD7142A66BC4AFA7260CEB54726F940877F10A661D187BC1C40D66C

Uniqueness

Uniqueness Score: -1.00%

Function 0046C7D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

NextButtonClick, xrefs: 0046C90C
PrepareToInstall failed: %s, xrefs: 0046CB2E
Need to restart Windows? %s, xrefs: 0046CB55

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: d87af4896cb793d083c2bc30ee3769ba6e3254b9113bfc88e0628799f0af0af8
Instruction ID: 93777efb9077a0228fe374709ad1741880755db4a3f7640889f56f3bdeecc4c5
Opcode Fuzzy Hash: d87af4896cb793d083c2bc30ee3769ba6e3254b9113bfc88e0628799f0af0af8
Instruction Fuzzy Hash: 9CD17F34A00108DFCB10EFA9C585AED7BF5EF49304F6444BAE444AB352E738AE45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00484470 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,004847C1), ref: 00484594
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00484632

Strings

Need to restart Windows? %s, xrefs: 0048466F
, xrefs: 004846EF

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: dca023eaf0adf91f688e90e7278f8f3d4603c071aacc431b0939a1ba66e08d33
Instruction ID: cbf7044c9224e5df34f4324165486d78489046a6efa1a602e4c0c9b5677eb74d
Opcode Fuzzy Hash: dca023eaf0adf91f688e90e7278f8f3d4603c071aacc431b0939a1ba66e08d33
Instruction Fuzzy Hash: C591A334A042459FDB10FB66D885B9D77E0AF5A308F1444BBE800973A2D77CAD45CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00454868 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 200fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00454AAE,?,00000000,00454B22,?,?,-00000001,00000000,?,0047E107,00000000,0047E054,00000000), ref: 00454A8A
FindClose.KERNEL32(000000FF,00454AB5,00454AAE,?,00000000,00454B22,?,?,-00000001,00000000,?,0047E107,00000000,0047E054,00000000,00000000), ref: 00454AA8

Strings

.H, xrefs: 00454AB5, 00454A2F, 00454A32
.H, xrefs: 00454B14, 004548F1, 00454902, 004548D4

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: .H$ .H
API String ID: 2066263336-1676226347
Opcode ID: ff4ed68c57a0d298832a8e289a05f0a49072924424f8e3e4963c38c144bad6ce
Instruction ID: 86a97b531f1ad2b4b7463d4220b8e0547854eedc1a857b6a9afda59406c2b972
Opcode Fuzzy Hash: ff4ed68c57a0d298832a8e289a05f0a49072924424f8e3e4963c38c144bad6ce
Instruction Fuzzy Hash: CF81A43490428DAFCF11DF65C8417EFBBB4AF89309F1440A6D8546B392C3399E8ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 00470938 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042CC54: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CC78

GetLastError.KERNEL32(00000000,00470B35,?,?,0049E1E4,00000000), ref: 00470A12
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00470A8C
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00470AB1

Strings

Creating directory: %s, xrefs: 004709FA

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: 491f8044cdd55bca13a915365ddaeeb7f1710c9c03b2f754f829ba70678f95d0
Instruction ID: 27f0dcb835b35bf1686b0556d16ec1317b7bae4cbab61287d01ee882f408922b
Opcode Fuzzy Hash: 491f8044cdd55bca13a915365ddaeeb7f1710c9c03b2f754f829ba70678f95d0
Instruction Fuzzy Hash: 0251FE74E01248ABDB01DFA5C982BDEB7F5AF48308F50856AE844B7382D7785F04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0045553C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 004555EA
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,004556B0), ref: 00455654

Strings

SfcIsFileProtected, xrefs: 004555E4
sfc.dll, xrefs: 004555AC

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: f7e58a0fd106200e4f3bc04200b2cacc58717943215cb6059fe45d01fbc32bb5
Instruction ID: f46810b5b314b431af4f43299c3fabe32507941823b9175d405aae5aeba4d308
Opcode Fuzzy Hash: f7e58a0fd106200e4f3bc04200b2cacc58717943215cb6059fe45d01fbc32bb5
Instruction Fuzzy Hash: 9141A470A00618AFEB20DF55DC95BAD77B8AB04319F5080B7E90CA7292D7789F48CE1D

Uniqueness

Uniqueness Score: -1.00%

Function 00452C54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,?), ref: 00452C74
74D41500.VERSION(00000000,?,00000000,?,00000000,00452CEF,?,00000000,?,?,?,?), ref: 00452CA1
74D41540.VERSION(?,00452D18,?,?,00000000,?,00000000,?,00000000,00452CEF,?,00000000,?,?,?,?), ref: 00452CBB

Strings

)-E, xrefs: 00452CFF, 00452CC7

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: D41500D41520D41540
String ID: )-E
API String ID: 2153611984-3997256589
Opcode ID: 1e3fa64680b4daa2d15fd70f35a4d6916cc241641b57064dc1621c371eabb0d9
Instruction ID: 50707f88950aac898d8c4389756beb7c92bb5193b179b1fc1fca76f0aa7be7f8
Opcode Fuzzy Hash: 1e3fa64680b4daa2d15fd70f35a4d6916cc241641b57064dc1621c371eabb0d9
Instruction Fuzzy Hash: 2B219275A00648AFDB01DAA99D419AFB7FCEB4A301F554077FC00E3282D6B99E088769

Uniqueness

Uniqueness Score: -1.00%

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Error, xrefs: 00404DB9
Runtime error at 00000000, xrefs: 00404DBE, 00404DD1

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 6146da9580bef9965da9cda28fdf8b1f09917d9546c5f1af2fde060953d626be
Instruction ID: c00c8b1b907268fe45c84c5108a6570d36dd98a08fca56cdb76ff5d345661702
Opcode Fuzzy Hash: 6146da9580bef9965da9cda28fdf8b1f09917d9546c5f1af2fde060953d626be
Instruction Fuzzy Hash: 8F21D360E452418ADB10AB75ED8171A3B8097F930CF04817BE700B73E2C67CD84687AE

Uniqueness

Uniqueness Score: -1.00%

Function 00450390 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,00450469,?,?,?,?,00000000,00000000), ref: 004503F8
LoadLibraryA.KERNEL32(00000000,00000000,00450469,?,?,?,?,00000000,00000000), ref: 0045043E

Part of subcall function 00450360: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00450378

Strings

RICHED32.DLL, xrefs: 0045042B
RICHED20.DLL, xrefs: 004503E5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: LibraryLoad$DirectorySystem
String ID: RICHED20.DLL$RICHED32.DLL
API String ID: 2630572097-740611112
Opcode ID: 9fcc27b6184eb67fa55648afaa4eab07c2ec715cb05f6099bae96d6f0231ec87
Instruction ID: 45d93e0d121fe09c7a50066aca23a685df4873c559958f5edeb39e7b45036801
Opcode Fuzzy Hash: 9fcc27b6184eb67fa55648afaa4eab07c2ec715cb05f6099bae96d6f0231ec87
Instruction Fuzzy Hash: EB216374900108EFDB10FF61E846B5D77F8EB55319F50447BE500A6162D7785A49CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 0042F188 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042F201

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042E7E4: SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
Part of subcall function 0042E7E4: LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042F1E4

Strings

shlwapi.dll, xrefs: 0042F1C1
SHAutoComplete, xrefs: 0042F1DE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: ef2fe5795da2c79bebcfc8bc045bc88b8cffcc678c25b10b165038ef52182f9f
Instruction ID: f8fd25663858203a515409cfb2833324ac242db414aae85ffba9c986139a78a3
Opcode Fuzzy Hash: ef2fe5795da2c79bebcfc8bc045bc88b8cffcc678c25b10b165038ef52182f9f
Instruction Fuzzy Hash: 9701D274B00718EBE711DB65EC42B5E7BFCDB99704FE000B7B404A2291DAB99E48C62C

Uniqueness

Uniqueness Score: -1.00%

Function 004561AC Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,00456217,?,00000001,00000000), ref: 0045620A

Strings

PendingFileRenameOperations, xrefs: 004561DC
PendingFileRenameOperations2, xrefs: 004561EB
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004561B8

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 87e1b63c1f2f4d127164f17ed4e3c83a002a2972f4535a48dc77b62da67b808c
Instruction ID: 13f9a8dc2762523c9d5034016e8e0e4cf56d15ba7b570f5b98feacd54ef34b89
Opcode Fuzzy Hash: 87e1b63c1f2f4d127164f17ed4e3c83a002a2972f4535a48dc77b62da67b808c
Instruction Fuzzy Hash: F2F06271348204ABD714E6E69C13B5B739CD784B15FE284A6F80487982EA79AD14962C

Uniqueness

Uniqueness Score: -1.00%

Function 0046FC5C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,VtG,?,0049E1E4,?,0046FF73,?,00000000,00470532,?,_is1), ref: 0046FC7F

Strings

VtG, xrefs: 0046FC61
Inno Setup: Setup Version, xrefs: 0046FC7D
I, xrefs: 0046FC89, 0046FC8F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version$VtG$I
API String ID: 3702945584-29442299
Opcode ID: 01fe2595a91c979785a9f0a3cbfdcbab837408d87d7a81537bd7bc401ac7c2bc
Instruction ID: 298cf4f1533d54ab550fd3d15e19e6a926ba71f9f01c0afe6301adb1283b93e4
Opcode Fuzzy Hash: 01fe2595a91c979785a9f0a3cbfdcbab837408d87d7a81537bd7bc401ac7c2bc
Instruction Fuzzy Hash: E7E06D713013043BD710AA2BAC85F5BAADCDF987A5F00403AB948DB392D578ED0542A8

Uniqueness

Uniqueness Score: -1.00%

Function 00481008 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,00481201), ref: 004810AE
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,00481201), ref: 004810BB
FindNextFileA.KERNEL32(000000FF,?,00000000,004811D4,?,?,?,?,00000000,00481201), ref: 004811B0
FindClose.KERNEL32(000000FF,004811DB,004811D4,?,?,?,?,00000000,00481201), ref: 004811CE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 63da60fc703e6e8aa7dcaf1f4a84ca4d1db4635fe8be35313377f08196bdfc45
Instruction ID: 32ce0b593b226a8a495a7b16ec3f8c392e3281c2b0d16565a73bd1b48714ff7d
Opcode Fuzzy Hash: 63da60fc703e6e8aa7dcaf1f4a84ca4d1db4635fe8be35313377f08196bdfc45
Instruction Fuzzy Hash: 95515E75A006489FCB10EF65CC45ADEB7BCEB89315F1045ABA808E7351D6389F86CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004216C4 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 004217B1
SetMenu.USER32(00000000,00000000), ref: 004217CE
SetMenu.USER32(00000000,00000000), ref: 00421803
SetMenu.USER32(00000000,00000000), ref: 0042181F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: a1d2f4484655de1d3fd0847b2328f430e3f40ab88dcc203f2c43afec94015a70
Instruction ID: 73b485f7b17ee0b128820b03b0310e3fef403fa1ec291b42cca88d6787b8c394
Opcode Fuzzy Hash: a1d2f4484655de1d3fd0847b2328f430e3f40ab88dcc203f2c43afec94015a70
Instruction Fuzzy Hash: 44419E3070426407DB21BF3AA98579B66D55FA0308F4811BFE8458F3A3CA7CCC4A82AD

Uniqueness

Uniqueness Score: -1.00%

Function 00417668 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004176B0
SetCursor.USER32(00000000), ref: 004176F3
GetLastActivePopup.USER32(?), ref: 0041771D
GetForegroundWindow.USER32(?), ref: 00417724

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 14110dda0b90429387dd3a163e0d8510df73624919390f4fd5eb2ebddd82d255
Instruction ID: dbcb3e4d6cdf237ebd373b45723c7518e1d79ef9827cdcdbbe1e0fb97faef126
Opcode Fuzzy Hash: 14110dda0b90429387dd3a163e0d8510df73624919390f4fd5eb2ebddd82d255
Instruction Fuzzy Hash: 8121CF303086018BC710EF29D980ADB73B1AB44768F52447BE8688B392D73DEC81CA8D

Uniqueness

Uniqueness Score: -1.00%

Function 00416F92 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416FD4
SetTextColor.GDI32(?,00000000), ref: 00416FEE
SetBkColor.GDI32(?,00000000), ref: 00417008
CallWindowProcA.USER32(?,?,?,?,?), ref: 00417030

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 2663e636a10a516644b319dd38bd24ec26a11bbb7cdbebd148a82c02926d9cca
Instruction ID: 97657bf4431c68cea31458eff6611b8cbcc4ca9acdd3171e17da9912607f4e93
Opcode Fuzzy Hash: 2663e636a10a516644b319dd38bd24ec26a11bbb7cdbebd148a82c02926d9cca
Instruction Fuzzy Hash: CE114CB1604600AFD710EE6ECD84E87B7ECDF48310B14882AB55ADB612C62CE8818B69

Uniqueness

Uniqueness Score: -1.00%

Function 00423ED4 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423E6C), ref: 00423EF8
GetWindow.USER32(?,00000003), ref: 00423F0D
GetWindowLongA.USER32(?,000000EC), ref: 00423F1C
SetWindowPos.USER32(00000000,004245AC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004245FB,?,?,004241C3), ref: 00423F52

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: da7c6a1f1adb1243b5fa3636d4e877867cfe7b0e5d1887425f7f41af5dac74a2
Instruction ID: 800f3c7d6b650a9444741cf3b456662361ea129bec99247a5177c247b1bc03b7
Opcode Fuzzy Hash: da7c6a1f1adb1243b5fa3636d4e877867cfe7b0e5d1887425f7f41af5dac74a2
Instruction Fuzzy Hash: 5B117071B04610ABDB109F28ED85F5673F4EB08715F12026AF9649B2E2C37CDD40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00423518 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042356E
EnumFontsA.GDI32(00000000,00000000,004234B8,004108B0,00000000,?,?,00000000,?,00419423,00000000,?,?,?,00000001), ref: 00423581
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423589
ReleaseDC.USER32(00000000,00000000), ref: 00423594

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: bb643e78eddffdc26f40f16d9b8672dcc85dc1c54bcbb46a45d6df83db9bb269
Instruction ID: 3e91f746c00fb2f600ae5fc17e333cd129bb14a9c5a67b8d5949c9a763c02f3d
Opcode Fuzzy Hash: bb643e78eddffdc26f40f16d9b8672dcc85dc1c54bcbb46a45d6df83db9bb269
Instruction Fuzzy Hash: 5C019EB17457102AE710BF6A5C82B9B37A49F0531DF40427FF908AB3C2DA7E990547AE

Uniqueness

Uniqueness Score: -1.00%

Function 004556E4 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00455710
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00455732
GetExitCodeProcess.KERNEL32(?,?), ref: 00455741
CloseHandle.KERNEL32(?,0045576E,00455767,?,?,?,00000000,?,?,00455943,?,?,?,00000044,00000000,00000000), ref: 00455761

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: 0e2e22314dae304e5bf22728ddaa36dde328adca970e968fdbe7b68800f3fe31
Instruction ID: d914ecb4f604d225e93de076450c6742835d04a0b91abb11bcb899d5d614385b
Opcode Fuzzy Hash: 0e2e22314dae304e5bf22728ddaa36dde328adca970e968fdbe7b68800f3fe31
Instruction Fuzzy Hash: 6101B570A40A09FEEB20A7A58D16F7F7BADDB49760F610167F904D32C2C6789D00CA68

Uniqueness

Uniqueness Score: -1.00%

Function 0047E054 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047E075
GetLastError.KERNEL32 ref: 0047E07F
GetTickCount.KERNEL32 ref: 0047E089
Sleep.KERNEL32(00000032), ref: 0047E099

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 22ddb9d6ab121fa8b7aad317e9abd2d9173961abc661a66fb327fe759d7b9ec5
Instruction ID: 9be5390d37519caeffefa09d8943b7800c28e667e42796fceef54f4227176e6c
Opcode Fuzzy Hash: 22ddb9d6ab121fa8b7aad317e9abd2d9173961abc661a66fb327fe759d7b9ec5
Instruction Fuzzy Hash: 28E0E5213092A855C63035BB58C26AF45C9DA89768B244ABFE088D6283C89C4C05652E

Uniqueness

Uniqueness Score: -1.00%

Function 00424690 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 0042469C
IsWindowVisible.USER32(?), ref: 004246AD
IsWindowEnabled.USER32(?), ref: 004246B7
SetForegroundWindow.USER32(?), ref: 004246C1

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 964e624a3cbf8c5b4517c95e76b9339d3539c6f5ce3d6abdcbab3e7bb719c7a3
Instruction ID: 92c4e0b2622c21c1aafdf32b5a5e60d634be871c9bac48645995030a32fad986
Opcode Fuzzy Hash: 964e624a3cbf8c5b4517c95e76b9339d3539c6f5ce3d6abdcbab3e7bb719c7a3
Instruction Fuzzy Hash: BBE01261B0293157AA31FA7AA885A9F118CDD47BC43460277BC41F7297DB2CDC1045FD

Uniqueness

Uniqueness Score: -1.00%

Function 0045CA60 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00451070: SetEndOfFile.KERNEL32(?,?,0045CB3E,00000000,0045CCC9,?,00000000,00000002,00000002), ref: 00451077

FlushFileBuffers.KERNEL32(?), ref: 0045CC95

Strings

EndOffset range exceeded, xrefs: 0045CBC9
NumRecs range exceeded, xrefs: 0045CB92

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 69559d5369597ea91ae9cee70a3000ef17ba892e4adcf601713595c8f1485f33
Instruction ID: 609741d3f79eabe780872f94ce4b5bf90fe53003262008b9b2f446b63576a9fa
Opcode Fuzzy Hash: 69559d5369597ea91ae9cee70a3000ef17ba892e4adcf601713595c8f1485f33
Instruction Fuzzy Hash: 6E615234A002588FDB25DF25D881BDAB7B5EF49305F0084DAED899B352D6B4AEC8CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00484978 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00484B02,?,00000000,00484B43,?,?,?,?,00000000,00000000,00000000,?,0046CA59), ref: 004849B1
SetActiveWindow.USER32(?,00000000,00484B02,?,00000000,00484B43,?,?,?,?,00000000,00000000,00000000,?,0046CA59), ref: 004849C3

Strings

Will not restart Windows automatically., xrefs: 00484AE2

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: 611cf57aec86bfea3a2af854023c09e37a5beb60966471ff9b2a299e19d7bf06
Instruction ID: e3ffbfa0a86cb08642d5b37a1a1eca219a4b332c0ee086946791bcc458de558f
Opcode Fuzzy Hash: 611cf57aec86bfea3a2af854023c09e37a5beb60966471ff9b2a299e19d7bf06
Instruction Fuzzy Hash: 64415930644245EFD714FFA6EC05B6E7BE4D795308F1948B7E8405B392E2BC9800971E

Uniqueness

Uniqueness Score: -1.00%

Function 0049A490 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,0049A49E), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,0049A49E), ref: 00403356

Part of subcall function 004063F4: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 0040640F
Part of subcall function 004063F4: GetVersion.KERNEL32(kernel32.dll,00000000,0040668E,?,?,?,?,00000000,?,0049A4A8), ref: 00406416
Part of subcall function 004063F4: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0040642B
Part of subcall function 004063F4: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00406453

Part of subcall function 00406814: 6F571CD0.COMCTL32(0049A4AD), ref: 00406814

Part of subcall function 00410BB4: GetCurrentThreadId.KERNEL32 ref: 00410C02

Part of subcall function 00419490: GetVersion.KERNEL32(0049A4C6), ref: 00419490

Part of subcall function 0044FD1C: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049A4DA), ref: 0044FD57
Part of subcall function 0044FD1C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044FD5D

Part of subcall function 004501E8: GetVersionExA.KERNEL32(0049D794,0049A4DF), ref: 004501F7

Part of subcall function 00453934: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004539F2,?,?,?,?,00000000,00000000,?,0049A4EE), ref: 00453956
Part of subcall function 00453934: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0045395C
Part of subcall function 00453934: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004539F2,?,?,?,?,00000000,00000000,?,0049A4EE), ref: 00453970
Part of subcall function 00453934: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453976

Part of subcall function 00457850: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004578AA

Part of subcall function 00465214: LoadLibraryA.KERNEL32(00000000,SHPathPrepareForWriteA,00000000,0046528A,?,?,?,?,00000000,00000000,?,0049A502), ref: 0046525F
Part of subcall function 00465214: GetProcAddress.KERNEL32(00000000,00000000), ref: 00465265

Part of subcall function 0046DAB0: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046DAFB

Part of subcall function 00479E68: GetModuleHandleA.KERNEL32(kernel32.dll,?,0049A50C), ref: 00479E6E
Part of subcall function 00479E68: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00479E7B
Part of subcall function 00479E68: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00479E8B

Part of subcall function 00485374: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00485485

Part of subcall function 0049749C: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 004974B5

SetErrorMode.KERNEL32(00000001,00000000,0049A554), ref: 0049A526

Part of subcall function 0049A250: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0049A530,00000001,00000000,0049A554), ref: 0049A25A
Part of subcall function 0049A250: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049A260

Part of subcall function 00424924: SendMessageA.USER32(?,0000B020,00000000,?), ref: 00424943

Part of subcall function 00424714: SetWindowTextA.USER32(?,00000000), ref: 0042472C

ShowWindow.USER32(?,00000005,00000000,0049A554), ref: 0049A587

Part of subcall function 004839B4: SetActiveWindow.USER32(?), ref: 00483A62

Strings

Setup, xrefs: 0049A56D

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$HandleModule$VersionWindow$ActiveClipboardCommandCurrentErrorF571FormatLibraryLineLoadMessageModeRegisterSendShowTextThread
String ID: Setup
API String ID: 3351940568-3839654196
Opcode ID: cdfde2e51fe0698aa6b85e30c0a1c237bbea7d7fd99d79f8e074734ecee56c62
Instruction ID: 2627a5300f3eb19f067de96b875d46ae0be93d5911e26a22e66c9acfb87dca20
Opcode Fuzzy Hash: cdfde2e51fe0698aa6b85e30c0a1c237bbea7d7fd99d79f8e074734ecee56c62
Instruction Fuzzy Hash: AA31B3712046409EDB01BBB7AC1391D3BA8EB8971CB62487FF90486563DE3D5C24867F

Uniqueness

Uniqueness Score: -1.00%

Function 0045418C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0045427B,?,?,00000000,0049D62C,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004541D2
GetLastError.KERNEL32(00000000,00000000,?,00000000,0045427B,?,?,00000000,0049D62C,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004541DB

Strings

.tmp, xrefs: 004541BB

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 6f4460bb771477b2532cc418dcf8c2749320d1c4241bb26b34006b525e4e1938
Instruction ID: f8da180511d522ff1cc3db6e91f047bd7ddaecfb92c8c1642a91e8309ff3a61b
Opcode Fuzzy Hash: 6f4460bb771477b2532cc418dcf8c2749320d1c4241bb26b34006b525e4e1938
Instruction Fuzzy Hash: 19214E75A002189BDB01EFA1C8465DEB7BDEF44305F50457BF801B7382D67C5E458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00485374 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00484E68: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00484E79
Part of subcall function 00484E68: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00484E86
Part of subcall function 00484E68: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00484E94
Part of subcall function 00484E68: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00484E9C
Part of subcall function 00484E68: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00484EA8
Part of subcall function 00484E68: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00484EC9
Part of subcall function 00484E68: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00484EDC
Part of subcall function 00484E68: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00484EE2

Part of subcall function 00485194: GetVersionExA.KERNEL32(?,004853AA,00000000,004854AA,?,?,?,?,00000000,00000000,?,0049A511), ref: 004851A2
Part of subcall function 00485194: GetVersionExA.KERNEL32(0000009C,?,004853AA,00000000,004854AA,?,?,?,?,00000000,00000000,?,0049A511), ref: 004851F4

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042E7E4: SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
Part of subcall function 0042E7E4: LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00485485

Strings

shell32.dll, xrefs: 0048546D
SHGetKnownFolderPath, xrefs: 00485452

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$HandleModuleSystemVersion$CurrentDirectoryErrorInfoLibraryLoadModeNativeProcess
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 1303913335-2936008475
Opcode ID: 8d9af6f5cb47815f3ef02b670df531d4aca205f4dd503ff5ab0741a2b0aad5e0
Instruction ID: 7070cd684f6103364e9f8a31a7d8965128adaac247882cc77746aeeddc076857
Opcode Fuzzy Hash: 8d9af6f5cb47815f3ef02b670df531d4aca205f4dd503ff5ab0741a2b0aad5e0
Instruction Fuzzy Hash: F9215E70600200ABC711FFAF995674E37A4EB9570CB51993FF400AB2D1D77DA8059B6E

Uniqueness

Uniqueness Score: -1.00%

Function 0045304C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,004530A9,?,-00000001,?), ref: 00453083
GetLastError.KERNEL32(00000000,00000000,004530A9,?,-00000001,?), ref: 0045308B

Strings

@8H, xrefs: 004530B9

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: @8H
API String ID: 2018770650-3762495883
Opcode ID: a1fb3666b45fe32249cf4b68f1752c0b17d8b18f48336da527a90bea16c05efb
Instruction ID: 483a50349848f844724b37c9089874c2f5155cc8dca7ffd3c90c1c5b4081c312
Opcode Fuzzy Hash: a1fb3666b45fe32249cf4b68f1752c0b17d8b18f48336da527a90bea16c05efb
Instruction Fuzzy Hash: 74F0C871A04708AFCB01DFB9AC4249EB7ECDB0975675045B7FC04E3282EB785F188599

Uniqueness

Uniqueness Score: -1.00%

Function 00453554 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,004535B1,?,-00000001,00000000), ref: 0045358B
GetLastError.KERNEL32(00000000,00000000,004535B1,?,-00000001,00000000), ref: 00453593

Strings

@8H, xrefs: 004535C1

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID: @8H
API String ID: 377330604-3762495883
Opcode ID: ed9ee3e2dc24464d0c236720d007919d28e5762e289691b171a35ab4808c6178
Instruction ID: 7fd71ab76445d730fbf8dcc8275d2678ef65a3f2b88ec35f2c7a4b5c8e56db9b
Opcode Fuzzy Hash: ed9ee3e2dc24464d0c236720d007919d28e5762e289691b171a35ab4808c6178
Instruction Fuzzy Hash: B2F0C271A04608BBCB01EFB9AC4249EB7E8EB0975675049BBFC04E3242F7785F088598

Uniqueness

Uniqueness Score: -1.00%

Function 00457850 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004577E0: CoInitialize.OLE32(00000000), ref: 004577E6

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042E7E4: SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
Part of subcall function 0042E7E4: LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 004578AA

Strings

SHCreateItemFromParsingName, xrefs: 00457877
shell32.dll, xrefs: 00457892

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressDirectoryErrorInitializeLibraryLoadModeProcSystem
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 1013667774-2320870614
Opcode ID: f768b6972bd4a9b7486ce10d9acfcd5e81d127b13faf4c2cc7ed9affc27adf63
Instruction ID: 9566a5db5de29e1f96e1247fa15de811f0c6c8f84fbefe9709ba2c3b4718617c
Opcode Fuzzy Hash: f768b6972bd4a9b7486ce10d9acfcd5e81d127b13faf4c2cc7ed9affc27adf63
Instruction Fuzzy Hash: 4DF03670604608BBE701FBA6E842F5D7BACDB45759F604477B800A6592D67CAE04C92D

Uniqueness

Uniqueness Score: -1.00%

Function 0046DAB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 0042E7E4: SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
Part of subcall function 0042E7E4: LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046DAFB

Strings

SHPathPrepareForWriteA, xrefs: 0046DAC8
shell32.dll, xrefs: 0046DAE3

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressDirectoryErrorLibraryLoadModeProcSystem
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2552568031-2683653824
Opcode ID: d5f4c7af768d16b3b5c6a86f87ef45a876fa3cc5c322967070caf22bd86c78e1
Instruction ID: 91b75a77547c13e1772f921c750cf7bd45708da1ec0dc58a0f4cb33c0377533c
Opcode Fuzzy Hash: d5f4c7af768d16b3b5c6a86f87ef45a876fa3cc5c322967070caf22bd86c78e1
Instruction Fuzzy Hash: B5F04430B04608BBD700EF52DC52F5DBBACEB45B14FA14076B40067595E678AE048A2D

Uniqueness

Uniqueness Score: -1.00%

Function 0047D8E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047DC36,00000000,0047DC4C), ref: 0047D946

Strings

RegisteredOrganization, xrefs: 0047D935
RegisteredOwner, xrefs: 0047D923

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 9457630586559cfb7e194a626f7ed99069e1973a1d9648e0d13679cb2f752d42
Instruction ID: 03cfcff152a519ea80d4f5543ba1c5a79f91faf414c5488bd5ec988fdc31f9f9
Opcode Fuzzy Hash: 9457630586559cfb7e194a626f7ed99069e1973a1d9648e0d13679cb2f752d42
Instruction Fuzzy Hash: B6F0BBB0B042449BDB04D667AC93BDB37B9CB41308F24847BA2459B392D67C9D00D75D

Uniqueness

Uniqueness Score: -1.00%

Function 004763E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047661B), ref: 00476409
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047661B), ref: 00476420

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

CreateFile, xrefs: 00476415

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: dfe37b7c2a5045629fd8e0b2a77d405f8cad1a2ae405d18a87ba2f0597c9e29b
Instruction ID: 7bcc5fcb2fff494360280e2963ad1350d0a4ff74aab44489db68ce07f01780cc
Opcode Fuzzy Hash: dfe37b7c2a5045629fd8e0b2a77d405f8cad1a2ae405d18a87ba2f0597c9e29b
Instruction Fuzzy Hash: CDE06D302403447BEA20EB69DCC6F4A77D89B04738F108161FA48AF3E2C6B9EC408A5C

Uniqueness

Uniqueness Score: -1.00%

Function 0046EE04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0046EE9A), ref: 0046EE0E
756FE550.OLE32(0049BB9C,00000000,00000001,0049BBAC,?,?,0046EE9A), ref: 0046EE2A

Strings

`8f, xrefs: 0046EE43, 0046EE4F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: E550Version
String ID: `8f
API String ID: 1323609852-81291940
Opcode ID: 780da2f8f06851a502736db72271cf8d77c3ee5523c6db3b3ed376e5da340fe9
Instruction ID: 784abeb2b863a263b0685f2ce256345c834679a9cfc70721c753cc97000ad865
Opcode Fuzzy Hash: 780da2f8f06851a502736db72271cf8d77c3ee5523c6db3b3ed376e5da340fe9
Instruction Fuzzy Hash: 2AF0E534241310EEFB11E72BDC4AB4A3BC4AB25714F14403BF144972A1E3EE94808B6F

Uniqueness

Uniqueness Score: -1.00%

Function 0046FCCC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0047034A,?,?,00000000,00470532,?,_is1,?), ref: 0046FCDF

Strings

NoModify, xrefs: 0046FCDD
I, xrefs: 0046FCE9, 0046FCEF

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Value
String ID: NoModify$I
API String ID: 3702945584-1047506205
Opcode ID: 3b8341a2778ff8ba3f6fd97ccb953c8a619a9620ee14e4a078d82245842b3605
Instruction ID: 74656710be1799963dacf24c43606be2f52e229709c8467fcc2139d849b5a3c3
Opcode Fuzzy Hash: 3b8341a2778ff8ba3f6fd97ccb953c8a619a9620ee14e4a078d82245842b3605
Instruction Fuzzy Hash: 1AE04FB0640308BFEB04DB55DD4AF6BB7ACDB48750F104059BA44DB381EA74FE008658

Uniqueness

Uniqueness Score: -1.00%

Function 00483068 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,004831A0), ref: 00483138
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00483149
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00483161

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: b1581a0f06f3993262020228058a878573e1761b052ad4db3e08fed4fbd829c7
Instruction ID: 62bbcf7b8eda1c1d1fe504de26200215c04982407344b62899e0b3f82f18d8db
Opcode Fuzzy Hash: b1581a0f06f3993262020228058a878573e1761b052ad4db3e08fed4fbd829c7
Instruction Fuzzy Hash: 6431B0707083445AD710FF368C86B9E7A945B55B08F44593FB9009B3E3CA7D9E09876D

Uniqueness

Uniqueness Score: -1.00%

Function 0044B82C Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B8A1
SelectObject.GDI32(?,00000000), ref: 0044B8C4
ReleaseDC.USER32(00000000,?), ref: 0044B8F7

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID:
API String ID: 1831053106-0
Opcode ID: aebefea9080a2ffce71cc44d900bb6067fbd40711943de4e6aa6f899a124bbe5
Instruction ID: 488fbe92d3dbd6553530e1f28a7071e145c326c324a604cd7e83169de99d3e99
Opcode Fuzzy Hash: aebefea9080a2ffce71cc44d900bb6067fbd40711943de4e6aa6f899a124bbe5
Instruction Fuzzy Hash: B321A470E043086FEB05EFA5C841B9EBBB8EB48304F0184BAF504A6292D73CD940CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0044B560 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B5EC,?,004839CF,?,?), ref: 0044B5BE
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B5D1
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B605

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: 220ba5cac8d50b27136c7947ff428b4d5b30f8bb344e0136b885afe7086c5f85
Instruction ID: c4c5e2dbcf53f363daa0ac06871d419456bbfc1076f0fbe0a6f7c1d9791685bd
Opcode Fuzzy Hash: 220ba5cac8d50b27136c7947ff428b4d5b30f8bb344e0136b885afe7086c5f85
Instruction Fuzzy Hash: 1011CBB27045047FE711DB5A9C81D6FB7ECEB89714F10417BF514D72D0D6389E018669

Uniqueness

Uniqueness Score: -1.00%

Function 0042484C Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424862
TranslateMessage.USER32(?), ref: 004248DF
DispatchMessageA.USER32(?), ref: 004248E9

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 1d5f45652bc976909b78a8fda5e55899e4ac3f100e933d79a059951e0026f3ac
Instruction ID: c7af1bd1b10d32b98fa997e15213bd70182e4a6faef26a56c53dd2d0e562e7a0
Opcode Fuzzy Hash: 1d5f45652bc976909b78a8fda5e55899e4ac3f100e933d79a059951e0026f3ac
Instruction Fuzzy Hash: 7111C4343143905AEA20F664A94179B73D4DFD1B04F81481FF8D947382D3BD9D49876B

Uniqueness

Uniqueness Score: -1.00%

Function 00416A94 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 00416ABA
SetPropA.USER32(00000000,00000000), ref: 00416ACF
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 00416AF6

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 120d831fd0e7c0f5eedd88e24305ab6ef8b5e2b9243d669fe5121d0f27645725
Instruction ID: ba7ff3a79511e9fd345c6eb2e7309737472e1a66b8435aad7f351e84ed883601
Opcode Fuzzy Hash: 120d831fd0e7c0f5eedd88e24305ab6ef8b5e2b9243d669fe5121d0f27645725
Instruction Fuzzy Hash: 24F0B271701210ABD710AB698C85FA636ECAF0D755F16417ABA05EF286C679DC4087A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041F2A4 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041F2B4
IsWindowEnabled.USER32(?), ref: 0041F2BE
EnableWindow.USER32(?,00000000), ref: 0041F2E4

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: f8c63cb9eb03fe3057432f7fc847cbb230a844cb3caf0d06e376941515be7c19
Instruction ID: f88b3158499dd9289c75302ad3040ea965d59b676cda83e5cbf87f6be83bac28
Opcode Fuzzy Hash: f8c63cb9eb03fe3057432f7fc847cbb230a844cb3caf0d06e376941515be7c19
Instruction Fuzzy Hash: 56E06D74200200ABE310AB26ED81A56779CEB10314F118437A849AB293D63AD8458ABC

Uniqueness

Uniqueness Score: -1.00%

Function 0046ABA0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0046ACB1

Strings

PrepareToInstall, xrefs: 0046AC5B, 0046AD02

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: 0757163771d4cf7a822be93ef349af548551faecbdb0c417471b8bac247afbb2
Instruction ID: fdee18710babf5e336c1910aeb408bf0e6a903f892d838ad66a8bf575b9628a0
Opcode Fuzzy Hash: 0757163771d4cf7a822be93ef349af548551faecbdb0c417471b8bac247afbb2
Instruction Fuzzy Hash: 90A10C74A00109DFCB00EF99D886E9EB7F5AF48304F5540B6E404AB366D738AE45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0046D17C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046D318, 0046D32F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: ceb3f76dddb8c4f3c05b9d1c15b0c50ece1c75124130fc1418fa8c0e44e40a18
Instruction ID: f677315d7a897bddb44220e636167c4a4d5a92338f94b0a6c85659efeb8beb4e
Opcode Fuzzy Hash: ceb3f76dddb8c4f3c05b9d1c15b0c50ece1c75124130fc1418fa8c0e44e40a18
Instruction Fuzzy Hash: 95719770F04208ABDB10EB66DC92F9E77A15B41308F1480A7F900BB392E6B99D45875F

Uniqueness

Uniqueness Score: -1.00%

Function 004839B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00483A62

Strings

InitializeWizard, xrefs: 004839FB

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 596aecf1e0d44b14ec5b2cfef45288126fa4049a39532523449cbed932b259e2
Instruction ID: 9a8fbe648e99d25b3c1ebd2b051959da3f81131ff902f8f70686133b91dd172c
Opcode Fuzzy Hash: 596aecf1e0d44b14ec5b2cfef45288126fa4049a39532523449cbed932b259e2
Instruction Fuzzy Hash: BD119170608104DFD704EF2AFC85B597BE8E714718F22847BE544872A2EBB96D00DB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0047E0A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047E0F2

Strings

Failed to remove temporary directory: , xrefs: 0047E10B

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: 9feb2f6085af5a8b024ba5244f206146ce975ac7a9d5adcf9a00534459b24a1c
Instruction ID: ac5e1a37918f7d070e72ace47ef54387b1d6805ebc6ff4ed15476670fa48ed12
Opcode Fuzzy Hash: 9feb2f6085af5a8b024ba5244f206146ce975ac7a9d5adcf9a00534459b24a1c
Instruction Fuzzy Hash: 5A017930604204AADB11EB73DC47FDA3798DB49709F6089BBB504B62E2DBBC9D04D55C

Uniqueness

Uniqueness Score: -1.00%

Function 0047D800 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047DA4C,00000000,0047DC4C), ref: 0047D845

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047D815

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 8582a0812e687b99b4010e427de3579a0a85b4eba5dd20bce05beee30ead869a
Instruction ID: 9e1ac37bc360ea69ca44dde089ba04ba4b826bb97de6a423fadd5e819c649f8f
Opcode Fuzzy Hash: 8582a0812e687b99b4010e427de3579a0a85b4eba5dd20bce05beee30ead869a
Instruction Fuzzy Hash: 09F08231B04114A7DB00B69A9C42BAEA7AC8F84758F20807BF519EB242D9B99E0143AD

Uniqueness

Uniqueness Score: -1.00%

Function 0042E26C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042E286

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: ba599b357b8d4751e1ab922ebb55064d8a8854d38c942fc45e646e4ab9ecaa7b
Instruction ID: 65e6a506820a5022674633d18044d67bbd02e357da0c4a821f6ebd0b5300d4b8
Opcode Fuzzy Hash: ba599b357b8d4751e1ab922ebb55064d8a8854d38c942fc45e646e4ab9ecaa7b
Instruction Fuzzy Hash: B7D09272910228BBAB009A89DC41DFB77ADDB1A760F80806AF91897241D2B4AC519BF4

Uniqueness

Uniqueness Score: -1.00%

Function 0047F778 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047FA57,?,-0000001A,00481956,-00000010,?,00000004,0000001C,00000000,00481CA3,?,0045E364), ref: 0047F7EE

Part of subcall function 0042E76C: GetDC.USER32(00000000), ref: 0042E77B
Part of subcall function 0042E76C: EnumFontsA.GDI32(?,00000000,0042E758,00000000,00000000,0042E7C4,?,00000000,00000000,?,?,00000001,00000000,00000002,00000000,00482671), ref: 0042E7A6
Part of subcall function 0042E76C: ReleaseDC.USER32(00000000,?), ref: 0042E7BE

SendNotifyMessageA.USER32(00010446,00000496,00002711,-00000001), ref: 0047F9BE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: f63ddfb2871cf1e66e6cb65ad1930d9627398cbe91e727e5a4f1e93d11453290
Instruction ID: 2351f95844d6f0f86e4a4553bb1ee5652cba21286aa46acec5315b7e6dd2a420
Opcode Fuzzy Hash: f63ddfb2871cf1e66e6cb65ad1930d9627398cbe91e727e5a4f1e93d11453290
Instruction Fuzzy Hash: 865196B46001009BD710FF26D98179A37A9EB54309B50C53BA4099F3A7CB3CED4ACB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0042E050 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042E188), ref: 0042E08C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042E188), ref: 0042E0FC

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fb659fd4e3abd397cfb8b0300bb5eb5c22831bf077ba98013b241e0a6da047f3
Instruction ID: f9a1da9ca9b7937b0bb3d9b331acc3eaa2fb365deabda7ea02547e95fe34f262
Opcode Fuzzy Hash: fb659fd4e3abd397cfb8b0300bb5eb5c22831bf077ba98013b241e0a6da047f3
Instruction Fuzzy Hash: 77415E71E00129ABDB11DF92D881BBFB7B9EB01704F944576E814F7281D778AE01CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042E310 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042E426,?,?,00000008,00000000,00000000,0042E453), ref: 0042E3BC
RegCloseKey.ADVAPI32(?,0042E42D,?,00000000,00000000,00000000,00000000,00000000,0042E426,?,?,00000008,00000000,00000000,0042E453), ref: 0042E420

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: 8e38e26ea7d12c4b22edeb5b587879abd38fc7d3cd9d2886f944fb4bc6bb0f2e
Instruction ID: a18f9d464683a8b418f1d9d9c182c699679c3713f239d59a614a00dbe2042668
Opcode Fuzzy Hash: 8e38e26ea7d12c4b22edeb5b587879abd38fc7d3cd9d2886f944fb4bc6bb0f2e
Instruction Fuzzy Hash: 3E318670B04254AFDB11EBA3EC52BBFBBB9EB45305F90447BE500B3291D6785E01CA29

Uniqueness

Uniqueness Score: -1.00%

Function 0049736C Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00496DF0: GetDC.USER32(00000000), ref: 00496E01
Part of subcall function 00496DF0: SelectObject.GDI32(00000000,00000000), ref: 00496E23
Part of subcall function 00496DF0: GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,004973A1), ref: 00496E37
Part of subcall function 00496DF0: GetTextMetricsA.GDI32(00000000,?), ref: 00496E59
Part of subcall function 00496DF0: ReleaseDC.USER32(00000000,00000000), ref: 00496E76

MulDiv.KERNEL32(?,?,00000006), ref: 004973E3
MulDiv.KERNEL32(?,?,0000000D), ref: 004973F8

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Text$ExtentMetricsObjectPointReleaseSelect
String ID:
API String ID: 844173074-0
Opcode ID: fca75c916b54703d812863fd5a64648230285fda38564a72a06a26571747fd25
Instruction ID: 2ab63df33d73f289ec64bd0c8ef61f719fd54a594f647403259fc708cc79ea48
Opcode Fuzzy Hash: fca75c916b54703d812863fd5a64648230285fda38564a72a06a26571747fd25
Instruction Fuzzy Hash: E821D6313002009FDB50DF69C8C5EA637A5EB89314F1846B9FD18CF39ADB25EC048BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00452F2C Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,00458A74,00000000,00458A5C,?,?,?,00000000,00452FA6,?,?,?,00000001), ref: 00452F80
GetLastError.KERNEL32(00000000,00000000,?,?,00458A74,00000000,00458A5C,?,?,?,00000000,00452FA6,?,?,?,00000001), ref: 00452F88

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: 1398244007b20135f5cbcb84ec70d62da1e947103cbbdaeddf7845a69a56a8f1
Instruction ID: 1642ece03f316e66375c060ca7626bc18a341a32778e3b1f8c5ba0bc81bd916e
Opcode Fuzzy Hash: 1398244007b20135f5cbcb84ec70d62da1e947103cbbdaeddf7845a69a56a8f1
Instruction Fuzzy Hash: E7112772A04208AF8B40DEA9ED41D9FB7ECEB4E310B11456BBD08D3241D678AD159B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040B228 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040B242
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B39F,00000000,0040B3B7,?,?,?,00000000), ref: 0040B253

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: ccfb53ccaaecadb89aef38a6b87b21aaaa45f6b87b20848e9e6dd1c8ee0e0d8f
Instruction ID: 99f6b945ddddc3ffa7954b5b99b0f089effa67c77682540e1bcd22500dccd1d0
Opcode Fuzzy Hash: ccfb53ccaaecadb89aef38a6b87b21aaaa45f6b87b20848e9e6dd1c8ee0e0d8f
Instruction Fuzzy Hash: 9101F7717043006FE700EF69DC52D1A77ADDB89718711807AF500EB2D0D63D9C0196AD

Uniqueness

Uniqueness Score: -1.00%

Function 0041F2F4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F343
EnumThreadWindows.USER32(00000000,0041F2A4,00000000), ref: 0041F349

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 26a01034718a754fac2428515d88d868d648ddf0343dd67eaafc6563d075de98
Instruction ID: ded2603fe903b3ccb75c053802ed51acc4a1ef0e0cc57bb05547c7342bcbb188
Opcode Fuzzy Hash: 26a01034718a754fac2428515d88d868d648ddf0343dd67eaafc6563d075de98
Instruction Fuzzy Hash: B2016D74A04B08BFD301CF66ED1195ABBF8F749724B22C877E854D3AA0E73459119E58

Uniqueness

Uniqueness Score: -1.00%

Function 004533C4 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00453406
GetLastError.KERNEL32(00000000,00000000,00000000,0045342C), ref: 0045340E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 1548faf8a9677bd12e98f2e2d243f9d82652a592f520366f9bcd72908c48431c
Instruction ID: 0cc30b72992c59045a3cb8216ce3619e412531a307d766600c380e57d1775dbb
Opcode Fuzzy Hash: 1548faf8a9677bd12e98f2e2d243f9d82652a592f520366f9bcd72908c48431c
Instruction Fuzzy Hash: 6101D671B04204BB8701EFB9AC4249EB7ECDB49766760457BFC04E3242EA789F088558

Uniqueness

Uniqueness Score: -1.00%

Function 00452EB4 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00452F13), ref: 00452EED
GetLastError.KERNEL32(00000000,00000000,00000000,00452F13), ref: 00452EF5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7cb2c570ac219d0ee22c88f96f5bf87a62d98c3fd0f6f1ca7cf3871b5df67843
Instruction ID: 89335b5e5455deb896f2d2efe83bb95299e3db0618b413de6719cdd134c6b725
Opcode Fuzzy Hash: 7cb2c570ac219d0ee22c88f96f5bf87a62d98c3fd0f6f1ca7cf3871b5df67843
Instruction Fuzzy Hash: CEF02872A04304BBCB01EF75AD0259EB3E8DB0A321B5045BBFC04E3282E7B94E049698

Uniqueness

Uniqueness Score: -1.00%

Function 00453224 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00453283,?,?,00000000), ref: 0045325D
GetLastError.KERNEL32(00000000,00000000,00453283,?,?,00000000), ref: 00453265

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 93a4445a77e87f832db48cc37b7d9a5725dfb79c3c3b600bc74ddeadc40bd50e
Instruction ID: 5db4c9d18fff2c699384bf48158aad256892f70ed416b0cdc9347702aa33957f
Opcode Fuzzy Hash: 93a4445a77e87f832db48cc37b7d9a5725dfb79c3c3b600bc74ddeadc40bd50e
Instruction Fuzzy Hash: D5F0FC71A04B04ABCB10DFB9AD4249DB3A8DB49766B5046FBFC14E3682DB785F04859C

Uniqueness

Uniqueness Score: -1.00%

Function 0042368C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423699
LoadCursorA.USER32(00000000,00000000), ref: 004236C3

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: f140cec9cfa9b30dc2305244e4258a11cf30c4d8c1b352010c949b8b0dda8ca8
Instruction ID: 05fd857f6409e6a60644ea24615d01c87e42662e453bf4d6e4e1dfbb00014e4e
Opcode Fuzzy Hash: f140cec9cfa9b30dc2305244e4258a11cf30c4d8c1b352010c949b8b0dda8ca8
Instruction Fuzzy Hash: F2F0A7517002107ADA205E3E6CC0A2A72ADCBC1735B61437BFA2AE73D1C72D5D45556D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E7E4 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E7EE
LoadLibraryA.KERNEL32(00000000,00000000,0042E838,?,00000000,0042E856,?,00008000), ref: 0042E81D

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b4fdb90dd8f6dfc429e23110810c204407b66d19ffb3595c1bc568b2ae7c347
Instruction ID: 76a16bdd6934cf9e499703eeb82aeaab1faf94a78ecb328ba4f7015bbedd62a6
Opcode Fuzzy Hash: 9b4fdb90dd8f6dfc429e23110810c204407b66d19ffb3595c1bc568b2ae7c347
Instruction Fuzzy Hash: 13F08270B14744BEDB116F779C6282BBBECE749B1079348B6F800A3A91E63C4C10C968

Uniqueness

Uniqueness Score: -1.00%

Function 0047DB95 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(0049BD54,00008000,00000000,?), ref: 0047DBA5
757283B0.OLE32(?,0047DBE8), ref: 0047DBDB

Strings

Failed to get path of 64-bit Common Files directory, xrefs: 0047DB18
Common Files, xrefs: 0047DAB1
cmd.exe, xrefs: 0047DC06
SystemDrive, xrefs: 0047D9DF
Failed to get path of 64-bit Program Files directory, xrefs: 0047DAE9
CommonFilesDir, xrefs: 0047DA7A, 0047DAF6
COMMAND.COM, xrefs: 0047DC27
\Program Files, xrefs: 0047DA67
ProgramFilesDir, xrefs: 0047DA40, 0047DAC7

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: 757283FolderKnownPath
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 733073498-544719455
Opcode ID: 40c9fceec1849ef55c2d9e9b165fa2d81ca6f89bfe3325e062340eef34f4dc70
Instruction ID: 547cb950fcd41f41a68947569da9652c82defc7c7397c5e87919afd81bca1a0c
Opcode Fuzzy Hash: 40c9fceec1849ef55c2d9e9b165fa2d81ca6f89bfe3325e062340eef34f4dc70
Instruction Fuzzy Hash: F5E06534714640BEEB119A619D12B5977B8EB85B04FB28476F50496690D678A9009A18

Uniqueness

Uniqueness Score: -1.00%

Function 0041F444 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F45E
EnumThreadWindows.USER32(00000000,0041F3E0,00000000), ref: 0041F464

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 714e2587f2e5118136e687c91d65361c8421099981035becec4dff953f00131f
Instruction ID: 68741bc32d62e3c0e2143af6d8bcd4559dc66fbf958b0e80957fbdef8d5f35d8
Opcode Fuzzy Hash: 714e2587f2e5118136e687c91d65361c8421099981035becec4dff953f00131f
Instruction Fuzzy Hash: 92E04CB1A00600AFDB10EF35FF4575A37E4E720718F16483BA884D21A1D3745844DA9C

Uniqueness

Uniqueness Score: -1.00%

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7e62aa1badbe9b7bec7abb2084251aae76f03f49734707af951965b808a3b35c
Instruction ID: a6323659c4e3f22e280215c11bf30f87fcb27bed7f3312751ebcd43238c0638b
Opcode Fuzzy Hash: 7e62aa1badbe9b7bec7abb2084251aae76f03f49734707af951965b808a3b35c
Instruction Fuzzy Hash: CCF08272A0063067EB60596A4C81B5359849BC5794F154076FD09FF3E9D6B58C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 00408A2C Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408B62), ref: 00408A4B

Part of subcall function 0040723C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00407259

Part of subcall function 004089B8: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049D4C4,00000001,?,00408A83,?,00000000,00408B62), ref: 004089D6

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: bb57ecfbcf6c99401787c1e244de85808a7a992296f2a947b18206caa06ad51e
Instruction ID: 2280d21d464d6860fad4d2303e4b2489916fa30e512bd771d5ffef80d8a4ef38
Opcode Fuzzy Hash: bb57ecfbcf6c99401787c1e244de85808a7a992296f2a947b18206caa06ad51e
Instruction Fuzzy Hash: F6315275E001099BCF00EF95C8819EEB779EF84314F51857BE815BB385E738AE058B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041FFEC Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 00420089

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: 3edf798da742a1a67383ead948891c4ca252191c32eeff7b634738f170ced4ea
Instruction ID: a69ccf46589f52d523cedfa5b555af8e95575bce60e7416ef6aeac4177a5bf43
Opcode Fuzzy Hash: 3edf798da742a1a67383ead948891c4ca252191c32eeff7b634738f170ced4ea
Instruction Fuzzy Hash: BA2151B1604755AFD340DF39A440767BBE4BB48344F04892EE098C3342E775E995CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0046D110 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041F2F4: GetCurrentThreadId.KERNEL32 ref: 0041F343
Part of subcall function 0041F2F4: EnumThreadWindows.USER32(00000000,0041F2A4,00000000), ref: 0041F349

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046D16E,?,00000000,?,?,0046D380,?,00000000,0046D3F4), ref: 0046D152

Part of subcall function 0041F3A8: IsWindow.USER32(?), ref: 0041F3B6
Part of subcall function 0041F3A8: EnableWindow.USER32(?,00000001), ref: 0041F3C5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: 9f032309dcde971134040d123568164e642ddd2cabc1e4735cf40f63c5ed8cf9
Instruction ID: b16b0b1c8f0f43ce2eded6e4310be42afa410753b2a581968e322ef2fdc8cd52
Opcode Fuzzy Hash: 9f032309dcde971134040d123568164e642ddd2cabc1e4735cf40f63c5ed8cf9
Instruction Fuzzy Hash: EFF0BEB1B08344BFFB05DB72EC56B6AB7A8E30A714F61447BF404861A0EAF95840852E

Uniqueness

Uniqueness Score: -1.00%

Function 004169A0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 004169D5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 055c9416affa8369aca5a52daf2b71abecd104a899c95fff13876bf4c34adbe4
Instruction ID: 76b9729045c620b17443a4bfae3f317f1f80b082859ffabd1d53e10c409eed5a
Opcode Fuzzy Hash: 055c9416affa8369aca5a52daf2b71abecd104a899c95fff13876bf4c34adbe4
Instruction Fuzzy Hash: FEF025B2600510AFDB84CF9CD8C0F9373ECEB0C210B0881A6FA08CF21AD220EC108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00414E04 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 00414E3F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00450F08 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450F48

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 00d3b0e571f0f9799c9202ce425a31b8579894210baf7755ca9a5e27d392a7a4
Instruction ID: 8219f7e09200e9d280371fd8822ce49b3febf2e1364c7dcaf59ee2aef9f1cf3d
Opcode Fuzzy Hash: 00d3b0e571f0f9799c9202ce425a31b8579894210baf7755ca9a5e27d392a7a4
Instruction Fuzzy Hash: E2E0EDB53541483ED6809AAD7D42F9667DCD71A724F008033B998D7241D5619D158BE8

Uniqueness

Uniqueness Score: -1.00%

Function 0042D11C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042D164,?,00000001,?,?,00000000,?,0042D1B6,00000000,00453169,00000000,0045318A,?,00000000), ref: 0042D147

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 52a97f63493a2405b18f7ceeeb4c5583b1fc3ffb9d272bcba16263c996160de7
Instruction ID: 9806b9c164805e7544688198397d180b04c1e4ca63c7d3d80aa3ce68cdb407ca
Opcode Fuzzy Hash: 52a97f63493a2405b18f7ceeeb4c5583b1fc3ffb9d272bcba16263c996160de7
Instruction Fuzzy Hash: 74E09271704704BFD701EF62DC53E6BBBECDB89B18BA14876B400E7692D6789E10D468

Uniqueness

Uniqueness Score: -1.00%

Function 0042ED18 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004539D7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042ED37

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 09ac2101c8e17b0b2705a927b8a5b1ff093a5eaf49e610a8aec8846a662564db
Instruction ID: 20bfa46e39afc277729b0f592bdc1926ad718625f52f7f76be7811270f12921f
Opcode Fuzzy Hash: 09ac2101c8e17b0b2705a927b8a5b1ff093a5eaf49e610a8aec8846a662564db
Instruction Fuzzy Hash: 0DE0206179471216F2351416AC47B77530E43C0704F944436BF50DD3E3D6AED906465E

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3C0 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetTextExtentPointA.GDI32(?,00000000,00000000), ref: 0041B3EB

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ExtentPointText
String ID:
API String ID: 566491939-0
Opcode ID: 4f1fa0a02a33453e16a3ac25b8454f07757e9b35dd03f569d85e1fff26693cf1
Instruction ID: 82af27fd8798cce69ff4cfc8f8e0108cf3890269a8c20ce36369b0e760b6a7da
Opcode Fuzzy Hash: 4f1fa0a02a33453e16a3ac25b8454f07757e9b35dd03f569d85e1fff26693cf1
Instruction Fuzzy Hash: 01E086B13086506B9600E67E1DC18DB67DCCA49329314817AF858E7393D728DE1143EE

Uniqueness

Uniqueness Score: -1.00%

Function 004062F8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,00423ACC,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C), ref: 00406321

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9dc46ec25ca5ecaaaae1fbad39bdca196911fb58cef97937ba07dcb482697fa8
Instruction ID: 1e3b386673cc32b76f3712ab4659b14af7d7742474b1f2ca80afcc4f691b27f6
Opcode Fuzzy Hash: 9dc46ec25ca5ecaaaae1fbad39bdca196911fb58cef97937ba07dcb482697fa8
Instruction Fuzzy Hash: 26E002B221430DBFDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972528675AC608B71

Uniqueness

Uniqueness Score: -1.00%

Function 0042E234 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042E260

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5347a797c781b98567e2e52ffd135a3f9820974f1ad95a252eafdff03c881ffc
Instruction ID: 1b6ad3e9ff9242377371a87229ab788a86a92e19cf0220c3a89558970fe9bf90
Opcode Fuzzy Hash: 5347a797c781b98567e2e52ffd135a3f9820974f1ad95a252eafdff03c881ffc
Instruction Fuzzy Hash: 58E07EB6600119AF9B40DE8DDC81EEB37ADAB5D360F444016FA48E7200C2B8EC519BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00455360 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0047194C,00000000,00472768,?,00000000,004727B1,?,00000000,004728EA,?,00000000,?,00000000,I), ref: 00455376

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 2037d152b961654d0701826464360efc1bc8af66d82e3674caf93459437a3ed2
Instruction ID: 8b71881552422ad0faea9fb58b8cbe3f8cf10286c40a53e64c89ff98b22cfa58
Opcode Fuzzy Hash: 2037d152b961654d0701826464360efc1bc8af66d82e3674caf93459437a3ed2
Instruction Fuzzy Hash: 74E09BB0504A004BC714DF7A848132A77D15F84321F04C96ABC9CCB7D7E67C84154667

Uniqueness

Uniqueness Score: -1.00%

Function 00414ACC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(004972CE,?,004972F0,?,?,00000000,004972CE,?,?), ref: 00414AEB

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00407360 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00407374

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3a95ec999e214528a4642a0263e4bef887c4bff4fae810559ecd64d74c978ed9
Instruction ID: 7137799a8a619894c36928dc497025c8ae4ce5b7c347e91e7b4e2a044eac2fb2
Opcode Fuzzy Hash: 3a95ec999e214528a4642a0263e4bef887c4bff4fae810559ecd64d74c978ed9
Instruction Fuzzy Hash: CFD05B723082507BE320A55B5C44EAB6BDCCBC5774F10063EF958D31C1D6349C01C675

Uniqueness

Uniqueness Score: -1.00%

Function 00423A9C Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423A48: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 00423A5D

ShowWindow.USER32(004108B0,00000009,?,00000000,0041F1F4,00423D8A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C), ref: 00423AB7

Part of subcall function 00423A78: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423A94

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: b1c2cd61143bf12a0bef37db47b635a6d3ef0f027e429c080d83374e888f6fa5
Instruction ID: b4979a057c5364df20928e0f8112b75834207fc47edce7a1cb621b48fadbe9ee
Opcode Fuzzy Hash: b1c2cd61143bf12a0bef37db47b635a6d3ef0f027e429c080d83374e888f6fa5
Instruction Fuzzy Hash: E4D0A7137811703143117BB738469BF46EC4DD26AB38808BBB5C0DB303E91E8E051278

Uniqueness

Uniqueness Score: -1.00%

Function 00424714 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 0042472C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 0f798d55b4a563aaf07053da431746ff1fcbe1b34a54896860b3a53b831deb59
Instruction ID: 0401e0c0b6f3d46f422729750133087b7afca2a32056b90ced50410e3746bfe3
Opcode Fuzzy Hash: 0f798d55b4a563aaf07053da431746ff1fcbe1b34a54896860b3a53b831deb59
Instruction Fuzzy Hash: 17D05EE27011602BCB01BAAD54C4ACA67CC8B8936AB1440BBF908EF257C638CE458398

Uniqueness

Uniqueness Score: -1.00%

Function 0042D1BC Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00453399,00000000,004533B2,?,-00000001,00000000), ref: 0042D1C7

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7c6ebe174506a89767f7ee592df00eb0c72a5955deab68b848f445c8102e14c6
Instruction ID: bf35e0695d646f252302ae8c05399a3b1551c06c76099583daea3b520eb86f7d
Opcode Fuzzy Hash: 7c6ebe174506a89767f7ee592df00eb0c72a5955deab68b848f445c8102e14c6
Instruction Fuzzy Hash: 3ED022D071121001DE10A0BC28C533711880B74336BA41A33BD69E26E3C33D8823542C

Uniqueness

Uniqueness Score: -1.00%

Function 0042D174 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00451D0F,00000000), ref: 0042D17F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 176281895ea3e42f60d60676608de6346bb49bc8ae14b0fa01ac27964d7a3955
Instruction ID: 86baad2ceceaa6a85e65f17f0286784d9b66173697f2cc348ab0aa8737b1e759
Opcode Fuzzy Hash: 176281895ea3e42f60d60676608de6346bb49bc8ae14b0fa01ac27964d7a3955
Instruction Fuzzy Hash: C9C080D0711210155E10A5BD1CC556703C849543793540F37B068D66D2D13D8466202C

Uniqueness

Uniqueness Score: -1.00%

Function 004677CC Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00468491,00000000,00000000,00000000,0000000C,00000000), ref: 004677E4

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00407310 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040AB24,0040D0D0,?,00000000,?), ref: 0040732D

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 209b0ba7fd8c5b4a24ef9a539f4d873392a5060120ce01350303422817e34c0d
Instruction ID: a78e408fffc15bc8d0ee8a54c686fbaa4e2694f5c3f88f37cecd524e454749ad
Opcode Fuzzy Hash: 209b0ba7fd8c5b4a24ef9a539f4d873392a5060120ce01350303422817e34c0d
Instruction Fuzzy Hash: ADC048B13C130032F93025A61C87F1604889714B1AE60943AB740BE1C2D8E9A818016C

Uniqueness

Uniqueness Score: -1.00%

Function 0041F7EC Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,00000000), ref: 0041F800

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction ID: 48f25c4fc7afed193c39a16cc91a0304f94a1296cd048c63733264e3b5f0309e
Opcode Fuzzy Hash: aa2ab5d04534ce78fd06398472ac87fc8e200d4b6eb1d54961e47d4e7a3c3f50
Instruction Fuzzy Hash: D2D0C932100108AFDB018E94AC018677B69EB48210B148815FD0485221D633E831AA91

Uniqueness

Uniqueness Score: -1.00%

Function 004504A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,004506B4,00000000,?,00469063,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 004504C6

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 26d24d78127bedaa8bd94fa6176c523188c8219f80ea813ea250164edc493aa3
Instruction ID: d31243997fce6a081680f754dd08e5339b9cfa2d37494deb9f472b2c5ff9ad0f
Opcode Fuzzy Hash: 26d24d78127bedaa8bd94fa6176c523188c8219f80ea813ea250164edc493aa3
Instruction Fuzzy Hash: 1AD092B1925244AECB10AB26EA0430232B0E364316F404037E60095163C33988958F8C

Uniqueness

Uniqueness Score: -1.00%

Function 00451070 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045CB3E,00000000,0045CCC9,?,00000000,00000002,00000002), ref: 00451077

Part of subcall function 00450DF8: GetLastError.KERNEL32(00450C14,00450EBA,?,00000000,?,00499714,00000001,00000000,00000002,00000000,00499875,?,?,00000005,00000000,004998A9), ref: 00450DFB

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 46bffcc4190b32f1737510e309765b0f9d847fb6a3bc417c92e668a4702f1f8e
Instruction ID: c64e7bd530bf7aca0fb3f38fdfe864b922b4b7832701085435935f337d1370ec
Opcode Fuzzy Hash: 46bffcc4190b32f1737510e309765b0f9d847fb6a3bc417c92e668a4702f1f8e
Instruction Fuzzy Hash: 0BC04CA5340140578F40A6AE85C1A1663DC9E193493504066B904DF657D669D8484A15

Uniqueness

Uniqueness Score: -1.00%

Function 004073A0 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,0049D62C,00499FD9,00000000,0049A02E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073AB

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 591f449e1d77daae53b1a5aa43bd251db5a728a4dd1e5d8efdcf407e7d8efb90
Instruction ID: b32d93fc701aa1162a174406e7d11ef14f94d69b7075bb962530761d6eacc69a
Opcode Fuzzy Hash: 591f449e1d77daae53b1a5aa43bd251db5a728a4dd1e5d8efdcf407e7d8efb90
Instruction Fuzzy Hash: 5BB012E13D320A26CA0079FE4CC191B00CC46297063405A3A3406E71C3DC3CC8180414

Uniqueness

Uniqueness Score: -1.00%

Function 004076F8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,004996A2,00000000,00499875,?,?,00000005,00000000,004998A9,?,?,00000000), ref: 00407703

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: f8e5bc84ed77a990345a18ebfce7b3b4d36d471a9523976a67f94f28f3ebd8b5
Instruction ID: c18bf430a4858a09d5fd0626d157798880aaaa8ea81a5298b6cf69089c3012d4
Opcode Fuzzy Hash: f8e5bc84ed77a990345a18ebfce7b3b4d36d471a9523976a67f94f28f3ebd8b5
Instruction Fuzzy Hash: B0B012E03D161B27CA0079FE4CC191A01CC46292163501B3A3006E71C3D83CC8080514

Uniqueness

Uniqueness Score: -1.00%

Function 0047E3D0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00482E1B), ref: 0047E3E6

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 6c53cdab159c99083d4d98b8786732a30233f1b333e0139ad3d8075ed81d35ad
Instruction ID: be2fe49a244c431ec9946715e535269e6deba234050b303873a188c7b9bcae40
Opcode Fuzzy Hash: 6c53cdab159c99083d4d98b8786732a30233f1b333e0139ad3d8075ed81d35ad
Instruction Fuzzy Hash: C5C00271511210AED750DFBA9D4C75637D4A71832AF068477F40CC3160F6344840CB09

Uniqueness

Uniqueness Score: -1.00%

Function 0042E83F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E85D), ref: 0042E850

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: bbf0f8014a804afebd1604ab393a38912dcaab738292d82ddfa54d7cc6c30dd0
Instruction ID: 289f6c2202f902c5fbbb0b24ee8d848b414576690a26c35d590b8c03c3951524
Opcode Fuzzy Hash: bbf0f8014a804afebd1604ab393a38912dcaab738292d82ddfa54d7cc6c30dd0
Instruction Fuzzy Hash: A7B09B76B0C6005DF705D6D5745152D63D4D7C57203E1457BF454D35C0D93C58004918

Uniqueness

Uniqueness Score: -1.00%

Function 00416A3C Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 00416A43

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 7c218e59c1dd1ff03dc8e849b9cf22d0cf8864dd38f6abff84783c2b34ac62d8
Instruction ID: 951f12253bcdbe2be33f1d7372765b1b3ebb510443260a24e1bbd496af9ec3c9
Opcode Fuzzy Hash: 7c218e59c1dd1ff03dc8e849b9cf22d0cf8864dd38f6abff84783c2b34ac62d8
Instruction Fuzzy Hash: AFA002755015409ADB10E7A5C84DF7A2298BF44204FD905FA714CA7052C53CD9008A55

Uniqueness

Uniqueness Score: -1.00%

Function 0047F09C Relevance: 1.4, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047F287,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047F241

Part of subcall function 0042CE50: GetSystemMetrics.USER32(0000002A), ref: 0042CE62

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ByteCharMetricsMultiSystemWide
String ID:
API String ID: 224039744-0
Opcode ID: f52afbad91b667b6f6308f5f7be5f2f829de3790a0e249e9b62606124138a6e4
Instruction ID: 496bb1a5f94cf580fd05206e04ab07141ed402b11bdf28edaa456749bafa96dd
Opcode Fuzzy Hash: f52afbad91b667b6f6308f5f7be5f2f829de3790a0e249e9b62606124138a6e4
Instruction Fuzzy Hash: 1D51B670600245FFDB10DFA6D884B9AB7F8EB19308F518077E804A73A2D778AD49CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041F814 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041F1F4,?,00423CDF,0042405C,0041F1F4), ref: 0041F832

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3cd9b2b82d3c03bb1042e3aec431f22b9c9f9b479e5e8d2dc048638413a345c3
Instruction ID: 12b252a98648104a36852bc9e66bdd9c626d3d2234b6f24232172dde86ff5d2a
Opcode Fuzzy Hash: 3cd9b2b82d3c03bb1042e3aec431f22b9c9f9b479e5e8d2dc048638413a345c3
Instruction Fuzzy Hash: FA1148746007059BCB10DF19C880B82FBE4EB98350F10C53AE9588B385D374E849CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c75a05877fa6d12c6d50048bf692a8cb9b872a1b30c0c7aeae6369689fd3dcf9
Instruction ID: 191f0f4b7cd680364798b3dc381f6aadc2f07e0dbee61be3c45a65ffd8c3a871
Opcode Fuzzy Hash: c75a05877fa6d12c6d50048bf692a8cb9b872a1b30c0c7aeae6369689fd3dcf9
Instruction Fuzzy Hash: 9E01FC766442148FC3109E29DCC0E2677E8D794378F15453EDA85673A1D37A7C4187D8

Uniqueness

Uniqueness Score: -1.00%

Function 00453708 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00453771), ref: 00453753

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 23d18d59897e39bc4499862bac3fc6016057085f4d4fb8d535a9825dcce29caf
Instruction ID: c77a4f58350eb22b54b4dfaca8229fa0e9126d3262ef2898ea61e0989ca8d5dd
Opcode Fuzzy Hash: 23d18d59897e39bc4499862bac3fc6016057085f4d4fb8d535a9825dcce29caf
Instruction Fuzzy Hash: 24014CB5A042046B8701DF69A8114AEFBE8DB4D3617208277FC64D3342D7345E059764

Uniqueness

Uniqueness Score: -1.00%

Function 00401340 Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000644,?,0049D450,004013A3,?,?,00401443,?,?,?,?,?,00401983), ref: 00401353

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 78b51a20f87013a2b8d738b98d0019fb6e38c968b046018860c7d69c9a759dbb
Instruction ID: 3837c305931925427e5917c24a6cbe5f1a74ecb476a9df88ea36e45ee8dad041
Opcode Fuzzy Hash: 78b51a20f87013a2b8d738b98d0019fb6e38c968b046018860c7d69c9a759dbb
Instruction Fuzzy Hash: 0CF05E71B012018FE724CF29D880656B7E1EBA9365F20807EE5C5D7760D3359C418B54

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041F568 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00419440,00000000,?,?,?,00000001), ref: 0041F576
SetErrorMode.KERNEL32(00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F592
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F59E
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00419440,00000000,?,?,?,00000001), ref: 0041F5AC
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F5DC
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F605
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F61A
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F62F
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F644
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F659
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F66E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F683
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F698
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F6AD
FreeLibrary.KERNEL32(00000001,?,00419440,00000000,?,?,?,00000001), ref: 0041F6BF

Strings

Ctl3dCtlColorEx, xrefs: 0041F64E
CTL3D32.DLL, xrefs: 0041F599
BtnWndProc3d, xrefs: 0041F6A2
Ctl3dSubclassCtl, xrefs: 0041F60F
Ctl3dUnAutoSubclass, xrefs: 0041F678
Ctl3dSubclassDlgEx, xrefs: 0041F624
Ctl3dAutoSubclass, xrefs: 0041F663
Ctl3dDlgFramePaint, xrefs: 0041F639
Ctl3dUnregister, xrefs: 0041F5FA
Ctl3DColorChange, xrefs: 0041F68D
Ctl3dRegister, xrefs: 0041F5D1

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 7f93fe397e684a103bce9d62382bab99a389729839f73a4ae53f62d0e5e878ce
Instruction ID: 05ddd3b6a7babc3b5f2b58818bfec20f43c940fb7309246182468bed43dc01b1
Opcode Fuzzy Hash: 7f93fe397e684a103bce9d62382bab99a389729839f73a4ae53f62d0e5e878ce
Instruction Fuzzy Hash: C93104B1A00604BBD710EF75BD46A6933A4F728B28B59093BB148D71A2E77C9C468F5C

Uniqueness

Uniqueness Score: -1.00%

Function 00458DC4 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00458E2B
QueryPerformanceCounter.KERNEL32(00000000,00000000,004590BE,?,?,00000000,00000000,?,004597BA,?,00000000,00000000), ref: 00458E34
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 00458E3E
GetCurrentProcessId.KERNEL32(?,00000000,00000000,004590BE,?,?,00000000,00000000,?,004597BA,?,00000000,00000000), ref: 00458E47
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00458EBD
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 00458ECB
CreateFileA.KERNEL32(00000000,C0000000,00000000,0049BB24,00000003,00000000,00000000,00000000,0045907A), ref: 00458F13
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00459069,?,00000000,C0000000,00000000,0049BB24,00000003,00000000,00000000,00000000,0045907A), ref: 00458F4C

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458FF5
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045902B
CloseHandle.KERNEL32(000000FF,00459070,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00459063

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

64-bit helper EXE wasn't extracted, xrefs: 00458E1F
i, xrefs: 00458FA8
CreateFile, xrefs: 00458F21
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00458E93
SetNamedPipeHandleState, xrefs: 00458F55
helper %d 0x%x, xrefs: 00458FD4
CreateProcess, xrefs: 00458FFE
Cannot utilize 64-bit features on this version of Windows, xrefs: 00458E0C
Starting 64-bit helper process., xrefs: 00458DF9
CreateNamedPipe, xrefs: 00458EDB
Helper process PID: %u, xrefs: 00459048
D, xrefs: 00458F6E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 588258891636d6961f6f973a73ca3d63e7b3c2cb37b3ea655e6ca71426862519
Instruction ID: c4bf9a6304175502231bb311a6f33329fdfd9ee29416440b986483e0f2b1c780
Opcode Fuzzy Hash: 588258891636d6961f6f973a73ca3d63e7b3c2cb37b3ea655e6ca71426862519
Instruction Fuzzy Hash: 9071F270A00654DADB10DF65CC46B9E7BF8EB05705F1045AAF908FB282DB785D448F69

Uniqueness

Uniqueness Score: -1.00%

Function 0047974C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 004795B8: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,022A79F0,?,?,?,022A79F0,0047977C,00000000,0047989A,?,?,?,?), ref: 004795D1
Part of subcall function 004795B8: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004795D7
Part of subcall function 004795B8: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022A79F0,?,?,?,022A79F0,0047977C,00000000,0047989A,?,?,?,?), ref: 004795EA
Part of subcall function 004795B8: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022A79F0,?,?,?,022A79F0), ref: 00479614
Part of subcall function 004795B8: CloseHandle.KERNEL32(00000000,?,?,?,022A79F0,0047977C,00000000,0047989A,?,?,?,?), ref: 00479632

Part of subcall function 00479690: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00479722,?,?,?,022A79F0,?,00479784,00000000,0047989A,?,?,?,?), ref: 004796C0

ShellExecuteEx.SHELL32(0000003C), ref: 004797D4
GetLastError.KERNEL32(00000000,0047989A,?,?,?,?), ref: 004797DD
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0047982A
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 0047984E
CloseHandle.KERNEL32(00000000,0047987F,00000000,00000000,000000FF,000000FF,00000000,00479878,?,00000000,0047989A,?,?,?,?), ref: 00479872

Strings

ShellExecuteEx returned hProcess=0, xrefs: 004797FE
<, xrefs: 00479793
GetExitCodeProcess, xrefs: 00479857
runas, xrefs: 004797A1
MsgWaitForMultipleObjects, xrefs: 00479837
ShellExecuteEx, xrefs: 004797EE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: f75691c6988614191e08cddca8c11734c2160cae10b5dfc7f4e0ecb506ded385
Instruction ID: ef977962423105e2be3f30a06cf623b0e2f7e3d3d4ebd630472f9d2e264b432c
Opcode Fuzzy Hash: f75691c6988614191e08cddca8c11734c2160cae10b5dfc7f4e0ecb506ded385
Instruction Fuzzy Hash: 35314471910204AADB10FFAA88416DEBAB8EF45314F51857FF518F7281D77C8D058B1A

Uniqueness

Uniqueness Score: -1.00%

Function 004187D4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004187E3
GetWindowPlacement.USER32(?,0000002C), ref: 00418800
GetWindowRect.USER32(?), ref: 0041881C
GetWindowLongA.USER32(?,000000F0), ref: 0041882A
GetWindowLongA.USER32(?,000000F8), ref: 0041883F
ScreenToClient.USER32(00000000), ref: 00418848
ScreenToClient.USER32(00000000,?), ref: 00418853

Strings

,, xrefs: 004187EC

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: b787cf8406b328f9ec3a8af6233a206f78ef01905e488829e8331a9627355685
Instruction ID: c8128d77bd0d7ceb2c04d713c679bf83e48da9b619e6265fa23865d78167b210
Opcode Fuzzy Hash: b787cf8406b328f9ec3a8af6233a206f78ef01905e488829e8331a9627355685
Instruction Fuzzy Hash: 1B111971505201ABDB00EF69C885E9B77E8AF48314F140A7EB958DB286C738D900CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0042F71C Relevance: 13.6, APIs: 9, Instructions: 108windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042F744
GetWindowLongA.USER32(?,000000F0), ref: 0042F758
GetWindowLongA.USER32(?,000000EC), ref: 0042F76F
GetActiveWindow.USER32 ref: 0042F778
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F7A5
SetActiveWindow.USER32(?,0042F8D5,00000000,?), ref: 0042F7C6

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$ActiveLong$IconicMessage
String ID:
API String ID: 1633107849-0
Opcode ID: 49306f5a5aea126db747c93f7e274e0cd8a3885b454e69ee071c1ce4e6e90790
Instruction ID: 4c2db8bb30fa69d0e852579bfabd785c91e73d104037fd1269e13a33cc275b58
Opcode Fuzzy Hash: 49306f5a5aea126db747c93f7e274e0cd8a3885b454e69ee071c1ce4e6e90790
Instruction Fuzzy Hash: 0D31B170A00654AFDB01EFB5DC52D6EBBF8EB09704B9244BBF804E7291D6389D04CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00455D80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00455D8F
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00455D95
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455DAE
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455DD5
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455DDA
ExitWindowsEx.USER32(00000002,00000000), ref: 00455DEB

Strings

SeShutdownPrivilege, xrefs: 00455DA7

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 082306ff38d6c760ea0c9f1032eabff53d8a831f0171a5046667534f49f86738
Instruction ID: 02e3d1fa5e569da00b44776faf89310fbaa28c239a726f1a6525e170f6cce7ee
Opcode Fuzzy Hash: 082306ff38d6c760ea0c9f1032eabff53d8a831f0171a5046667534f49f86738
Instruction Fuzzy Hash: 55F06871294B02BAE650A6718C1BF7B21A8DB40749F50892ABD41EA1C3D7BDD40C8A7A

Uniqueness

Uniqueness Score: -1.00%

Function 0049998C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00499ACA,?,?,00000000,0049D62C,?,00499C54,00000000,00499CA8,?,?,00000000,0049D62C), ref: 004999E3
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 00499A66
FindNextFileA.KERNEL32(000000FF,?,00000000,00499AA2,?,00000000,?,00000000,00499ACA,?,?,00000000,0049D62C,?,00499C54,00000000), ref: 00499A7E
FindClose.KERNEL32(000000FF,00499AA9,00499AA2,?,00000000,?,00000000,00499ACA,?,?,00000000,0049D62C,?,00499C54,00000000,00499CA8), ref: 00499A9C

Strings

isRS-, xrefs: 00499A03
isRS-???.tmp, xrefs: 004999CD

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 95b3f25cf4ec60d39bc400f980b771d31e145dcc29cfc9c7f6bb2460c5483c6d
Instruction ID: e7bbbac40fef3dfc3cc8058b31a588cc53a4b1370f1491e53b11de7997221e0f
Opcode Fuzzy Hash: 95b3f25cf4ec60d39bc400f980b771d31e145dcc29cfc9c7f6bb2460c5483c6d
Instruction Fuzzy Hash: 98318871A015586FDF10EF66CC41ADEBBBCDB45304F5184BBA808A32A1DA389F45CE58

Uniqueness

Uniqueness Score: -1.00%

Function 00457D90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457E0D
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457E34
SetForegroundWindow.USER32(?), ref: 00457E45
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,0045811D,?,00000000,00458159), ref: 00458108

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00457F88

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: e7ca403cd300f68bd3acf1d00117b17a139c61a2b201c170996a7922c79b85e5
Instruction ID: fc8679ff921622e129be82b5c7b8b9d6156041410e322bf9d6052ebf871bd799
Opcode Fuzzy Hash: e7ca403cd300f68bd3acf1d00117b17a139c61a2b201c170996a7922c79b85e5
Instruction Fuzzy Hash: E8911234604204DFDB15CF55D952F1ABBF9EB88700F2180BAED04AB792CB79AE05CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00418120 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041815F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 0041817D
GetWindowPlacement.USER32(?,0000002C), ref: 004181B3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 004181DA

Strings

,, xrefs: 004181A1

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 3939ae1d6e1c590614f47c3d4bcf148a2532e1c37498b01d3d2c2056b4d5783c
Instruction ID: 655d5dfc889397085a04c255a013ff48624dbcd9c32011b5bbe491b24769000a
Opcode Fuzzy Hash: 3939ae1d6e1c590614f47c3d4bcf148a2532e1c37498b01d3d2c2056b4d5783c
Instruction Fuzzy Hash: 3C211D72600204ABDF00EF69CCC1ADA77E8AF49314F55456AFD18DF246CB78D9458BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004648D0 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00464A8D), ref: 00464901
FindFirstFileA.KERNEL32(00000000,?,00000000,00464A60,?,00000001,00000000,00464A8D), ref: 00464990
FindNextFileA.KERNEL32(000000FF,?,00000000,00464A42,?,00000000,?,00000000,00464A60,?,00000001,00000000,00464A8D), ref: 00464A22
FindClose.KERNEL32(000000FF,00464A49,00464A42,?,00000000,?,00000000,00464A60,?,00000001,00000000,00464A8D), ref: 00464A3C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 9c4269f61b84920ca12822ed024a471ff72fe9e9b28da976123b0901a486667e
Instruction ID: ae00aa0afc7aa582470d59ca75ba9400823c3a1943f8949d3747a5def8a0c8eb
Opcode Fuzzy Hash: 9c4269f61b84920ca12822ed024a471ff72fe9e9b28da976123b0901a486667e
Instruction Fuzzy Hash: B541C570A00658AFDF11EFA5DC45ADEB7B8EB89305F4044BAF404E7381E63C9E488E19

Uniqueness

Uniqueness Score: -1.00%

Function 00464D4C Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00464F33), ref: 00464DC1
FindFirstFileA.KERNEL32(00000000,?,00000000,00464EFE,?,00000001,00000000,00464F33), ref: 00464E07
FindNextFileA.KERNEL32(000000FF,?,00000000,00464EE0,?,00000000,?,00000000,00464EFE,?,00000001,00000000,00464F33), ref: 00464EBC
FindClose.KERNEL32(000000FF,00464EE7,00464EE0,?,00000000,?,00000000,00464EFE,?,00000001,00000000,00464F33), ref: 00464EDA

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: bf41e3cc1b133229262ffb54fabbd49d98797372cd5bfa19d660c2805fd8b5e1
Instruction ID: 8e27f6cc4c7e55bed8f6d5ebd72a4c3c722eac7afebeb0f1b00dc6af3d7f2fe3
Opcode Fuzzy Hash: bf41e3cc1b133229262ffb54fabbd49d98797372cd5bfa19d660c2805fd8b5e1
Instruction Fuzzy Hash: 31416535A006589FCB11EFA5CD859DEB7B9FBC8305F5044AAF804E7341EB389E448E59

Uniqueness

Uniqueness Score: -1.00%

Function 0042ED84 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453683,00000000,004536A4), ref: 0042EDA6
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042EDD1
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453683,00000000,004536A4), ref: 0042EDDE
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453683,00000000,004536A4), ref: 0042EDE6
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00453683,00000000,004536A4), ref: 0042EDEC

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 060edd20a8b9ef3e5187fa71c6153c8dffa7266a06f07a40ca48e996766aa3cd
Instruction ID: d5f14a2582f403684e4f7b299b1070748df424b87161b08669007267f0031b9d
Opcode Fuzzy Hash: 060edd20a8b9ef3e5187fa71c6153c8dffa7266a06f07a40ca48e996766aa3cd
Instruction Fuzzy Hash: 21F0F0723A07203AF620B17A6C82F7F018CC784B68F10423AF704FF1D1D9A84D0515AD

Uniqueness

Uniqueness Score: -1.00%

Function 00484D28 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00484D66
GetWindowLongA.USER32(00000000,000000F0), ref: 00484D84
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049E0AC,00484242,00484276,00000000,00484296,?,?,?,0049E0AC), ref: 00484DA6
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049E0AC,00484242,00484276,00000000,00484296,?,?,?,0049E0AC), ref: 00484DBA

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 6d02ab3679acd20c13477f6129401e215db0be7c9c4dcc708735b62ecc99512f
Instruction ID: c453c85064c149f2f8de5328ae0569b6634ad2f96c4c2f1b45344ef68f201c80
Opcode Fuzzy Hash: 6d02ab3679acd20c13477f6129401e215db0be7c9c4dcc708735b62ecc99512f
Instruction Fuzzy Hash: 3D015E706002129EDB10FB769D89B9A22D95B50344F19083FB8449B2E2CB7C9841975C

Uniqueness

Uniqueness Score: -1.00%

Function 00463344 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00463418), ref: 0046339C
FindNextFileA.KERNEL32(000000FF,?,00000000,004633F8,?,00000000,?,00000000,00463418), ref: 004633D8
FindClose.KERNEL32(000000FF,004633FF,004633F8,?,00000000,?,00000000,00463418), ref: 004633F2

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 7c5a373344a681de92fecfb08138b0c42bf8f9877b9eb60383b953f92d76aded
Instruction ID: 0500e82312f9f08261d57c94a6d9b1f58695be5d4d7593f033a5dbf80f84d4fc
Opcode Fuzzy Hash: 7c5a373344a681de92fecfb08138b0c42bf8f9877b9eb60383b953f92d76aded
Instruction Fuzzy Hash: 1421DB315046886FDB11DF66CC41ADEB7ACDB49305F5084F7B808D3251EA389F44C959

Uniqueness

Uniqueness Score: -1.00%

Function 0042462C Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00424634
SetActiveWindow.USER32(?,?,?,?,0046DA13), ref: 00424641

Part of subcall function 00423A9C: ShowWindow.USER32(004108B0,00000009,?,00000000,0041F1F4,00423D8A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C), ref: 00423AB7

Part of subcall function 00423F64: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,022A25AC,0042465A,?,?,?,?,0046DA13), ref: 00423F9F

SetFocus.USER32(00000000,?,?,?,?,0046DA13), ref: 0042466E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: f6b17c850702daf3fe2f22264f5d8e983b40a127641bef431db8629b7e0b9e45
Instruction ID: 5ae1608fbac1b61a262bbd8080f57afdf1b64e8a1d97d82fcb33e84f02d7d1dc
Opcode Fuzzy Hash: f6b17c850702daf3fe2f22264f5d8e983b40a127641bef431db8629b7e0b9e45
Instruction Fuzzy Hash: DBF0D07170122187CB00BFA9D9C5A9633A8AF48714B56407BBD09DF25BC67CDC458768

Uniqueness

Uniqueness Score: -1.00%

Function 0042F254 Relevance: 4.5, APIs: 3, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(00000001,00000001), ref: 0042F261
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000001), ref: 0042F271
CreateMutexA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0042F299

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DescriptorSecurity$CreateDaclInitializeMutex
String ID:
API String ID: 3525989157-0
Opcode ID: 296a65e85b4cf530d2912259c248fa0dd98adb1b483a3bccc15e2a953cf47158
Instruction ID: b330794617a7040f76ad0da05c7b1ee5a1856395dd3e8d048ce20caf316d4231
Opcode Fuzzy Hash: 296a65e85b4cf530d2912259c248fa0dd98adb1b483a3bccc15e2a953cf47158
Instruction Fuzzy Hash: 18E0C0B16443007EE200EE758C82F5F76DCDB48714F00483AB654DB1C1E679D9489B96

Uniqueness

Uniqueness Score: -1.00%

Function 0041811E Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041815F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 0041817D
GetWindowPlacement.USER32(?,0000002C), ref: 004181B3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 004181DA

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: add44dc6c1a8246b0274be2cc60e43faf0e8d0d1d4c3491e9dc610c53a27efe0
Instruction ID: b17f17ea660f77e7302433a0225cb82371cce2f83056bcd31e3690383aca5fbc
Opcode Fuzzy Hash: add44dc6c1a8246b0274be2cc60e43faf0e8d0d1d4c3491e9dc610c53a27efe0
Instruction Fuzzy Hash: E5012C72300104BBDF10EE69CCC1EEB7798AB55364F55416AFD18DF242DA38ED8287A8

Uniqueness

Uniqueness Score: -1.00%

Function 004179E8 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417A13
GetCapture.USER32 ref: 00417A1C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 373e0a40ab0d4ea76f69d1688ff4f953920e4e837af208d8a25afaf4faa000c4
Instruction ID: c42435c704d87005acf5b6d7044dd68bff31d3bfeee1bac994fdbb5906758c2c
Opcode Fuzzy Hash: 373e0a40ab0d4ea76f69d1688ff4f953920e4e837af208d8a25afaf4faa000c4
Instruction Fuzzy Hash: 79F049313446014BD720A72DC889AAF62F99F84394B1C643BE41AC7756EB7DDDC48758

Uniqueness

Uniqueness Score: -1.00%

Function 004245E4 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004245EB

Part of subcall function 00423ED4: EnumWindows.USER32(00423E6C), ref: 00423EF8
Part of subcall function 00423ED4: GetWindow.USER32(?,00000003), ref: 00423F0D
Part of subcall function 00423ED4: GetWindowLongA.USER32(?,000000EC), ref: 00423F1C
Part of subcall function 00423ED4: SetWindowPos.USER32(00000000,004245AC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004245FB,?,?,004241C3), ref: 00423F52

SetActiveWindow.USER32(?,?,?,004241C3,00000000,004245AC), ref: 004245FF

Part of subcall function 00423A9C: ShowWindow.USER32(004108B0,00000009,?,00000000,0041F1F4,00423D8A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,0042405C), ref: 00423AB7

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: 1a354955b864757cfaa5613f9b306845f8d366a619694d2750710a135c8cdae9
Instruction ID: 0eb0e95855424de6865fa4d756a676c77cd5728601e575884a8a50090c80911a
Opcode Fuzzy Hash: 1a354955b864757cfaa5613f9b306845f8d366a619694d2750710a135c8cdae9
Instruction Fuzzy Hash: 3BE01A6070010187DB00EFAAE8C4B8622A8BF88305F55017ABC08CF24BDA3CDC048728

Uniqueness

Uniqueness Score: -1.00%

Function 00412A28 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,00412C25), ref: 00412C13

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: de892e97fbd68e1bb7582f7974717f862a539d23c567f166e41cd9819a8f42aa
Instruction ID: cdfe5c129d614e166dcfab814c58775b37bd24f4e82d9105b90a581207f53ed6
Opcode Fuzzy Hash: de892e97fbd68e1bb7582f7974717f862a539d23c567f166e41cd9819a8f42aa
Instruction Fuzzy Hash: 0451C2316082058FC720DF6AD781A9AF3E5EF98304B2086ABD904C7351EAB9ED91C74D

Uniqueness

Uniqueness Score: -1.00%

Function 00479D08 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00479E56

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 462738d441aef1136b86fc8094aec41bc4a49bb6b5bf6afc55cbfc6645c50547
Instruction ID: 77384fbc8b33c5310ab19163c687e45bac72601044cd1e9f95c219b02d082465
Opcode Fuzzy Hash: 462738d441aef1136b86fc8094aec41bc4a49bb6b5bf6afc55cbfc6645c50547
Instruction Fuzzy Hash: 71414A75604105EFCB20CF99C6808AAB7F5EB48310B74C9A6E849DB745D338EE41DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0042F9C0 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F9DC

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 2621fde08b5d071fc730d3c03362a0ac5d2de45ee12ad7e5c10e42539110ff87
Instruction ID: 416a4692ed3cb8c0a12f59f0b22837e163b9cfd3c66ebd18f18690eb3ad7abe4
Opcode Fuzzy Hash: 2621fde08b5d071fc730d3c03362a0ac5d2de45ee12ad7e5c10e42539110ff87
Instruction Fuzzy Hash: 07D0A7B220010C7FDB00DE98D840D6B33BC9B8C700B90C826F945C7241D234EDA0CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0044BB28 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 282libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044BAA4: GetVersionExA.KERNEL32(00000094), ref: 0044BAC1

Part of subcall function 0044BAF8: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0044BB10

LoadLibraryA.KERNEL32(00000000,00000000,0044BF0B,?,?,?,?,00000000,00000000,?,0044FD4D,0049A4DA), ref: 0044BB8A
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044BBA2
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044BBB4
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044BBC6
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044BBD8
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BBEA
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BBFC
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044BC0E
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044BC20
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044BC32
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044BC44
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044BC56
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044BC68
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044BC7A
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044BC8C
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044BC9E
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044BCB0
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044BCC2
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044BCD4
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044BCE6
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044BCF8
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044BD0A
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044BD1C
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044BD2E
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044BD40
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044BD52
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044BD64
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044BD76
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044BD88
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044BD9A
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044BDAC
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044BDBE
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044BDD0
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044BDE2
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044BDF4
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044BE06
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044BE18
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044BE2A
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044BE3C
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044BE4E
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044BE60
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044BE72
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044BE84
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044BE96
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044BEA8
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044BEBA
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044BECC
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044BEDE

Strings

DrawThemeIcon, xrefs: 0044BC72
GetThemeFilename, xrefs: 0044BD92
CloseThemeData, xrefs: 0044BBAC
GetThemeBackgroundRegion, xrefs: 0044BC3C
GetThemeInt, xrefs: 0044BCF0
GetThemeSysColor, xrefs: 0044BDA4
GetWindowTheme, xrefs: 0044BE46
EnableTheming, xrefs: 0044BED6
SetWindowTheme, xrefs: 0044BD80
DrawThemeBackground, xrefs: 0044BBBE
GetThemeIntList, xrefs: 0044BD5C
IsThemeActive, xrefs: 0044BE22
GetThemeSysSize, xrefs: 0044BDDA
IsThemeDialogTextureEnabled, xrefs: 0044BE6A
GetThemeDocumentationProperty, xrefs: 0044BEB2
GetThemeSysFont, xrefs: 0044BDEC
OpenThemeData, xrefs: 0044BB9A
HitTestThemeBackground, xrefs: 0044BC4E
IsThemePartDefined, xrefs: 0044BC84
GetThemeFont, xrefs: 0044BD26
GetThemeTextMetrics, xrefs: 0044BC2A
GetThemeRect, xrefs: 0044BD38
GetThemeBool, xrefs: 0044BCDE
GetThemeColor, xrefs: 0044BCA8
GetThemeEnumValue, xrefs: 0044BD02
uxtheme.dll, xrefs: 0044BB77
EnableThemeDialogTexture, xrefs: 0044BE58
GetThemeString, xrefs: 0044BCCC
GetThemeTextExtent, xrefs: 0044BC18
GetThemeSysBool, xrefs: 0044BDC8
GetThemeBackgroundContentRect, xrefs: 0044BBE2, 0044BBF4
GetThemeSysColorBrush, xrefs: 0044BDB6
GetThemeMetric, xrefs: 0044BCBA
GetThemeSysString, xrefs: 0044BDFE
DrawThemeParentBackground, xrefs: 0044BEC4
IsThemeBackgroundPartiallyTransparent, xrefs: 0044BC96
DrawThemeText, xrefs: 0044BBD0
GetThemeSysInt, xrefs: 0044BE10
GetThemePosition, xrefs: 0044BD14
SetThemeAppProperties, xrefs: 0044BE8E
GetThemePropertyOrigin, xrefs: 0044BD6E
IsAppThemed, xrefs: 0044BE34
GetThemeMargins, xrefs: 0044BD4A
GetThemePartSize, xrefs: 0044BC06
DrawThemeEdge, xrefs: 0044BC60
GetThemeAppProperties, xrefs: 0044BE7C
GetCurrentThemeName, xrefs: 0044BEA0

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystemVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2754715182-2910565190
Opcode ID: 2001b9481bd4323523c3a6d9ee5d3feebd5ce703d364f315cb0e33d3a930df2d
Instruction ID: 345b4916510d3cb7c096cba84ec2b1d1bd9d6ff2ab3c947e91cb1c242a843473
Opcode Fuzzy Hash: 2001b9481bd4323523c3a6d9ee5d3feebd5ce703d364f315cb0e33d3a930df2d
Instruction Fuzzy Hash: 49A16AB0A41A50EBEB00EFF5DC86A2A37A8EB15B14B1405BBB444EF295D678DC048F5D

Uniqueness

Uniqueness Score: -1.00%

Function 00493FEC Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,004944E1,?,?,?,?,00000000,00000000,00000000), ref: 0049402C
FindWindowA.USER32(00000000,00000000), ref: 0049405D

Strings

REGISTERWINDOWMESSAGE, xrefs: 004941BF
FINDWINDOWBYWINDOWNAME, xrefs: 00494075
SENDBROADCASTMESSAGE, xrefs: 004941F9
FREEDLL, xrefs: 004943D8
SLEEP, xrefs: 00494016
SENDNOTIFYMESSAGE, xrefs: 00494163
OEMTOCHARBUFF, xrefs: 0049443F
LOADDLL, xrefs: 004942EF
CALLDLLPROC, xrefs: 00494351
FINDWINDOWBYCLASSNAME, xrefs: 00494039
CHARTOOEMBUFF, xrefs: 00494482
SENDMESSAGE, xrefs: 004940B1
SENDBROADCASTNOTIFYMESSAGE, xrefs: 0049429B
CREATEMUTEX, xrefs: 0049440D
POSTMESSAGE, xrefs: 00494107
POSTBROADCASTMESSAGE, xrefs: 00494247

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 834d3c12a7b8cb1b7f9a51084d0e5a3396d1cd2c1371b045a5ef52030d7eb881
Instruction ID: aaf63752e06fee66a7d05b71673dc8e7902340e663ecb0da5339ca9489632561
Opcode Fuzzy Hash: 834d3c12a7b8cb1b7f9a51084d0e5a3396d1cd2c1371b045a5ef52030d7eb881
Instruction Fuzzy Hash: 7EC14060B0421027DB14FB7ACC4692E5A999BD4704750CA3FB40AEB78BDE3CDC0B4799

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE5C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CE90
CreateCompatibleDC.GDI32(?), ref: 0041CE9C
CreateBitmap.GDI32(0041AD94,?,00000001,00000001,00000000), ref: 0041CEC0
CreateCompatibleBitmap.GDI32(?,0041AD94,?), ref: 0041CED0
SelectObject.GDI32(0041D28C,00000000), ref: 0041CEEB
FillRect.USER32(0041D28C,?,?), ref: 0041CF26
SetTextColor.GDI32(0041D28C,00000000), ref: 0041CF3B
SetBkColor.GDI32(0041D28C,00000000), ref: 0041CF52
PatBlt.GDI32(0041D28C,00000000,00000000,0041AD94,?,00FF0062), ref: 0041CF68
CreateCompatibleDC.GDI32(?), ref: 0041CF7B
SelectObject.GDI32(00000000,00000000), ref: 0041CFAC
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CFC4
RealizePalette.GDI32(00000000), ref: 0041CFCD
SelectPalette.GDI32(0041D28C,00000000,00000001), ref: 0041CFDC
RealizePalette.GDI32(0041D28C), ref: 0041CFE5
SetTextColor.GDI32(00000000,00000000), ref: 0041CFFE
SetBkColor.GDI32(00000000,00000000), ref: 0041D015
BitBlt.GDI32(0041D28C,00000000,00000000,0041AD94,?,00000000,00000000,00000000,00CC0020), ref: 0041D031
SelectObject.GDI32(00000000,?), ref: 0041D03E
DeleteDC.GDI32(00000000), ref: 0041D054

Part of subcall function 0041A4A8: GetSysColor.USER32(?), ref: 0041A4B2

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: 5e0ecd7f746a94368510dc98cd5b3d13ae19e4ca4739b00519ae71ef4424a664
Instruction ID: f3cd37e79d0242250547ce8a95e3067296a2558137ee74c5e82542f4c8f5946c
Opcode Fuzzy Hash: 5e0ecd7f746a94368510dc98cd5b3d13ae19e4ca4739b00519ae71ef4424a664
Instruction Fuzzy Hash: 6F61CD71A44604AFDB10EBE9DC46FAFB7B8EF48704F10446AF504E7281C67CA9418B69

Uniqueness

Uniqueness Score: -1.00%

Function 00499CB8 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,0049A050,?,?,00000000,?,00000000,00000000,?,0049A407,00000000,0049A411,?,00000000), ref: 00499D3B
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049A050,?,?,00000000,?,00000000,00000000,?,0049A407,00000000), ref: 00499D4E
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049A050,?,?,00000000,?,00000000,00000000), ref: 00499D5E
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00499D7F
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,0049A050,?,?,00000000,?,00000000), ref: 00499D8F

Part of subcall function 0042D89C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D92A,?,?,?,00000001,?,0045681A,00000000,00456882), ref: 0042D8D1

Strings

.lst, xrefs: 00499DCC
/REGU, xrefs: 00499D11
/REG, xrefs: 00499CED
Inno-Setup-RegSvr-Mutex, xrefs: 00499D45
.msg, xrefs: 00499DB2
Setup, xrefs: 00499D27

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 925e690ebd037e7923dbbcefbad47493d482e32af6c3f83e886948a8d640b5b4
Instruction ID: 24b702ce4587ab849973673670b37801b9677cadbfb3bf4f1077f7c12e9ac28d
Opcode Fuzzy Hash: 925e690ebd037e7923dbbcefbad47493d482e32af6c3f83e886948a8d640b5b4
Instruction Fuzzy Hash: 5591C430A04205AFDF11EF69C852BAEBBB4EB49304F51447AF500AB792C63DAC05CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0045AED4 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045B190,?,?,?,?,?,00000006,?,00000000,00499145,?,00000000,004991E8), ref: 0045B042

Strings

Stripped read-only attribute., xrefs: 0045B01B
.chw, xrefs: 0045AF89
.hlp, xrefs: 0045AF0B
.gid, xrefs: 0045AF24
Failed to delete the file; it may be in use (%d)., xrefs: 0045B131
The file appears to be in use (%d). Will delete on restart., xrefs: 0045B08B
.lnk, xrefs: 0045AFAF
.chm, xrefs: 0045AF70
Deleting file: %s, xrefs: 0045AFE1
.fts, xrefs: 0045AF48
Failed to strip read-only attribute., xrefs: 0045B027

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: ee902998d0ea4d496aeed0dc6aaa5ed569175179788583852f2215e5d79f3eef
Instruction ID: 1722664f16d817fc675012576ec738190a07adef69c32437d7057340c1fc2b4b
Opcode Fuzzy Hash: ee902998d0ea4d496aeed0dc6aaa5ed569175179788583852f2215e5d79f3eef
Instruction Fuzzy Hash: 3271AE307006445BDB01EB6A88927AE7BA5EF49755F50846BFC01EB383CB7C8E49879D

Uniqueness

Uniqueness Score: -1.00%

Function 0045D3BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045D3D6
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045D3F6
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045D403
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045D410
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045D41E

Part of subcall function 0045D2C4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045D363,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045D33D

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045D611,?,?,00000000), ref: 0045D4D7
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045D611,?,?,00000000), ref: 0045D4E0

Strings

SetEntriesInAclW, xrefs: 0045D418
SetNamedSecurityInfoW, xrefs: 0045D40A
advapi32.dll, xrefs: 0045D3F1
W, xrefs: 0045D4EE
GetNamedSecurityInfoW, xrefs: 0045D3FD

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 0336fb35fd749793045182d1361f828010284629c3cee937cf748adbc12729e9
Instruction ID: 1fdbc06bdf38f6500452038ca5d2f44928d617c4984e35671f0aa61f53d98d16
Opcode Fuzzy Hash: 0336fb35fd749793045182d1361f828010284629c3cee937cf748adbc12729e9
Instruction Fuzzy Hash: D35183B1D00208EFDB20DF99C841BAEB7B8EF49315F14806AF904B7382D6789945CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7FC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B813
CreateCompatibleDC.GDI32(00000000), ref: 0041B81D
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B82F
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B846
GetDC.USER32(00000000), ref: 0041B852
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B87F
ReleaseDC.USER32(00000000,00000000), ref: 0041B8A5
SelectObject.GDI32(00000000,?), ref: 0041B8C0
SelectObject.GDI32(?,00000000), ref: 0041B8CF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B8FB
SelectObject.GDI32(00000000,00000000), ref: 0041B909
SelectObject.GDI32(?,00000000), ref: 0041B917
DeleteDC.GDI32(00000000), ref: 0041B920
DeleteDC.GDI32(?), ref: 0041B929

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 545e798d89bfd874ee53134500b0446245b84f374f10eb2ff5fc30c629433f8f
Instruction ID: 5456327a1e321ce8c2b8187df1c916a831ebe275c46a8a968a344784d91ca00b
Opcode Fuzzy Hash: 545e798d89bfd874ee53134500b0446245b84f374f10eb2ff5fc30c629433f8f
Instruction Fuzzy Hash: FC419F71E44609ABDB10EAE9C845FEFB7BCEB08704F104466F614F7281D7786D418BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00454FDC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegQueryValueExA.ADVAPI32(0045B366,00000000,00000000,?,00000000,?,00000000,00455275,?,0045B366,00000003,00000000,00000000,004552AC), ref: 004550F5

Part of subcall function 0042ED18: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004539D7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042ED37

RegQueryValueExA.ADVAPI32(0045B366,00000000,00000000,00000000,?,00000004,00000000,004551BF,?,0045B366,00000000,00000000,?,00000000,?,00000000), ref: 00455179
RegQueryValueExA.ADVAPI32(0045B366,00000000,00000000,00000000,?,00000004,00000000,004551BF,?,0045B366,00000000,00000000,?,00000000,?,00000000), ref: 004551A8

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045504C
, xrefs: 00455066
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00455013
RegOpenKeyEx, xrefs: 00455078

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: e505bbac87e079255f4eea0ca5e74eb803f9fa129fd0d44c7da1eb335db16a26
Instruction ID: 06452bf81ef06fa34888f2ab1cc7b3841a1100f4c60e90cd60a05f06e497d7d6
Opcode Fuzzy Hash: e505bbac87e079255f4eea0ca5e74eb803f9fa129fd0d44c7da1eb335db16a26
Instruction Fuzzy Hash: E0913371D04608ABDB10DFA5C952BEEB7F8EB08305F50406BF904F7282D6799E088B69

Uniqueness

Uniqueness Score: -1.00%

Function 00459C54 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459B60: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459C9D,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459BAD

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459CFB
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459D65

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459DCC

Strings

SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 00459D18
v4.0.30319, xrefs: 00459CED
.NET Framework not found, xrefs: 00459E19
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 00459CAE
.NET Framework version %s not found, xrefs: 00459E05
v2.0.50727, xrefs: 00459D57
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00459D7F
v1.1.4322, xrefs: 00459DBE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 1aa85c752a1d3603d52ccaef4dc6b008277cbbbe6d6d1b8f5b44ec9793cd717f
Instruction ID: 13a12a4b366685baa8d6a2e304724611cbcec49206d2204e0959de5a5d6478e2
Opcode Fuzzy Hash: 1aa85c752a1d3603d52ccaef4dc6b008277cbbbe6d6d1b8f5b44ec9793cd717f
Instruction Fuzzy Hash: 6451B235A04104EFCB04DB66D862BEE77BADB49305F1844BBA941D7382E7799E0D8B18

Uniqueness

Uniqueness Score: -1.00%

Function 00459240 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00459277
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00459293
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 004592A1
GetExitCodeProcess.KERNEL32(?), ref: 004592B2
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 004592F9
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00459315

Strings

Helper process exited, but failed to get exit code., xrefs: 004592EB
Stopping 64-bit helper process. (PID: %u), xrefs: 00459269
Helper isn't responding; killing it., xrefs: 00459283
Helper process exited with failure code: 0x%x, xrefs: 004592DF
Helper process exited., xrefs: 004592C1

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 230b5ddc3981dfca21d5636881bab7241834d3e40b9cb852e8f413207b64b114
Instruction ID: 475b633a8f1197f12a32b7740e8dffccf3703e2e74a756bc360da45c31bde27f
Opcode Fuzzy Hash: 230b5ddc3981dfca21d5636881bab7241834d3e40b9cb852e8f413207b64b114
Instruction Fuzzy Hash: 7B215C70604700EAC720EA7DC486B5B77D49F49305F048D2EB899DB693DA7CEC489B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00454C90 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E234: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042E260

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,00454E67,?,00000000,00454F2B), ref: 00454DB7
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,00454E67,?,00000000,00454F2B), ref: 00454EF3

Part of subcall function 0042ED18: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,004539D7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042ED37

Strings

RegCreateKeyEx, xrefs: 00454D2B
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454CFF
, xrefs: 00454D19
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454CCF

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 2d07f13e4db519d4e9e36b01427add84eda95a74c7e6f0e57b2001e2f306a931
Instruction ID: 61cb1c98edcfe528623c145d9993427f2b00fea00e486b8f0244815ce8f04fab
Opcode Fuzzy Hash: 2d07f13e4db519d4e9e36b01427add84eda95a74c7e6f0e57b2001e2f306a931
Instruction Fuzzy Hash: 18810175900209ABDB01DFD5C942BDEB7B8FB49709F50442AF900FB282D7789A49CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00498538 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00454024: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00498709,_iu,?,00000000,0045415E), ref: 00454113
Part of subcall function 00454024: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00498709,_iu,?,00000000,0045415E), ref: 00454123

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004985B5
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00498709), ref: 004985D6
CreateWindowExA.USER32(00000000,STATIC,00498718,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 004985FD
SetWindowLongA.USER32(?,000000FC,00497D90), ref: 00498610
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004986DC,?,?,000000FC,00497D90,00000000,STATIC,00498718), ref: 00498640
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004986B4
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004986DC,?,?,000000FC,00497D90,00000000), ref: 004986C0

Part of subcall function 00454498: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0045457F

DestroyWindow.USER32(?,004986E3,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004986DC,?,?,000000FC,00497D90,00000000,STATIC), ref: 004986D6

Strings

STATIC, xrefs: 004985F6
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 0049866F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: 33f0aa1e6c66ba33127d106aa60bf689e86794d53dcbda2b1297c66d72ebb552
Instruction ID: 19a9ac76a87cbdbac9fefc72f4bc8d66673aab5a8439699f4ab81f25108c8d39
Opcode Fuzzy Hash: 33f0aa1e6c66ba33127d106aa60bf689e86794d53dcbda2b1297c66d72ebb552
Instruction Fuzzy Hash: 78414771A54204AFDF00EBA5CC42F9E7BF8EB09714F51457AF500FB291DA799E048B58

Uniqueness

Uniqueness Score: -1.00%

Function 0042E868 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E96D,?,00000000,0047F9E0,00000000), ref: 0042E891
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E897
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E96D,?,00000000,0047F9E0,00000000), ref: 0042E8E5

Strings

.DEFAULT\Control Panel\International, xrefs: 0042E8BC
Locale, xrefs: 0042E8D4
GetUserDefaultUILanguage, xrefs: 0042E887
kernel32.dll, xrefs: 0042E88C
Control Panel\Desktop\ResourceLocale, xrefs: 0042E8F4
hE, xrefs: 0042E927, 0042E92F, 0042E93A, 0042E95C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll$hE
API String ID: 4190037839-2100363064
Opcode ID: 0d0542b490789496275326bf467ee48a418aeea0f636004cd32046c80f98ed15
Instruction ID: 343416b7bfae85f45959abe8e21461bd4048f30ead5244c3b453dfa896624356
Opcode Fuzzy Hash: 0d0542b490789496275326bf467ee48a418aeea0f636004cd32046c80f98ed15
Instruction Fuzzy Hash: 06214470B00229EBDB50EAA7DC42BAE77A8EB44314F904477A500E7281DB7C9E45DB1C

Uniqueness

Uniqueness Score: -1.00%

Function 004635E4 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 004635F0
GetModuleHandleA.KERNEL32(user32.dll), ref: 00463604
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00463611
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0046361E
GetWindowRect.USER32(?,00000000), ref: 0046366A
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 004636A8

Strings

user32.dll, xrefs: 004635FF
MonitorFromWindow, xrefs: 0046360B
GetMonitorInfoA, xrefs: 00463618
(, xrefs: 00463649

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 5d54fb813e64eee8d2e1fd1d869d3f84fcc541412d8aec38238ce219d7c6ea2a
Instruction ID: 23225dc964baf5770c03b9449d190f9fd0809e25ab0c2f23061680c52a7637e8
Opcode Fuzzy Hash: 5d54fb813e64eee8d2e1fd1d869d3f84fcc541412d8aec38238ce219d7c6ea2a
Instruction Fuzzy Hash: AE21C2B17006446BD320EE68CC45F3B76D9EB84B05F09452EF944DB3C1EA78DD004B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042F614 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F620
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F634
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F641
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F64E
GetWindowRect.USER32(?,00000000), ref: 0042F69A
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F6D8

Strings

GetMonitorInfoA, xrefs: 0042F648
MonitorFromWindow, xrefs: 0042F63B
user32.dll, xrefs: 0042F62F
(, xrefs: 0042F679

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 9e18f176ca51f207d9f48e4ded0b32e3445f45e6b18c2f86467d84d44384674f
Instruction ID: 8e363f887434259cf3ecd6bfca6d9ac669349ab4594bae960fb014309ef79425
Opcode Fuzzy Hash: 9e18f176ca51f207d9f48e4ded0b32e3445f45e6b18c2f86467d84d44384674f
Instruction Fuzzy Hash: BC21C2B27006146FD600EA68DC85F3B72A9EB84704F89463AF944DB391DA78DC098B59

Uniqueness

Uniqueness Score: -1.00%

Function 00459418 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,004595F7,?,00000000,0045965A,?,?,00000000,00000000), ref: 00459475
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045958C,?,00000000,00000001,00000000,00000000,00000000,004595F7), ref: 004594D2
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045958C,?,00000000,00000001,00000000,00000000,00000000,004595F7), ref: 004594DF
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0045952B
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00459565,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045958C,?,00000000), ref: 00459551
GetLastError.KERNEL32(?,?,00000000,00000001,00459565,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,0045958C,?,00000000), ref: 00459558

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

TransactNamedPipe, xrefs: 004594EB
CreateEvent, xrefs: 00459483

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 8c882674e4e7badbb1dce3e2dfa1fdcbe7e98f1f80990b5ca878147d0da0e0cb
Instruction ID: 77fbb71d8e7aac064b87aac98c1c55f9fcb2258c1561d492b861e589c0c855dd
Opcode Fuzzy Hash: 8c882674e4e7badbb1dce3e2dfa1fdcbe7e98f1f80990b5ca878147d0da0e0cb
Instruction Fuzzy Hash: CF418B71A00208FFDB11DF99C981F9EB7F9EB48710F5040AAF904E7282D6789E54CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004574BC Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00457621,?,?,00000031,?), ref: 004574E4
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 004574EA
LoadTypeLib.OLEAUT32(00000000,?), ref: 00457537

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

ITypeLib::GetLibAttr, xrefs: 0045756D
GetProcAddress, xrefs: 004574F7
LoadTypeLib, xrefs: 00457542
OLEAUT32.DLL, xrefs: 004574DF
UnRegisterTypeLib, xrefs: 004575A3
UnRegisterTypeLib, xrefs: 004574DA

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: b2a57cb5d0d4215bed9739cbf0b7be67a86da8044cbf193a82d044f72dd204c0
Instruction ID: 559faf3bdf9cccbe36ab56d48fd8e4aa4276a02661c60707683b87f46ce48c1c
Opcode Fuzzy Hash: b2a57cb5d0d4215bed9739cbf0b7be67a86da8044cbf193a82d044f72dd204c0
Instruction Fuzzy Hash: 8131B471A04604BFCB01EFAADC01D5FB7BEEB8975571044B6BD04D3652EA38DD04CA68

Uniqueness

Uniqueness Score: -1.00%

Function 004171D0 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00417263
SaveDC.GDI32(?), ref: 00417277
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 0041729A
RestoreDC.GDI32(?,?), ref: 004172B5
CreateSolidBrush.GDI32(00000000), ref: 00417335
FrameRect.USER32(?,?,?), ref: 00417368
DeleteObject.GDI32(?), ref: 00417372
CreateSolidBrush.GDI32(00000000), ref: 00417382
FrameRect.USER32(?,?,?), ref: 004173B5
DeleteObject.GDI32(?), ref: 004173BF

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 53338b723e60019b0e5d7787f83bb0eaf38aae583f1cfacba6e60a06ab1a3e99
Instruction ID: 6654575de22a121332528345891e4d9aada139d791074539051cb87a9fd886f5
Opcode Fuzzy Hash: 53338b723e60019b0e5d7787f83bb0eaf38aae583f1cfacba6e60a06ab1a3e99
Instruction Fuzzy Hash: 30515D712086455FDB50EF69C8C0B9B7BE8AF48314F1455AAFD588B286C738EC81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00422638 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422683
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 004226A1
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004226AE
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004226BB
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004226C8
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 004226D5
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 004226E2
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 004226EF
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 0042270D
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 00422729

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 28c3c26aa58a7b1d0b737a17757400c93c751d32761aa9437bbdc0a385d65993
Instruction ID: df9c0873c136ddd24b8aa988775969986c1613bec62327c4069b14a2c43cb384
Opcode Fuzzy Hash: 28c3c26aa58a7b1d0b737a17757400c93c751d32761aa9437bbdc0a385d65993
Instruction Fuzzy Hash: 5F2156743847047AE721E724CD8BF9B7BD89B54748F144069B6487F2D3C6FCAA40869C

Uniqueness

Uniqueness Score: -1.00%

Function 00462174 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004621AF
GetActiveWindow.USER32 ref: 00462213
CoInitialize.OLE32(00000000), ref: 00462227
SHBrowseForFolder.SHELL32(?), ref: 0046223E
756CD120.OLE32(0046227F,00000000,?,?,?,?,?,00000000,00462303), ref: 00462253
SetActiveWindow.USER32(?,0046227F,00000000,?,?,?,?,?,00000000,00462303), ref: 00462269
SetActiveWindow.USER32(?,?,0046227F,00000000,?,?,?,?,?,00000000,00462303), ref: 00462272

Strings

A, xrefs: 004621E7

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ActiveWindow$BrowseD120FolderInitializeMalloc
String ID: A
API String ID: 2698730301-3554254475
Opcode ID: caefdfe045defb9a034f2c4a917009fdef53ece79d7542ea0497d69e424cd409
Instruction ID: 1e82777cc352b96db12449cf8796706bfa71e84f11e11660080683620fe74db3
Opcode Fuzzy Hash: caefdfe045defb9a034f2c4a917009fdef53ece79d7542ea0497d69e424cd409
Instruction Fuzzy Hash: E23130B0E04208AFDB00EFB5D945ADEBBF8EB09304F51447AF914E7251E7789A04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0045DAB0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045DAB9
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045DAC9
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045DAD9
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045DAE9

Strings

inflateEnd, xrefs: 0045DAD3
inflate, xrefs: 0045DAC3
inflateInit_, xrefs: 0045DAB3
inflateReset, xrefs: 0045DAE3

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 5abc5c05f731a0f84057b652f47985810eed84a0374322df604e0c431af132d1
Instruction ID: 9991d33b7b3f44c4a287d390de66c621eb38f0a325e11cae05c3c9c0ae6f74c7
Opcode Fuzzy Hash: 5abc5c05f731a0f84057b652f47985810eed84a0374322df604e0c431af132d1
Instruction Fuzzy Hash: ED016CB0D00710DAE324DF335C827223AA79B94306F1584376B4853266D3FC184DCE2D

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD2C Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041AE09
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041AE43
SetBkColor.GDI32(?,?), ref: 0041AE58
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AEA2
SetTextColor.GDI32(00000000,00000000), ref: 0041AEAD
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AEBD
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AEFC
SetTextColor.GDI32(00000000,00000000), ref: 0041AF06
SetBkColor.GDI32(00000000,?), ref: 0041AF13

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: b2e79564dac12e93c58a92479de6674996e515196b856df7b31fa3c4552ba36b
Instruction ID: 4ec4bb7d7ecd06ab75a809c898bbb7394ceff3bd51f581de865bbf99f3132505
Opcode Fuzzy Hash: b2e79564dac12e93c58a92479de6674996e515196b856df7b31fa3c4552ba36b
Instruction Fuzzy Hash: E761A6B5A01605EFC740EFADE985E9AB7F9EF08318B108566F518DB251C734ED408F98

Uniqueness

Uniqueness Score: -1.00%

Function 004588C0 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458A74,?, /s ",?,regsvr32.exe",?,00458A74), ref: 004589E6

Strings

/s ", xrefs: 0045892F
/u, xrefs: 00458922
regsvr32.exe", xrefs: 00458907
0x%x, xrefs: 00458A09
D, xrefs: 0045899C
CreateProcess, xrefs: 004589D8
Spawning 64-bit RegSvr32: , xrefs: 0045894B
Spawning 32-bit RegSvr32: , xrefs: 0045896D

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 155819c64c430fb45d55460a0d10478e2dbda3fe00918e678cc052cf01514edf
Instruction ID: 5e566bfdb395c8031f807e0e6dfcda5b961088fbae7d5a2ae3caad0b9f5d9a1a
Opcode Fuzzy Hash: 155819c64c430fb45d55460a0d10478e2dbda3fe00918e678cc052cf01514edf
Instruction Fuzzy Hash: 94410770A003486BDB10EFE5C842B9DB7F9AF45305F50407FA914BB296DF789E098B59

Uniqueness

Uniqueness Score: -1.00%

Function 0044D750 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D781
GetSysColor.USER32(00000014), ref: 0044D788
SetTextColor.GDI32(00000000,00000000), ref: 0044D7A0
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D7C9
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D7D3
GetSysColor.USER32(00000010), ref: 0044D7DA
SetTextColor.GDI32(00000000,00000000), ref: 0044D7F2
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D81B
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D846

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: c732eae71167dd8aa6631ccdc206b1dcbb1a1316a8d8e9d7e0f026f0b59abdf9
Instruction ID: 83f763003a0c4173e52025d9049416b14570b2719a823760897ab970dc451d42
Opcode Fuzzy Hash: c732eae71167dd8aa6631ccdc206b1dcbb1a1316a8d8e9d7e0f026f0b59abdf9
Instruction Fuzzy Hash: B221ACB46015047FC710FB2ACD8AE8AB7DC9F59319B00857BB918EB3A3C67CDE444669

Uniqueness

Uniqueness Score: -1.00%

Function 00497DDC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00451070: SetEndOfFile.KERNEL32(?,?,0045CB3E,00000000,0045CCC9,?,00000000,00000002,00000002), ref: 00451077

Part of subcall function 004073A0: DeleteFileA.KERNEL32(00000000,0049D62C,00499FD9,00000000,0049A02E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073AB

GetWindowThreadProcessId.USER32(00000000,?), ref: 00497E6D
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00497E81
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00497E9B
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00497EA7
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00497EAD
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00497EC0

Strings

Deleting Uninstall data files., xrefs: 00497DE3

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 76f4a073d4d431fcb8e24e0d71c40f55804fe31760389f23b01cbf0fd8bd04be
Instruction ID: 7989a93d4f85e89f9f4a8d52eef74e044f35551c753dc98037dc67a034be62a8
Opcode Fuzzy Hash: 76f4a073d4d431fcb8e24e0d71c40f55804fe31760389f23b01cbf0fd8bd04be
Instruction Fuzzy Hash: 78213270718204BEEF10EBB6AC42B5737A8E755758F15497BF500961E2EA7C5C048B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00471058 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00471155,?,?,?,?,00000000), ref: 004710BF
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00471155), ref: 004710D6
AddFontResourceA.GDI32(00000000), ref: 004710F3
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00471107

Strings

Failed to open Fonts registry key., xrefs: 004710DD
AddFontResource, xrefs: 00471111
Failed to set value in Fonts registry key., xrefs: 004710C8

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: 8b4590871c18eeae088a7c2d90715e56c0871639f9d032f97c1a61f902beaf2d
Instruction ID: e530b8863bd5b0940b7b47d45e6c2b04f0dd933a31ed90210a2cbfb1d5868c86
Opcode Fuzzy Hash: 8b4590871c18eeae088a7c2d90715e56c0871639f9d032f97c1a61f902beaf2d
Instruction Fuzzy Hash: 3821B27074024477D710EA6A9C42F9A77ACCB09708F60C43BBA04EB3D2DA7CDE05862D

Uniqueness

Uniqueness Score: -1.00%

Function 00463A24 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416860: GetClassInfoA.USER32(00400000,?,?), ref: 004168CF
Part of subcall function 00416860: UnregisterClassA.USER32(?,00400000), ref: 004168FB
Part of subcall function 00416860: RegisterClassA.USER32(?), ref: 0041691E

GetVersion.KERNEL32 ref: 00463A54
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00463A92
SHGetFileInfo.SHELL32(00463B30,00000000,?,00000160,00004011), ref: 00463AAF
LoadCursorA.USER32(00000000,00007F02), ref: 00463ACD
SetCursor.USER32(00000000,00000000,00007F02,00463B30,00000000,?,00000160,00004011), ref: 00463AD3
SetCursor.USER32(?,00463B13,00007F02,00463B30,00000000,?,00000160,00004011), ref: 00463B06

Strings

Explorer, xrefs: 00463A6E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: 08ef91ce8ca4084e417ba220884df78b79a66e01962786801913a20119982a52
Instruction ID: 0956d246c88e4b13c617490cc10e92cdb10fa67267cb1644ec11604dcab5a564
Opcode Fuzzy Hash: 08ef91ce8ca4084e417ba220884df78b79a66e01962786801913a20119982a52
Instruction Fuzzy Hash: 6A212C307403446AE710BFB58C47F9A76989B08708F5000BFBA09EE1C3EABD9D4586AD

Uniqueness

Uniqueness Score: -1.00%

Function 004795B8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,022A79F0,?,?,?,022A79F0,0047977C,00000000,0047989A,?,?,?,?), ref: 004795D1
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004795D7
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022A79F0,?,?,?,022A79F0,0047977C,00000000,0047989A,?,?,?,?), ref: 004795EA
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022A79F0,?,?,?,022A79F0), ref: 00479614
CloseHandle.KERNEL32(00000000,?,?,?,022A79F0,0047977C,00000000,0047989A,?,?,?,?), ref: 00479632

Strings

GetFinalPathNameByHandleA, xrefs: 004795C7
kernel32.dll, xrefs: 004795CC

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 1947a9aaa15eabe4036a12787753409495eb16ca8dbead4cdc7f2695ecfe1c22
Instruction ID: 19ddb68189d16dccfde8b10573e35333770f7cebea86a77b7f1be6907437da3a
Opcode Fuzzy Hash: 1947a9aaa15eabe4036a12787753409495eb16ca8dbead4cdc7f2695ecfe1c22
Instruction Fuzzy Hash: CC01D26034470436E52131BA4C86FBB248C8B50768F148237BA1CEA2E2EDAD9E0601AE

Uniqueness

Uniqueness Score: -1.00%

Function 0045A608 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A78A,?,00000000,00000000,00000000,?,00000006,?,00000000,00499145,?,00000000,004991E8), ref: 0045A6CE

Part of subcall function 00454B5C: FindClose.KERNEL32(000000FF,00454C52), ref: 00454C41

Strings

Failed to delete directory (%d)., xrefs: 0045A764
Stripped read-only attribute., xrefs: 0045A690
Deleting directory: %s, xrefs: 0045A657
Failed to strip read-only attribute., xrefs: 0045A69C
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 0045A743
Failed to delete directory (%d). Will retry later., xrefs: 0045A6E7
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 0045A6A8

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: ae42777790169d4ff6edf5fab0230c903d40739da18b61ae09ca68f4304208a4
Instruction ID: 6800a92dfaec35f14ad088af188abd42280c19cea7490fe80134e7d3278dcbe3
Opcode Fuzzy Hash: ae42777790169d4ff6edf5fab0230c903d40739da18b61ae09ca68f4304208a4
Instruction Fuzzy Hash: 62418630A002485ACB10EB6988017AE7AF59B4D306F55867FAC11A7393DB7CCE1D875B

Uniqueness

Uniqueness Score: -1.00%

Function 004232A0 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 004232F4
GetCapture.USER32 ref: 00423303
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00423309
ReleaseCapture.USER32 ref: 0042330E
GetActiveWindow.USER32 ref: 0042331D
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 0042339C
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00423400
GetActiveWindow.USER32 ref: 0042340F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: bac6248c5c65b2a46f0a1d517af8b370a3a4e6cba25cb3140287781b4ccd40b9
Instruction ID: 3a9af59dda1f98e95100fec3f153a7acb7f05633bd4cd2eb2e4992da2b7770c9
Opcode Fuzzy Hash: bac6248c5c65b2a46f0a1d517af8b370a3a4e6cba25cb3140287781b4ccd40b9
Instruction Fuzzy Hash: 68414170B10258AFDB10EFAAD942B9DB7F1AF44704F5140BAE404AB292DB7C9F41CB18

Uniqueness

Uniqueness Score: -1.00%

Function 004298D0 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004298DA
GetTextMetricsA.GDI32(00000000), ref: 004298E3

Part of subcall function 0041A638: CreateFontIndirectA.GDI32(?), ref: 0041A6F7

SelectObject.GDI32(00000000,00000000), ref: 004298F2
GetTextMetricsA.GDI32(00000000,?), ref: 004298FF
SelectObject.GDI32(00000000,00000000), ref: 00429906
ReleaseDC.USER32(00000000,00000000), ref: 0042990E
GetSystemMetrics.USER32(00000006), ref: 00429933
GetSystemMetrics.USER32(00000006), ref: 0042994D

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: 493c3e02d1035430593376a4cfe0bac28c29019347665ee68c3eba71a2dbb902
Instruction ID: 0ef879b540a67ceb128a5e1141d84f2d1524799c58b88ee5a2ee57f477153a9f
Opcode Fuzzy Hash: 493c3e02d1035430593376a4cfe0bac28c29019347665ee68c3eba71a2dbb902
Instruction Fuzzy Hash: 8401A19170971127F310667A9CC2B6F6688DB54368F44053EFA86963E3D96C8C81876E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E274 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041E277
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041E281
ReleaseDC.USER32(00000000,00000000), ref: 0041E28E
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041E29D
GetStockObject.GDI32(00000007), ref: 0041E2AB
GetStockObject.GDI32(00000005), ref: 0041E2B7
GetStockObject.GDI32(0000000D), ref: 0041E2C3
LoadIconA.USER32(00000000,00007F00), ref: 0041E2D4

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: db53187b583683c3da25eb47fc51b38c63e1255722fbf2352793706f85574c6b
Instruction ID: 718266ba1944efb5b46721f14e799226cd24d8dfc19287898d5783b558d94fa9
Opcode Fuzzy Hash: db53187b583683c3da25eb47fc51b38c63e1255722fbf2352793706f85574c6b
Instruction Fuzzy Hash: 1111FB70A453015AE340BFA69D52BAA3691D724709F00813BF608EF3D2DB7D5C809BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00463E34 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 00463F38
SetCursor.USER32(00000000,00000000,00007F02,00000000,00463FCD), ref: 00463F3E
SetCursor.USER32(?,00463FB5,00007F02,00000000,00463FCD), ref: 00463FA8

Strings

, xrefs: 004641B3
, xrefs: 004641CE
Internal error: Item already expanding, xrefs: 00463ED5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 2e72c9ebfc19e7403a65945d55937a119cc11725f60109d9f94943b84faf3f65
Instruction ID: aa82ab3995de3935e6727d947cb2bd0e3876d59c6d9623ce98a17a39b04bf081
Opcode Fuzzy Hash: 2e72c9ebfc19e7403a65945d55937a119cc11725f60109d9f94943b84faf3f65
Instruction Fuzzy Hash: 67B1E230A00244DFDB14DF65C549B9EBBF1AF45304F1584AAE8459B392E778EE84CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00454498 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0045457F

Strings

NUL, xrefs: 00454641
MoveFileEx, xrefs: 0045478F
WININIT.INI, xrefs: 0045452D
.tmp, xrefs: 0045453B
[rename], xrefs: 004545E2, 0045461E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 7fc08df52904c59b3176bd425c815c443ddc94d3e7b0bfcf8c3a045116732771
Instruction ID: e87d0749b1697b84d3b9cc82c23e20e51564d8fa8ce324392089b518a873d649
Opcode Fuzzy Hash: 7fc08df52904c59b3176bd425c815c443ddc94d3e7b0bfcf8c3a045116732771
Instruction Fuzzy Hash: B8913334E001499BDB01EFA5D882BDEB7B5EF49309F508467E900BB292D77C9E49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00477E98 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00477EF1
SetWindowLongW.USER32(00000000,000000FC,Function_00077E4C), ref: 00477F18
GetACP.KERNEL32(00000000,00478130,?,00000000,0047815A), ref: 00477F55
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00477F9B

Strings

Inno Setup: Language, xrefs: 00478023
COMBOBOX, xrefs: 00477EEA

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: deb51ddf8cca9870b91e1d9d0dcad9b4f5c78b57c6cc0b96f0beb683c572e979
Instruction ID: 81c94a85f2d0ae2d33cbd4ee74d6221623364a49e9b2571c8ba4411711431487
Opcode Fuzzy Hash: deb51ddf8cca9870b91e1d9d0dcad9b4f5c78b57c6cc0b96f0beb683c572e979
Instruction Fuzzy Hash: 65813C34A00205DFD710EF69C989AAAB7F0FB49304F55C1BAE848D7362DB38AD45CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047E980 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047EAF4,?,?,?,?,00000000,0047EC49,?,?,?,00000000,?,0047ED58), ref: 0047EAD0
FindClose.KERNEL32(000000FF,0047EAFB,0047EAF4,?,?,?,?,00000000,0047EC49,?,?,?,00000000,?,0047ED58,00000000), ref: 0047EAEE

Strings

TG, xrefs: 0047EB72, 0047EA9F, 0047EAA5, 0047EB75
TG, xrefs: 0047E9C0, 0047E9D7

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: TG$TG
API String ID: 2066263336-2531790037
Opcode ID: b0e8c0ab68be89f93ee12764341254d4567c72d9188f1650ca356d27e1af81f5
Instruction ID: 49c023a3d40347f396a503d53546bb693b8cfca30f5629bd36de7deb8458e88f
Opcode Fuzzy Hash: b0e8c0ab68be89f93ee12764341254d4567c72d9188f1650ca356d27e1af81f5
Instruction Fuzzy Hash: F5812C7490024D9FDF11DF96C841ADFBBB9EF4D304F1081EAE508A7291D6399A46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00408B70 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408DB8,?,?,?,?,00000000,00000000,00000000,?,00409DBF,00000000,00409DD2), ref: 00408B8A

Part of subcall function 004089B8: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049D4C4,00000001,?,00408A83,?,00000000,00408B62), ref: 004089D6

Part of subcall function 00408A04: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00408C06,?,?,?,00000000,00408DB8), ref: 00408A17

Strings

:mm:ss, xrefs: 00408D86
mmmm d, yyyy, xrefs: 00408C7B
AMPM, xrefs: 00408D55
m/d/yy, xrefs: 00408C59
:mm, xrefs: 00408D6C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: c69c3147cd56940e9f4fd8337a0fbc887525be67d32930313bc35b703755f031
Instruction ID: a8d7ab9d838d1b353a0e5ff474912d8a0235132b07344be0acb9e4c83fee81e1
Opcode Fuzzy Hash: c69c3147cd56940e9f4fd8337a0fbc887525be67d32930313bc35b703755f031
Instruction Fuzzy Hash: D8513D34B001486BDB01FBA5DA41A9F77A9DB98308F50947FB181BB7C6CE3CDA068759

Uniqueness

Uniqueness Score: -1.00%

Function 00411B44 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00411D49), ref: 00411BDC
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 00411C9A

Part of subcall function 00411EFC: CreatePopupMenu.USER32 ref: 00411F16

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 00411D26

Part of subcall function 00411EFC: CreateMenu.USER32 ref: 00411F20

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 00411D0D

Strings

?, xrefs: 00411BF6
,, xrefs: 00411BEF

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: c987c748b65508a950cf3f2169e5bd87e5634fb74b346734da7ef3b4f05fb7f7
Instruction ID: 125356fab78159fbe3d4b3b77ff780d7a0eb3536e5c02055c9c5492709250fea
Opcode Fuzzy Hash: c987c748b65508a950cf3f2169e5bd87e5634fb74b346734da7ef3b4f05fb7f7
Instruction Fuzzy Hash: 7D512674A001049BDB10EF6AED815EE7BF9EF08304B1141BAFA04E73A2E738D941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041C2B3 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041C378
GetObjectA.GDI32(?,00000018,?), ref: 0041C387
GetBitmapBits.GDI32(?,?,?), ref: 0041C3D8
GetBitmapBits.GDI32(?,?,?), ref: 0041C3E6
DeleteObject.GDI32(?), ref: 0041C3EF
DeleteObject.GDI32(?), ref: 0041C3F8
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041C415

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: 8204310b78e8d6a6cf9899529667619705c527fa466c5b93b01e90bd2c764378
Instruction ID: 7028de2688ff158aa25c0b8276400e232655bb6670dd4605646626e5bfc1af4e
Opcode Fuzzy Hash: 8204310b78e8d6a6cf9899529667619705c527fa466c5b93b01e90bd2c764378
Instruction Fuzzy Hash: F651F671E002199FCB50DFE9C8819EEB7F9EB48314B218066F914E7295D638AD81CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041D328 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041D34E
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041D36D
SelectPalette.GDI32(?,?,00000001), ref: 0041D3D3
RealizePalette.GDI32(?), ref: 0041D3E2
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041D44C
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D48A
SelectPalette.GDI32(?,?,00000001), ref: 0041D4AF

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: 11edf0dba9517228aa32d7039567d0e1bdcd43b434536bf7bada936ddc7c4efc
Instruction ID: 60201597840efc574cdf5035eb35bbfd27a544e021146ecd029e3556dfc27432
Opcode Fuzzy Hash: 11edf0dba9517228aa32d7039567d0e1bdcd43b434536bf7bada936ddc7c4efc
Instruction Fuzzy Hash: 305121B0A00604AFD714DFA9C985F9AB7F9EF08304F14859AB944D7392C778ED80CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00457AD8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 00457B2A

Part of subcall function 004246CC: GetWindowTextA.USER32(?,?,00000100), ref: 004246EC

Part of subcall function 0041F2F4: GetCurrentThreadId.KERNEL32 ref: 0041F343
Part of subcall function 0041F2F4: EnumThreadWindows.USER32(00000000,0041F2A4,00000000), ref: 0041F349

Part of subcall function 00424714: SetWindowTextA.USER32(?,00000000), ref: 0042472C

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00457B91
TranslateMessage.USER32(?), ref: 00457BAF
DispatchMessageA.USER32(?), ref: 00457BB8

Strings

[Paused] , xrefs: 00457B60

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: 8f39b929066e5dde17ef7bf9f49813106d9eceee4e0607b45077cfdd9f9bed8a
Instruction ID: d952aa0340fda6d06c899081e645d661bac1146de2c671e539639067201b9655
Opcode Fuzzy Hash: 8f39b929066e5dde17ef7bf9f49813106d9eceee4e0607b45077cfdd9f9bed8a
Instruction Fuzzy Hash: BB3196309082445EDB11DFB9E845FDE7BF8DB49318F5180B7E814E7292D67CA909CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0046C0E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046C21F), ref: 0046C19C
LoadCursorA.USER32(00000000,00007F02), ref: 0046C1AA
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046C21F), ref: 0046C1B0
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046C21F), ref: 0046C1BA
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046C21F), ref: 0046C1C0

Strings

CheckPassword, xrefs: 0046C144

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: fb7cbc278dcb9edee9e8d2e5e9978fa6a8b16ca413f22061223fbaac6efefb0a
Instruction ID: ee4704442a97aa51a819b3d11b93b6eea7a80086b594a8aac8f18d25b90f0006
Opcode Fuzzy Hash: fb7cbc278dcb9edee9e8d2e5e9978fa6a8b16ca413f22061223fbaac6efefb0a
Instruction Fuzzy Hash: 063175346402449FD711EF69C8C9F9E7BE4AF49304F5580BAB9449B3E2E7789E40CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00478EB4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00478DDC: GetWindowThreadProcessId.USER32(00000000), ref: 00478DE4
Part of subcall function 00478DDC: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00478EDB,0049E0AC,00000000), ref: 00478DF7
Part of subcall function 00478DDC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00478DFD

SendMessageA.USER32(00000000,0000004A,00000000,0047926E), ref: 00478EE9
GetTickCount.KERNEL32 ref: 00478F2E
GetTickCount.KERNEL32 ref: 00478F38
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00478F8D

Strings

CallSpawnServer: Unexpected response: $%x, xrefs: 00478F1E
CallSpawnServer: Unexpected status: %d, xrefs: 00478F76

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3771334282
Opcode ID: b2e1d8d59d79f67ca6a224e872d53bca437999279a7be28f50c91e0342c7e9be
Instruction ID: 2b74b3330966d0da2430542d23b63ad4dc4eec681a1128910255243e8f8c0985
Opcode Fuzzy Hash: b2e1d8d59d79f67ca6a224e872d53bca437999279a7be28f50c91e0342c7e9be
Instruction Fuzzy Hash: E0319374F502149ADB10EBB9884A7EE76A19F48304F50843EF148EB382DA7C4D0187A9

Uniqueness

Uniqueness Score: -1.00%

Function 00459F80 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045A03B

Strings

Failed to load .NET Framework DLL "%s", xrefs: 0045A020
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045A046
CreateAssemblyCache, xrefs: 0045A032
Fusion.dll, xrefs: 00459FDB
.NET Framework CreateAssemblyCache function failed, xrefs: 0045A05E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: d95d5d40fddf0b6030493c953464f742ef4760e894d11a5ea04ccacfdf112554
Instruction ID: ac224aa19d502af52a8aeeb8631c7515eb40ef1487658bef2565bb8923ebe5d4
Opcode Fuzzy Hash: d95d5d40fddf0b6030493c953464f742ef4760e894d11a5ea04ccacfdf112554
Instruction Fuzzy Hash: 7931A971E006059FDB10EFA5C88169EB7B4AF44715F50867BE814E7382D7389E18C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0041C598 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C498: GetObjectA.GDI32(?,00000018), ref: 0041C4A5

GetFocus.USER32 ref: 0041C5B8
GetDC.USER32(?), ref: 0041C5C4
SelectPalette.GDI32(?,?,00000000), ref: 0041C5E5
RealizePalette.GDI32(?), ref: 0041C5F1
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C608
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C630
ReleaseDC.USER32(?,?), ref: 0041C63D

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 13ad04b8ebeec00c1d7dbe87a4843d5f0ce23703817d7fa7e30356844582fb0f
Instruction ID: 5608d60df95c2c9a4937b8f20fdaccdf81dd4bf5f719291f5ec9f8ce647d196e
Opcode Fuzzy Hash: 13ad04b8ebeec00c1d7dbe87a4843d5f0ce23703817d7fa7e30356844582fb0f
Instruction Fuzzy Hash: 00116DB1A00619BBDF10DBA9CC85FAFB7FCEF48700F14446AB614E7281D67899008B28

Uniqueness

Uniqueness Score: -1.00%

Function 004190A4 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 004190C0
GetSystemMetrics.USER32(0000000D), ref: 004190C8
6F552980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,?), ref: 004190CE

Part of subcall function 00410C48: 6F54C400.COMCTL32(?,000000FF,00000000,004190FC,00000000,00419158,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,?), ref: 00410C4C

6F5BCB00.COMCTL32(?,00000000,00000000,00000000,00000000,00419158,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,?), ref: 0041911E
6F5BC740.COMCTL32(00000000,?,?,00000000,00000000,00000000,00000000,00419158,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00419129
6F5BCB00.COMCTL32(?,00000001,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00419158,?,00000000,0000000D,00000000), ref: 0041913C
6F550860.COMCTL32(?,0041915F,?,00000000,?,?,00000000,00000000,00000000,00000000,00419158,?,00000000,0000000D,00000000,0000000E), ref: 00419152

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: MetricsSystem$C400C740F550860F552980
String ID:
API String ID: 1828538299-0
Opcode ID: 3537cdd0f738fbfcd60e26d14cefecc9ad32e9dd8feb771d9bbef366dd2eac9a
Instruction ID: 9903b46d79d4c0b31f098cc3390b5efedd2ad94e5cf824da9eef417fc70482b9
Opcode Fuzzy Hash: 3537cdd0f738fbfcd60e26d14cefecc9ad32e9dd8feb771d9bbef366dd2eac9a
Instruction Fuzzy Hash: 0611B971B44204BBEB14EFA5CC87F9E73B9EB09704F504166B604EB2C1E5B99D848B58

Uniqueness

Uniqueness Score: -1.00%

Function 00485058 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00485110), ref: 004850F5

Strings

LanmanNT, xrefs: 004850BF
ServerNT, xrefs: 004850D9
System\CurrentControlSet\Control\ProductOptions, xrefs: 0048507C
ProductType, xrefs: 00485094
WinNT, xrefs: 004850A5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 304b87013fd73cebd731c15b714bf00be093f8607f48a127b9e7105ed494b01e
Instruction ID: 02a49102d00d8724c0d73e8972acf5231ddb46999e19ea23a0f5791770e41de6
Opcode Fuzzy Hash: 304b87013fd73cebd731c15b714bf00be093f8607f48a127b9e7105ed494b01e
Instruction Fuzzy Hash: FE11B230A04644ABDB00F766DC56B5F7BA8DB42744F508877A800DB782D73D9E41975D

Uniqueness

Uniqueness Score: -1.00%

Function 0044CD48 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044CD18: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0044CD30

LoadLibraryA.KERNEL32(00000000,00000000,0044CE0A,?,?,?,?,00000000,00000000), ref: 0044CD92
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044CDA3
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044CDB3

Strings

LresultFromObject, xrefs: 0044CD9D
CreateStdAccessibleObject, xrefs: 0044CDAD
oleacc.dll, xrefs: 0044CD7F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2141747552-1050967733
Opcode ID: ea022944773ab25f9a4076fd398f24179dfceb8cd9828e0392caa77096e119c9
Instruction ID: 55534d0cd89e21a5042de7d2cb1dd0110792ae2e246426a933e63f936c6ed6e6
Opcode Fuzzy Hash: ea022944773ab25f9a4076fd398f24179dfceb8cd9828e0392caa77096e119c9
Instruction Fuzzy Hash: 361151B0A01704AFF710EFA1DCC2B5A7BA8E758719F64047BE400666A1DBBD9D448A1C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8B2 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B8C0
SelectObject.GDI32(?,00000000), ref: 0041B8CF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B8FB
SelectObject.GDI32(00000000,00000000), ref: 0041B909
SelectObject.GDI32(?,00000000), ref: 0041B917
DeleteDC.GDI32(00000000), ref: 0041B920
DeleteDC.GDI32(?), ref: 0041B929

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: c5d1e2e3ff328356a4e4238c7f450765dbf7839f38aeea7c0d55facf19ccd353
Instruction ID: b8528283d587f8f5f7158778d976388ea9280e6d202ec49eeb693ac58173ed71
Opcode Fuzzy Hash: c5d1e2e3ff328356a4e4238c7f450765dbf7839f38aeea7c0d55facf19ccd353
Instruction Fuzzy Hash: 5A118EB2F04619ABDB10D6DDC885FEFB7BCEB08314F044415B614FB241C678AD418B54

Uniqueness

Uniqueness Score: -1.00%

Function 004237E4 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004237FF
WindowFromPoint.USER32(?,?), ref: 0042380C
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042381A
GetCurrentThreadId.KERNEL32 ref: 00423821
SendMessageA.USER32(00000000,00000084,?,?), ref: 0042383A
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423851
SetCursor.USER32(00000000), ref: 00423863

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: bca67253d695687129505d4dd6b4be75de0481567bd8dbfc76009214d22bf118
Instruction ID: d55a13ab3e3fc67d9c1f0c697d1027359b93869cc9afd0973a071b09e334c979
Opcode Fuzzy Hash: bca67253d695687129505d4dd6b4be75de0481567bd8dbfc76009214d22bf118
Instruction Fuzzy Hash: 9901D42230521036D6207B7A5C86E2F22E8CBC5B65F51443FB609BF282D93D8C01976D

Uniqueness

Uniqueness Score: -1.00%

Function 00496C14 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00496C24
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00496C31
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00496C3E

Strings

MonitorFromRect, xrefs: 00496C2B
GetMonitorInfoA, xrefs: 00496C38
user32.dll, xrefs: 00496C1F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 1a62ebb246959f38fae6f97a16ae9b6e3f147e8fdc483f677f644595477796c0
Instruction ID: 0100053a3692f287516410ec157e21cb1b88c24c6f2ed11ec452f60a58bd69cd
Opcode Fuzzy Hash: 1a62ebb246959f38fae6f97a16ae9b6e3f147e8fdc483f677f644595477796c0
Instruction Fuzzy Hash: 5AF0F692701B1526DA1025764C81B7B698CCBC27A0F060037BD85A7382E9AD9C0552AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045D984 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045D98D
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045D99D
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045D9AD

Strings

ArcFourInit, xrefs: 0045D997
ArcFourCrypt, xrefs: 0045D9A7
ISCryptGetVersion, xrefs: 0045D987

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: a120c3d2ef62b36cbcf1f94c94fb794ce275c00622819f97a022044a312cbe17
Instruction ID: 0705cba7109997b41c54f5ec5154c4026f190107a5f336fc7dc4235633f43cad
Opcode Fuzzy Hash: a120c3d2ef62b36cbcf1f94c94fb794ce275c00622819f97a022044a312cbe17
Instruction Fuzzy Hash: E9F030F1901620EBF314EF77AC457273695EBA4302F14843BA445E11B2D7BA085AEA2C

Uniqueness

Uniqueness Score: -1.00%

Function 0045DE84 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045DE8D
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045DE9D
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045DEAD

Strings

BZ2_bzDecompress, xrefs: 0045DE97
BZ2_bzDecompressEnd, xrefs: 0045DEA7
BZ2_bzDecompressInit, xrefs: 0045DE87

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 69782b4271ac4a522c1cbf050024bd159fbeab52ed8ba1f2270972ee26ec74bc
Instruction ID: ffc1661d06bbefe96a91e36acebf6432405697aaa326f86a6f465272ccde7cfc
Opcode Fuzzy Hash: 69782b4271ac4a522c1cbf050024bd159fbeab52ed8ba1f2270972ee26ec74bc
Instruction Fuzzy Hash: 84F01DB1D00A18DED724DF37AC4A72736D5EF74316F08843BA9465A2A2D7B80858DF1D

Uniqueness

Uniqueness Score: -1.00%

Function 0042EE6C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,0049B934,004579ED,00457D90,00457944,00000000,00000B06,00000000,00000000,00000000,00000002,00000000,00482671), ref: 0042EE85
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EE8B
InterlockedExchange.KERNEL32(0049D66C,00000001), ref: 0042EE9C

Part of subcall function 0042EDFC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EEC0,00000004,0049B934,004579ED,00457D90,00457944,00000000,00000B06,00000000,00000000,00000000,00000002,00000000), ref: 0042EE12
Part of subcall function 0042EDFC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EE18
Part of subcall function 0042EDFC: InterlockedExchange.KERNEL32(0049D664,00000001), ref: 0042EE29

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,0049B934,004579ED,00457D90,00457944,00000000,00000B06,00000000,00000000,00000000,00000002,00000000), ref: 0042EEB0

Strings

user32.dll, xrefs: 0042EE80
ChangeWindowMessageFilterEx, xrefs: 0042EE7B

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 147ab314087a4e3dcf6e16000bf7a92f8a6b53821ee1abd9afb0821482d3c5ed
Instruction ID: d923442659e3b0e51499426f76f6993fec2ee5a704375d7ef0c30b5e995126c2
Opcode Fuzzy Hash: 147ab314087a4e3dcf6e16000bf7a92f8a6b53821ee1abd9afb0821482d3c5ed
Instruction Fuzzy Hash: 1AE06DF1B40724AAEF107B766C86B9B2668EB50769F55003BF104A61E1C7FD0C408A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00479E68 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0049A50C), ref: 00479E6E
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00479E7B
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00479E8B

Strings

kernel32.dll, xrefs: 00479E69
VerifyVersionInfoW, xrefs: 00479E85
VerSetConditionMask, xrefs: 00479E75

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 4eb8c5683a80416fa23ca28207be772c3a68f7a3a60c78b74a0383d4a233a3f9
Instruction ID: 2eb801612c02c2f681ec2550ef92dd2b82403b3208254216f30f7223daafca7c
Opcode Fuzzy Hash: 4eb8c5683a80416fa23ca28207be772c3a68f7a3a60c78b74a0383d4a233a3f9
Instruction Fuzzy Hash: BFC0C9E1680710A9D600F7725C82DBB2548D510B25310883FB499651D2E7BD0C144A2C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BABC Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BB95
GetDC.USER32(?), ref: 0041BBA1
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BBD6
RealizePalette.GDI32(00000000), ref: 0041BBE2
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC10
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BC44

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID:
API String ID: 3275473261-0
Opcode ID: 2f364fcd98ee6a1d62b7c654a57492f5fb96a9e1e42606f87797115b42be741f
Instruction ID: d5c29bb792210f064481fc70285f12689ccfb8d13ad776c980584781b3891df8
Opcode Fuzzy Hash: 2f364fcd98ee6a1d62b7c654a57492f5fb96a9e1e42606f87797115b42be741f
Instruction Fuzzy Hash: E4511E74A002099FCF11DFA9C895AEEBBB5FF49704F10406AF500A7790D779AD81CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BE67
GetDC.USER32(?), ref: 0041BE73
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BEAD
RealizePalette.GDI32(00000000), ref: 0041BEB9
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BEDD
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BF11

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID:
API String ID: 3275473261-0
Opcode ID: 6a42abb991037a6bf202db87d3771568c300b6986fb43c24206afdf92edcb334
Instruction ID: 6bf5c6e251c24ad455d3524f1730cbba616f151bd8f8db37d5e0169c444cf9bf
Opcode Fuzzy Hash: 6a42abb991037a6bf202db87d3771568c300b6986fb43c24206afdf92edcb334
Instruction Fuzzy Hash: FD511875A002089FCB11DFA9C891AAEBBF5FF49700F11846AF504EB390D7789D40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041B958 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B9CE
GetDC.USER32(?), ref: 0041B9DA
GetDeviceCaps.GDI32(?,00000068), ref: 0041B9F6
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041BA13
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041BA2A
ReleaseDC.USER32(?,?), ref: 0041BA76

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: aaad342ca44b07dec6af6486a8a42c1cb8d3efc41e270446eeb3d15c1de1c0ff
Instruction ID: 59801f7e5fcc4ac8ef53bb63f5e7b2fd9dc64a74171921ba3453a8653c00992f
Opcode Fuzzy Hash: aaad342ca44b07dec6af6486a8a42c1cb8d3efc41e270446eeb3d15c1de1c0ff
Instruction Fuzzy Hash: A941C371A042189FCB10DFB9C885A9FBBB4EF49740F1484AAF940EB351D2389D11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045D848 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045D914,?,?,?,?,00000000), ref: 0045D8B3
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045D980,?,00000000,0045D914,?,?,?,?,00000000), ref: 0045D8F2

Strings

CURRENT_USER, xrefs: 0045D887
MACHINE, xrefs: 0045D896
USERS, xrefs: 0045D8A5
CLASSES_ROOT, xrefs: 0045D878

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: bceaa7c9d38e855be30fb0ce12922fb4a40a0d74626b7c5ce76b3f9998da2675
Instruction ID: 7ee2480e64cf5dcc37247868779a06df4fe5ff89f2b42202383772de8024ccfa
Opcode Fuzzy Hash: bceaa7c9d38e855be30fb0ce12922fb4a40a0d74626b7c5ce76b3f9998da2675
Instruction Fuzzy Hash: 4811BB75A04204AFE731EBE1C941B9E76ADDF44306F604077AD0496383D67C5F0A952D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C1DC Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041C225
GetSystemMetrics.USER32(0000000C), ref: 0041C22F
GetDC.USER32(00000000), ref: 0041C239
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041C260
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041C26D
ReleaseDC.USER32(00000000,00000000), ref: 0041C2A6

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 3e92d3a5d6c5ecb792e0ebd5600fae34c9b68402c42568e6e1a494463c386ac3
Instruction ID: bd62dbbe377736d475eb9c8390e540ebf9edbe2df99a0055a8dbd9c6863756d8
Opcode Fuzzy Hash: 3e92d3a5d6c5ecb792e0ebd5600fae34c9b68402c42568e6e1a494463c386ac3
Instruction Fuzzy Hash: CA214A74E44608AFEB00EFE9C942BEEB7B4EB48700F10806AF514B7381D6785940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00474770 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045D848: SetLastError.KERNEL32(00000057,00000000,0045D914,?,?,?,?,00000000), ref: 0045D8B3

GetLastError.KERNEL32(00000000,00000000,00000000,00474844,?,?,0049E1E4,00000000), ref: 004747FD
GetLastError.KERNEL32(00000000,00000000,00000000,00474844,?,?,0049E1E4,00000000), ref: 00474813

Strings

Failed to set permissions on registry key (%d)., xrefs: 00474824
I, xrefs: 00474785
Could not set permissions on the registry key because it currently does not exist., xrefs: 00474807
Setting permissions on registry key: %s\%s, xrefs: 004747C2

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s$I
API String ID: 1452528299-1959139981
Opcode ID: fa1a9a8d389e764d463da442ef7f1c9e05787aef6c03ccc219f4a1874d89d582
Instruction ID: 89f83d431bb9d789a293ecef52b9ab2aae7d8ed3921fa29d9781309811a141fd
Opcode Fuzzy Hash: fa1a9a8d389e764d463da442ef7f1c9e05787aef6c03ccc219f4a1874d89d582
Instruction Fuzzy Hash: 15217774A042485FDB00EBA9C8416FEBBE8DB89314F51817BE414E7392DB785D058BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0047FA5C Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047FA6A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046DA09), ref: 0047FA90
GetWindowLongA.USER32(?,000000EC), ref: 0047FAA0
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047FAC1
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047FAD5
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047FAF1

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: abe530f147a2c3f98821beb69050e02df951cc1f08551c366297f014f152c27b
Instruction ID: ffd9c37a1d4b3a018da72acb707aca8a1d598a80d0625303fdebb2ead6bb840a
Opcode Fuzzy Hash: abe530f147a2c3f98821beb69050e02df951cc1f08551c366297f014f152c27b
Instruction Fuzzy Hash: D301E9B6A54210ABD600DB78CD41F6637E8AB0C310F0A4776FA5DDF3E3C679D8048A08

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6C0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041AB30: CreateBrushIndirect.GDI32 ref: 0041AB9B

UnrealizeObject.GDI32(00000000), ref: 0041B6CC
SelectObject.GDI32(?,00000000), ref: 0041B6DE
SetBkColor.GDI32(?,00000000), ref: 0041B701
SetBkMode.GDI32(?,00000002), ref: 0041B70C
SetBkColor.GDI32(?,00000000), ref: 0041B727
SetBkMode.GDI32(?,00000001), ref: 0041B732

Part of subcall function 0041A4A8: GetSysColor.USER32(?), ref: 0041A4B2

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 591f5e0a38fc1ca3dbe863e806ec08e439b2c286ec032ca355b2d19c4403f824
Instruction ID: 4060aa1d5abe481981ad85160ceff6bfe730d60da31349b060da60163fdb8f1a
Opcode Fuzzy Hash: 591f5e0a38fc1ca3dbe863e806ec08e439b2c286ec032ca355b2d19c4403f824
Instruction Fuzzy Hash: AAF0CD75601100ABDE04FFBADACAE4B77989F043097048057B908DF197CA7CE8A08B3A

Uniqueness

Uniqueness Score: -1.00%

Function 00499644 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00424714: SetWindowTextA.USER32(?,00000000), ref: 0042472C

ShowWindow.USER32(?,00000005,00000000,004998A9,?,?,00000000), ref: 0049967A

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Part of subcall function 004076F8: SetCurrentDirectoryA.KERNEL32(00000000,?,004996A2,00000000,00499875,?,?,00000005,00000000,004998A9,?,?,00000000), ref: 00407703

Part of subcall function 0042D89C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D92A,?,?,?,00000001,?,0045681A,00000000,00456882), ref: 0042D8D1

Strings

Uninstall, xrefs: 00499660
.msg, xrefs: 004996E0
IMsg, xrefs: 0049974E
.dat, xrefs: 004996C1

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: b59174c22afc0cb4d84e45ba041c7c5ab1d45157887829cd53cd9da25efcf179
Instruction ID: 4da38b6a349b60b5a60df07f01633cb26419001f7db46277bbb3aa66fc0d4d29
Opcode Fuzzy Hash: b59174c22afc0cb4d84e45ba041c7c5ab1d45157887829cd53cd9da25efcf179
Instruction Fuzzy Hash: A1313074A10114AFCB01FFAACC5295E7B75FB49318B51887AF800A7352EB39AD04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042EEF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EF2A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EF30
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EF59

Strings

user32.dll, xrefs: 0042EF25
ShutdownBlockReasonCreate, xrefs: 0042EF20

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: 0a1a7f0b35af10bec52672da06a2906d532a44599cf47327945e1bb0849fc05d
Instruction ID: 50bd107db23699165094570332042a9a2090c4fb9dd7a9a9ac1c8e9692f1be1d
Opcode Fuzzy Hash: 0a1a7f0b35af10bec52672da06a2906d532a44599cf47327945e1bb0849fc05d
Instruction Fuzzy Hash: D7F0F0E134062237E620B27FAC86F7F55CC8F94729F150036B608EA2C2EA7C9905426F

Uniqueness

Uniqueness Score: -1.00%

Function 004587F4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00458824
GetExitCodeProcess.KERNEL32(?,?), ref: 00458845
CloseHandle.KERNEL32(?,00458878), ref: 0045886B

Strings

GetExitCodeProcess, xrefs: 0045884E
MsgWaitForMultipleObjects, xrefs: 00458831

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: b59af786c083e6c34fb912d8588e02e36760330094b26c60bb33ca54220cd61b
Instruction ID: 4c05e8df3edacc9d455a33c3a45c96e3e51f685ffe720196e50d624f784124f1
Opcode Fuzzy Hash: b59af786c083e6c34fb912d8588e02e36760330094b26c60bb33ca54220cd61b
Instruction Fuzzy Hash: 3E01A274A00204AFDB10FBA98C52A1E73A8EB45715FA0057AFD10F73D2DE39AD048A28

Uniqueness

Uniqueness Score: -1.00%

Function 0042EDFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EEC0,00000004,0049B934,004579ED,00457D90,00457944,00000000,00000B06,00000000,00000000,00000000,00000002,00000000), ref: 0042EE12
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EE18
InterlockedExchange.KERNEL32(0049D664,00000001), ref: 0042EE29

Strings

user32.dll, xrefs: 0042EE0D
ChangeWindowMessageFilter, xrefs: 0042EE08

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 2ae9261505c9f67baa706182e7b3239f9e45ce3b55a3ca64683e2b7ae62260b5
Instruction ID: 37ab6c1781d9ace597be808b0f82a5ae7151ca86b9dce60fc565c366ef428a29
Opcode Fuzzy Hash: 2ae9261505c9f67baa706182e7b3239f9e45ce3b55a3ca64683e2b7ae62260b5
Instruction Fuzzy Hash: 76E0ECB1B41320AAEA1137726C8AF5726559B2471DF950437F108671E2C6FC1C84C91D

Uniqueness

Uniqueness Score: -1.00%

Function 00478DDC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00478DE4
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00478EDB,0049E0AC,00000000), ref: 00478DF7
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00478DFD

Strings

user32.dll, xrefs: 00478DF2
AllowSetForegroundWindow, xrefs: 00478DED

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: baaddf851ddbcde89e908f2650d0d7dd5a96bc2ff5b27e890b2c54087906d01e
Instruction ID: c95bb4f0dd120990503e7052118a19d741abdcedadff55ee9c16c600a1fe714f
Opcode Fuzzy Hash: baaddf851ddbcde89e908f2650d0d7dd5a96bc2ff5b27e890b2c54087906d01e
Instruction Fuzzy Hash: EFD09EB168060165E910B3B69D4AE9B235C89847647248C3FB458E2586DF7CD894457D

Uniqueness

Uniqueness Score: -1.00%

Function 0041707C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 004170A2
SaveDC.GDI32(?), ref: 004170D3
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00417195), ref: 00417134
RestoreDC.GDI32(?,?), ref: 0041715B
EndPaint.USER32(00000000,?,0041719C,00000000,00417195), ref: 0041718F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: d3cb791d7785fb4fc35c1181fb0c895e71633609ec102f90fedaf0bd5e116ec9
Instruction ID: 2d0e89e5730252ba578d2efb55dda1d595b63161fefa896777b830b1b9f6ffa1
Opcode Fuzzy Hash: d3cb791d7785fb4fc35c1181fb0c895e71633609ec102f90fedaf0bd5e116ec9
Instruction Fuzzy Hash: 9B412170A08204AFDB04DFA5C985FAA77F9FF48314F1544AEE4059B362C7789D85CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00414C50 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414C86
MulDiv.KERNEL32(?,?,?), ref: 00414CA0
MulDiv.KERNEL32(?,?,?), ref: 00414CC9
MulDiv.KERNEL32(?,?,?), ref: 00414CF4
MulDiv.KERNEL32(00000000,?,00000000), ref: 00414D3C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea1a8f7c9869be2cd73ede4559f3beb1d50bc075a71ac7122178a7397227914
Instruction ID: f067b59d413d1c4671d71e094a7f62e666ee1dcd53ee7561759f320ec3b01eff
Opcode Fuzzy Hash: eea1a8f7c9869be2cd73ede4559f3beb1d50bc075a71ac7122178a7397227914
Instruction Fuzzy Hash: 6F314F70605740AFC720EF69D984BABB7E8AF89314F04891EF9D5C7751D638EC808B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C008 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041C01A
GetSystemMetrics.USER32(0000000C), ref: 0041C024
GetDC.USER32(00000000), ref: 0041C062
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041C0A9
DeleteObject.GDI32(00000000), ref: 0041C0EA

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: e9779dfffb4f21f61e506df0ae377518d2b748fc237c0f7807fdb933fd26a7eb
Instruction ID: f919feb2cfdf9cb53746996a9db251afb7e4286801c3fccb61a5d2ca1bdc7bf1
Opcode Fuzzy Hash: e9779dfffb4f21f61e506df0ae377518d2b748fc237c0f7807fdb933fd26a7eb
Instruction Fuzzy Hash: A3313E74A40205EFDB04DFA5C981AAEB7F5EB48704F11856AF510AB381D7789E80DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00429C1C Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429C58
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429C87
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429CA3
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 00429CCE
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 00429CEC

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5ef5cab32e95011e4c7cfb0abff5a7214c11a7d164d3b5ed8cb8a22c4c4654b6
Instruction ID: 0478e77fbb77d274a7bfb783d11adee83c5a4069cdde94f0426c34ba09fc350e
Opcode Fuzzy Hash: 5ef5cab32e95011e4c7cfb0abff5a7214c11a7d164d3b5ed8cb8a22c4c4654b6
Instruction Fuzzy Hash: 222190707107147AE710AFA7DC82F4B76EC9B40704F90443E7906AB2D2DAB8ED41861D

Uniqueness

Uniqueness Score: -1.00%

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 67daf853af92f19bd36af3157ccd0aae30d6e3cf77030be0de76c974993ddc75
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: 67daf853af92f19bd36af3157ccd0aae30d6e3cf77030be0de76c974993ddc75
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Uniqueness

Uniqueness Score: -1.00%

Function 00414830 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414869
RealizePalette.GDI32(00000000), ref: 00414871
SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414885
RealizePalette.GDI32(00000000), ref: 0041488B
ReleaseDC.USER32(00000000,00000000), ref: 00414896

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: fa3b9403a46652b92fdf4541f93f936de0ad42420f7af6617674ce52f43e61da
Instruction ID: aeb03e62d8ddadf83c94429ec28f403801e3a8d1cb621d3e7bfc21001d019430
Opcode Fuzzy Hash: fa3b9403a46652b92fdf4541f93f936de0ad42420f7af6617674ce52f43e61da
Instruction Fuzzy Hash: 3201DF7520C3806AD600B63D8C85A9F6BEC9FCA314F15946EF484DB3C2CA7AC8018761

Uniqueness

Uniqueness Score: -1.00%

Function 004073F4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407453
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 004074CD
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 00407525

Strings

Z, xrefs: 0040748C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: ef725f5677505cc1ece444b72ce86a205eac34b3eeee73834d2775d04d947be5
Instruction ID: 2310e9831ee7c99a0a8649866770d0a98cc310fb2cf5807583ec8a4e9daa3455
Opcode Fuzzy Hash: ef725f5677505cc1ece444b72ce86a205eac34b3eeee73834d2775d04d947be5
Instruction Fuzzy Hash: 41519070E04208AFDB11DF99C845A9EBBB9EB49314F1448BAE400B72D1D778AE418B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0044D598 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D626
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D651
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D6D9

Strings

, xrefs: 0044D60B

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 118ce66f65fc30a3616beabd50b84bb536d9a0cd1ba8fe4db387a67cc8cfb132
Instruction ID: 5f00bac91b28cdab45bfb944687f04cfacea2c0ae70fe3b1c590f7ffbabf3d5b
Opcode Fuzzy Hash: 118ce66f65fc30a3616beabd50b84bb536d9a0cd1ba8fe4db387a67cc8cfb132
Instruction Fuzzy Hash: 7C517271E00248AFDB11DFA9C885BDEBBF8AF49304F15847AE805EB252D7389944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042F400 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042F42A

Part of subcall function 0041A638: CreateFontIndirectA.GDI32(?), ref: 0041A6F7

SelectObject.GDI32(?,00000000), ref: 0042F44D
ReleaseDC.USER32(00000000,?), ref: 0042F52C

Strings

...\, xrefs: 0042F4DE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: d1b66580af5f8b118005d8afe4c27e7b3c53fe3fbe43e40283f5066ed8c29eea
Instruction ID: 21909acc4746510f695b318a8719c62c66087a48e53e42bcbae852ee139bb065
Opcode Fuzzy Hash: d1b66580af5f8b118005d8afe4c27e7b3c53fe3fbe43e40283f5066ed8c29eea
Instruction Fuzzy Hash: E1314270B00229ABDB11EF9AD851BAEB7F9EB48308F90447BF410A7291C7785E45CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00454024 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00498709,_iu,?,00000000,0045415E), ref: 00454113
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00498709,_iu,?,00000000,0045415E), ref: 00454123

Strings

.tmp, xrefs: 004540C7
_iu, xrefs: 004540B5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: 2a078343c1ee0e1e426b7682a7e14f96dd8f6dbcb1786daf15018a65187b9764
Instruction ID: 59545500d2eeb09234598e35ee9a1648d273934097dc79d2b475452d37d3be57
Opcode Fuzzy Hash: 2a078343c1ee0e1e426b7682a7e14f96dd8f6dbcb1786daf15018a65187b9764
Instruction Fuzzy Hash: 8431C570E00209ABCF11EB95C942BEEBBB5AF54309F20452AF900BB3D2D7385F459759

Uniqueness

Uniqueness Score: -1.00%

Function 00416860 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004168CF
UnregisterClassA.USER32(?,00400000), ref: 004168FB
RegisterClassA.USER32(?), ref: 0041691E

Strings

@, xrefs: 00416879

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 9f70a0ac69facbd643e5dc069cf4c50d07a0174cb3081c66f42998cae8c8bb67
Instruction ID: c7ae62685634f2feb307fa6559a912500e41153472d9d2bb59c10c8b55fc2cbc
Opcode Fuzzy Hash: 9f70a0ac69facbd643e5dc069cf4c50d07a0174cb3081c66f42998cae8c8bb67
Instruction Fuzzy Hash: C6318E706043008BDB10EF68C885B9B77E9AB89308F00457FF985DB392DB39DD458B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00499AF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,0049A448,00000000,00499BEE,?,?,00000000,0049D62C), ref: 00499B68
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,0049A448,00000000,00499BEE,?,?,00000000,0049D62C), ref: 00499B91
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00499BAA

Strings

isRS-%.3u.tmp, xrefs: 00499B47

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: 88eac6fa2fd00287dbaa55a3b9bd3a1b65409462b653a3bc96acdfff81af7d31
Instruction ID: 0b841a000e743cb9e8da0cfb8565bc532e10ded45a2cf007f5af54a585f9ef1c
Opcode Fuzzy Hash: 88eac6fa2fd00287dbaa55a3b9bd3a1b65409462b653a3bc96acdfff81af7d31
Instruction Fuzzy Hash: 54212171D14119ABCF00EBA9D881AAFBBB8BB58314F11457EA814B72D1D63C6E018A59

Uniqueness

Uniqueness Score: -1.00%

Function 00457398 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042CC54: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042CC78

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 004573EC
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00457419

Strings

LoadTypeLib, xrefs: 004573F7
RegisterTypeLib, xrefs: 00457424

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: 18df84fe9d86e2862f6386675fb05e4dd3e507c86707e069f339337bab75705e
Instruction ID: 195147ed2e8b8ae7ced7006412bb8845aee82bd7b9f018cfdf51d436bcb33606
Opcode Fuzzy Hash: 18df84fe9d86e2862f6386675fb05e4dd3e507c86707e069f339337bab75705e
Instruction Fuzzy Hash: C911D630B04204BFDB01DFA6DC51A4EBBADEB4A305F108076FD04D3652DA389E04C618

Uniqueness

Uniqueness Score: -1.00%

Function 00457950 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 0045796A
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 00457A07

Strings

Failed to create DebugClientWnd, xrefs: 004579D0
Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00457996

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 96d37884a0109ccc9dd8bbdd55bd34cbe6755c3aabe39c11de9650ea9973cdf2
Instruction ID: b12cfe17c44d9b7297a0742d7ace06ebf4c30bfebd2037bde928bbf0dce3c7c1
Opcode Fuzzy Hash: 96d37884a0109ccc9dd8bbdd55bd34cbe6755c3aabe39c11de9650ea9973cdf2
Instruction Fuzzy Hash: 1311C4B16082509BE310AB299C81B5F77949B54319F04443BF9849F383D3B99C18C7AE

Uniqueness

Uniqueness Score: -1.00%

Function 00479934 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00424714: SetWindowTextA.USER32(?,00000000), ref: 0042472C

GetFocus.USER32 ref: 0047999F
GetKeyState.USER32(0000007A), ref: 004799B1
WaitMessage.USER32(?,00000000,004799D8,?,00000000,004799FF,?,?,00000001,00000000,?,?,0048174F,00000000,00482671), ref: 004799BB

Strings

Wnd=$%x, xrefs: 00479983

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: c7714a687ecd515da0b3d99d6b7bbb34f6b1e8ac2199ab9b74b109a4a99a3c73
Instruction ID: 0ce6ec70c77c992717eb959f135b56f98f7128e6f958ad4e09c8363bf76ba6b5
Opcode Fuzzy Hash: c7714a687ecd515da0b3d99d6b7bbb34f6b1e8ac2199ab9b74b109a4a99a3c73
Instruction Fuzzy Hash: 0511A3B0604244AFDB00FF69D842ADEB7B8EB49704B51C5BBF508E7381D738AD00CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0046F428 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046F430
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046F43F

Strings

(invalid), xrefs: 0046F4C2
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046F4B4

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: b3309c05ae6708dc9511693656f5da53199351be95235e45feba58672e8eaade
Instruction ID: b1f3f51ab816b97a6d4fd488e4796d5760ecc8acc51059d8482d4647201c4143
Opcode Fuzzy Hash: b3309c05ae6708dc9511693656f5da53199351be95235e45feba58672e8eaade
Instruction Fuzzy Hash: F111F5A040C3919AD340DF2AC44072BBAE4AB99708F44896FF9C8D6381E779C948DB67

Uniqueness

Uniqueness Score: -1.00%

Function 004546DE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 004546EB

Part of subcall function 004073A0: DeleteFileA.KERNEL32(00000000,0049D62C,00499FD9,00000000,0049A02E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 004073AB

MoveFileA.KERNEL32(00000000,00000000), ref: 00454710

Part of subcall function 00453C04: GetLastError.KERNEL32(00000000,00454799,00000005,00000000,004547CE,?,?,00000000,0049D62C,00000004,00000000,00000000,00000000,?,00499C8D,00000000), ref: 00453C07

Strings

DeleteFile, xrefs: 004546FC
MoveFile, xrefs: 00454719

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: cd51b7d6411f51ddff926bfb4089fa62fb2906befb808aa5ea3769e8c14f62c4
Instruction ID: 274a2e09890dd6abd1f20e60e4879b25532b4b8e44e7f96c1dbb1ac345d4d7c6
Opcode Fuzzy Hash: cd51b7d6411f51ddff926bfb4089fa62fb2906befb808aa5ea3769e8c14f62c4
Instruction Fuzzy Hash: 53F08B746141445BE701FBA5D94265FA7ECEB8431EF50403BB800BB6C3DB3C9D08492D

Uniqueness

Uniqueness Score: -1.00%

Function 00484FB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00484FF1
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00485014

Strings

System\CurrentControlSet\Control\Windows, xrefs: 00484FBE
CSDVersion, xrefs: 00484FE8

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: b9e36cadc727804c5f11a8465414363a5b518042b18c79ea3b7dd3ea96185e79
Instruction ID: 3d9820a6fde95d05ac542d305ffe0a0e534a7c1f4e1b62a11fb8fb702f882c01
Opcode Fuzzy Hash: b9e36cadc727804c5f11a8465414363a5b518042b18c79ea3b7dd3ea96185e79
Instruction Fuzzy Hash: E7F04975A40608E6DF10FAD18C55BDF73BCAB05704F604967E510E7281E7399A049BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00465214 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044BB28: LoadLibraryA.KERNEL32(00000000,00000000,0044BF0B,?,?,?,?,00000000,00000000,?,0044FD4D,0049A4DA), ref: 0044BB8A
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044BBA2
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044BBB4
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044BBC6
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044BBD8
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BBEA
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044BBFC
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044BC0E
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044BC20
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044BC32
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044BC44
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044BC56
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044BC68
Part of subcall function 0044BB28: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044BC7A

Part of subcall function 004651E8: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004651FB

LoadLibraryA.KERNEL32(00000000,SHPathPrepareForWriteA,00000000,0046528A,?,?,?,?,00000000,00000000,?,0049A502), ref: 0046525F
GetProcAddress.KERNEL32(00000000,00000000), ref: 00465265

Strings

SHPathPrepareForWriteA, xrefs: 00465231
shell32.dll, xrefs: 0046524C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressProc$LibraryLoad$DirectorySystem
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 1442766254-2683653824
Opcode ID: 19c949dbb77f1a78b4d411d9c1a27eb2db95fd8b53bd2c0869d9e8e17518ae75
Instruction ID: 415eb7409d81aa8454bb2dd4c72fa8b3e514a75415032da6adba06dceafb32ff
Opcode Fuzzy Hash: 19c949dbb77f1a78b4d411d9c1a27eb2db95fd8b53bd2c0869d9e8e17518ae75
Instruction Fuzzy Hash: F5F04470640A08BFD700FB62DC53F5E7BACEB45718FA044B7B400B6591EA7C9E04892D

Uniqueness

Uniqueness Score: -1.00%

Function 00459B60 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459C9D,00000000,00459E55,?,00000000,00000000,00000000), ref: 00459BAD

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 00459B80
.NET Framework not found, xrefs: 00459BBC
InstallRoot, xrefs: 00459B9C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: acc62e2c204e9e12f698e5b82add5e4ad09bb42f8c2d9db489e2300f4fff8397
Instruction ID: 9ff5366a1843594bb80037a440052cb9e88b760eaf161db27522a6c9f4c26c6f
Opcode Fuzzy Hash: acc62e2c204e9e12f698e5b82add5e4ad09bb42f8c2d9db489e2300f4fff8397
Instruction Fuzzy Hash: 2AF0AF31300121EBEB10EB17AC41B5E6789DB91316F18443BFA81C7253F6BCDC46862E

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,004542C2,00000000,00454365,?,?,00000000,00000000,00000000,00000000,00000000,?,00454755,00000000), ref: 0042DD5A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042DD60

Strings

kernel32.dll, xrefs: 0042DD55
GetSystemWow64DirectoryA, xrefs: 0042DD50

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 5abbe40046ba00350f24005cef1803a495b962ffc597d09d0b22329c5a666800
Instruction ID: 2c7f72bc3db4c40d16b1b765d912767d34fa58fe4c646cc18e222b4ed7f6fe44
Opcode Fuzzy Hash: 5abbe40046ba00350f24005cef1803a495b962ffc597d09d0b22329c5a666800
Instruction Fuzzy Hash: 0FE02660B60F1113D70071BA5C8379B208D4B84718F90043F3984F52C6DDBDD9490A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0042EFA4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EF20), ref: 0042EFB2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EFB8

Strings

user32.dll, xrefs: 0042EFAD
ShutdownBlockReasonDestroy, xrefs: 0042EFA8

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: baf4c7a8591a40d7dc6da6f15e5b4dc27338d30cfca151258ddc16df194b77c5
Instruction ID: 02ec898c6c75b1ba26151a3eebd585b8454ae7040b346800783755fde70e6890
Opcode Fuzzy Hash: baf4c7a8591a40d7dc6da6f15e5b4dc27338d30cfca151258ddc16df194b77c5
Instruction Fuzzy Hash: 01D0A993302B3332AA1071FB3DC19BB02CC8D202AA3670033F600E2280EA8CCC4012AC

Uniqueness

Uniqueness Score: -1.00%

Function 0044FD1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,0049A4DA), ref: 0044FD57
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044FD5D

Strings

NotifyWinEvent, xrefs: 0044FD4D
user32.dll, xrefs: 0044FD52

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: 21449735c4530238711e5baf3f7e6c6119c4b5ed48e58139290ccade4ce38153
Instruction ID: af032255d430417ffea63134fe83afc5c4b4dbba1536058c56e775f9f11b8dd5
Opcode Fuzzy Hash: 21449735c4530238711e5baf3f7e6c6119c4b5ed48e58139290ccade4ce38153
Instruction Fuzzy Hash: B2E012E0E417449AFB00BBB96D467193AD0EF6471DF10007FB540A6291C77C44489B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0049A250 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,0049A530,00000001,00000000,0049A554), ref: 0049A25A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049A260

Strings

user32.dll, xrefs: 0049A255
DisableProcessWindowsGhosting, xrefs: 0049A250

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 51550ffda035ac84042d4bddea94f20537adf7cd2f58fd56988f617bc6aacde1
Instruction ID: dac1c8ebddd32ae9bf6a035aad1c8d1f3cf840f271d0053423bdda14aa0d062e
Opcode Fuzzy Hash: 51550ffda035ac84042d4bddea94f20537adf7cd2f58fd56988f617bc6aacde1
Instruction Fuzzy Hash: 09B09281686A01509C4033F20C06A1B0E08484171871800B73400F12C6CE6E842404FF

Uniqueness

Uniqueness Score: -1.00%

Function 00476744 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042F2BC: GetTickCount.KERNEL32 ref: 0042F2C2

Part of subcall function 0042F0D8: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042F10D

GetLastError.KERNEL32(00000000,004768B9,?,?,0049E1E4,00000000), ref: 004767A2

Strings

LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 00476877
, xrefs: 004767DA, 004767F5
MoveFileEx, xrefs: 00476807

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: 60709b24bbd29ecba445f14f57d2c4ad189bd31ebd78b2e227524017e35208ed
Instruction ID: 03a236e7dc5f504d91790a0ce298dd5dba96fa6117a2cc3ee4ad00c9fc2b7c38
Opcode Fuzzy Hash: 60709b24bbd29ecba445f14f57d2c4ad189bd31ebd78b2e227524017e35208ed
Instruction Fuzzy Hash: 53418474A006098BCB00EFA5D882ADE77B9EF48314F52853BE414B7391D7389E05CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00414148 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00414196
GetDesktopWindow.USER32 ref: 0041424E

Part of subcall function 00419310: 6F5BC6F0.COMCTL32(00000000,?,0041427E,?,?,?,?,00413F43,00000000,00413F56), ref: 0041932C
Part of subcall function 00419310: ShowCursor.USER32(00000001,00000000,?,0041427E,?,?,?,?,00413F43,00000000,00413F56), ref: 00419349

SetCursor.USER32(00000000,?,?,?,?,00413F43,00000000,00413F56), ref: 0041428C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: cfce6284985b2a2f885b46e24aab87199b3bad27be3208afe6f8a3dae0a7e5f2
Instruction ID: 6a264f145c0982e92da272f414c83554030b66ece25ea6070dcdf00fca6814f6
Opcode Fuzzy Hash: cfce6284985b2a2f885b46e24aab87199b3bad27be3208afe6f8a3dae0a7e5f2
Instruction Fuzzy Hash: 30414170A10151AFC710EF6DDD89B5677E5ABA9318B05807BE409CB366C738DC81CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00408EA4 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408EC5
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408F34
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408FCF
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0040900E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: 6a14109298dd6aa5b23f5014bc90c14a5f309fa4690e2bc273b58c6e1dd153b9
Instruction ID: d606a76aa49eec759d07c5becdfef17a6c6b9766ea912d15a143196380f0994c
Opcode Fuzzy Hash: 6a14109298dd6aa5b23f5014bc90c14a5f309fa4690e2bc273b58c6e1dd153b9
Instruction Fuzzy Hash: C73162706083815AD330EB65C945BDBB7D99F8A304F00483FB6C8D72D2DB799904876B

Uniqueness

Uniqueness Score: -1.00%

Function 0044EE9C Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044EEE5

Part of subcall function 0044D528: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044D55A

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044EF69

Part of subcall function 0042C004: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042C018

IsRectEmpty.USER32(?), ref: 0044EF2B
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044EF4E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 975d6f0bacda975cfe83ce1eab8afcd9494905b79e3112c8c9d866416d3664bd
Instruction ID: 5be5a2c99a49a2f339bd726f9f517b743d06364a043e5a66e7e3b57b404dc1d6
Opcode Fuzzy Hash: 975d6f0bacda975cfe83ce1eab8afcd9494905b79e3112c8c9d866416d3664bd
Instruction Fuzzy Hash: 5B118C3170031027E610BA7E8C82B5F66C99B88748F01483FB60AEB387DDB8DC09835E

Uniqueness

Uniqueness Score: -1.00%

Function 0049720C Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00497270
OffsetRect.USER32(?,00000000,?), ref: 0049728B
OffsetRect.USER32(?,?,00000000), ref: 004972A5
OffsetRect.USER32(?,00000000,?), ref: 004972C0

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 1a73e688525ba1e930e3dbf3898af9d30e9465d405d6debb224a7eeb0afca85c
Instruction ID: e718e50738441f611e1ccbf74e0cde98489d487b8bfa6672397ae6e260ffa509
Opcode Fuzzy Hash: 1a73e688525ba1e930e3dbf3898af9d30e9465d405d6debb224a7eeb0afca85c
Instruction Fuzzy Hash: BE214FB67142016BCB00DF69CD85E5BB7EEEBD4340F14CA2AF544C728AD634E9448796

Uniqueness

Uniqueness Score: -1.00%

Function 00496EC4 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,?), ref: 00496ED9
MulDiv.KERNEL32(50142444,00000008,?), ref: 00496EED
MulDiv.KERNEL32(F6E65FE8,00000008,?), ref: 00496F01
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 00496F1F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865696dda9c04e972e54b31ac7a717d8d8d580924cf1526e353e6871edb84c7d
Instruction ID: e3308cc84e827548128d2b2e4dd5895a6eb2c6c5d9673f95432de963ba277a10
Opcode Fuzzy Hash: 865696dda9c04e972e54b31ac7a717d8d8d580924cf1526e353e6871edb84c7d
Instruction Fuzzy Hash: CB113372604204AFCF40DFA9D8C4D9B7BECEF4D324B15516AF918DB24AD634ED408BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041F8D0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F8C0,?), ref: 0041F8F1
UnregisterClassA.USER32(0041F8C0,00400000), ref: 0041F91A
RegisterClassA.USER32(0049B598), ref: 0041F924
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F95F

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: ae6de89eb0d2e6a3729d1e0b10ea6149efd73b68be0a0487beae6f0a454497aa
Instruction ID: 2f8fb42507e3cd1bc96778dfed7eead12d65e2047fb8f4462c71738803dd6c65
Opcode Fuzzy Hash: ae6de89eb0d2e6a3729d1e0b10ea6149efd73b68be0a0487beae6f0a454497aa
Instruction Fuzzy Hash: B7012DB16141047BCB10FBA8ED81E9A379CD719318B11423BB505E72A1D739D8168BAC

Uniqueness

Uniqueness Score: -1.00%

Function 0040D460 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D477
LoadResource.KERNEL32(00400000,72756F73,0040AC18,00400000,00000001,00000000,?,0040D3D4,00000000,?,00000000,?,?,0047DE64,0000000A,00000000), ref: 0040D491
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040AC18,00400000,00000001,00000000,?,0040D3D4,00000000,?,00000000,?,?,0047DE64), ref: 0040D4AB
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040AC18,00400000,00000001,00000000,?,0040D3D4,00000000,?,00000000,?), ref: 0040D4B5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 073da2e1467bd4923794a1699de9deb8666d8abafae58723814b459cf24724ae
Instruction ID: 736189130eb46f944708fe8ab0dcf7c2da2e7d83e7efdb8d5663637d3260b2f8
Opcode Fuzzy Hash: 073da2e1467bd4923794a1699de9deb8666d8abafae58723814b459cf24724ae
Instruction Fuzzy Hash: FCF04FB3A005046F8B04EE9DA881D5B76DCDE88364310013AFD08EB282DA38DD018B78

Uniqueness

Uniqueness Score: -1.00%

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049D420,00000000,00401A82,?,?,0040222E,022FCCD8,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049D420,0049D420,00000000,00401A82,?,?,0040222E,022FCCD8,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049D420,00000000,00401A82,?,?,0040222E,022FCCD8,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049D420,00401A89,00000000,00401A82,?,?,0040222E,022FCCD8,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: af9432a4a2f11b04810e4d66a6e0dd8d5d7e21dce30ad7e75a74316efdc90f86
Instruction ID: 7339f3ebbe1eed2a5a633cb922c09bf0bd68a71b88021a6e55e3f3fb74b7268e
Opcode Fuzzy Hash: af9432a4a2f11b04810e4d66a6e0dd8d5d7e21dce30ad7e75a74316efdc90f86
Instruction Fuzzy Hash: AB01CCB0E482405EFB19AF699902B293FD4D799748F51803BF441A7AF1CA7C6840CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00456538 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045BFAA,?,?,?,?,?,00000000,0045BFD1), ref: 00456574
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045BFAA,?,?,?,?,?,00000000), ref: 0045657D
RemoveFontResourceA.GDI32(00000000), ref: 0045658A
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0045659E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: cc6cb8f7df9bc38fa4312766b298fdc70083d939990630e9667ecae7c6fe003f
Instruction ID: 60fc6220e6421739c6cddc48edde2e304ed69df2a150d613f8e8855ad9854c81
Opcode Fuzzy Hash: cc6cb8f7df9bc38fa4312766b298fdc70083d939990630e9667ecae7c6fe003f
Instruction Fuzzy Hash: 27F054B174531076EA10B6B6AC47F5B22CC8F54749F54483A7604EB2C3D57CDD04966D

Uniqueness

Uniqueness Score: -1.00%

Function 00470C50 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 00470CA1

Strings

Setting NTFS compression on directory: %s, xrefs: 00470C6F
Unsetting NTFS compression on directory: %s, xrefs: 00470C87
Failed to set NTFS compression state (%d)., xrefs: 00470CB2

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: dfbe84044b29f3d57c509b65a983513d49cbe1f7a65d8e2e78e9d92552162f9b
Instruction ID: 2f8c6a7a6e35e8588bbb9e762321129d74c961a1f58895d436786832a4f1a68a
Opcode Fuzzy Hash: dfbe84044b29f3d57c509b65a983513d49cbe1f7a65d8e2e78e9d92552162f9b
Instruction Fuzzy Hash: 04018B30D09248AACB15D7ED94812DDFBE89F0D305F54C1EFA459E7342DF790A08879A

Uniqueness

Uniqueness Score: -1.00%

Function 004713FC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 0047144D

Strings

Unsetting NTFS compression on file: %s, xrefs: 00471433
Setting NTFS compression on file: %s, xrefs: 0047141B
Failed to set NTFS compression state (%d)., xrefs: 0047145E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: fe182551a98f743fcb6dc7018ea21a6c51c49eaeb083c5d16317d3ad1726425c
Instruction ID: a30ff693f52cd42e459b797e94763e7277481e0955e0c4e592f957c66b82d28b
Opcode Fuzzy Hash: fe182551a98f743fcb6dc7018ea21a6c51c49eaeb083c5d16317d3ad1726425c
Instruction Fuzzy Hash: 41016730D0424866CB1497AD64422DDBBE89F4D315F94C1EFA458E7352DE790A0887AA

Uniqueness

Uniqueness Score: -1.00%

Function 0047944C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,00000001,00000000,00000002,00000000,00482671,?,?,?,?,?,0049A5C3,00000000,0049A5EB), ref: 00479455
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,00000001,00000000,00000002,00000000,00482671,?,?,?,?,?,0049A5C3,00000000), ref: 0047945B
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,00000001,00000000,00000002,00000000,00482671), ref: 0047947D
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,00000001,00000000,00000002,00000000,00482671), ref: 0047948E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 6d49464bdbc91184ad7f6ac62fff289a707b850c7d11bd8742fde9f2fb834cc3
Instruction ID: 6505384fcc0360b3c734b71afb4e1a1a4ab6f9baee95e57f14d901b11eacad59
Opcode Fuzzy Hash: 6d49464bdbc91184ad7f6ac62fff289a707b850c7d11bd8742fde9f2fb834cc3
Instruction Fuzzy Hash: 90F030716447006BD600EAB58D82E9B73DCEB44354F04883EBE98CB2C1D678DC08AB76

Uniqueness

Uniqueness Score: -1.00%

Function 0040627C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040627F
GlobalUnWire.KERNEL32(00000000), ref: 00406286
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040628B
GlobalFix.KERNEL32(00000000), ref: 00406291

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 024a49765fc045a09389489d8ed5919b86daafa6bea6a005e9f609907830066e
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 64B009C6925A46B8EC0473B24C4BD3F041CE88472C3809A6E7554BA0839C7C9C002E3A

Uniqueness

Uniqueness Score: -1.00%

Function 0047B524 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047CE0D,?,00000000,00000000,00000001,00000000,0047B7C1,?,00000000), ref: 0047B785

Strings

Failed to parse "reg" constant, xrefs: 0047B78C
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 0047B5F9

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: aeac2b284915f0d3026f82830a8313e26b9b79e223d2ba9f6b9ae428c97bed97
Instruction ID: f1421b174eee6fc7f54e6f8e7a43c19df08b7389384ab18ee26f4796af10067b
Opcode Fuzzy Hash: aeac2b284915f0d3026f82830a8313e26b9b79e223d2ba9f6b9ae428c97bed97
Instruction Fuzzy Hash: 89815175E00208AFCB10DFA5D481BDEBBF9EF48354F50816AE454A7391DB38AE05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004775F4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,00477727,?,00000000,00477738,?,00000000,00477781), ref: 004776F8
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,00477727,?,00000000,00477738,?,00000000,00477781), ref: 0047770C

Strings

Extracting temporary file: , xrefs: 00477634

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: FileTime$Local
String ID: Extracting temporary file:
API String ID: 791338737-4171118009
Opcode ID: 8d8d29b45fb9742880719863d89589a4356bfd1e7f13b2e05d84abbcd72ab195
Instruction ID: 13e9f88ccb8282ea38195536ff5c63a907cbb836f3d7a61bc1ee4cb3f854d839
Opcode Fuzzy Hash: 8d8d29b45fb9742880719863d89589a4356bfd1e7f13b2e05d84abbcd72ab195
Instruction Fuzzy Hash: 4041B774A04649AFCB01DF65CC91AEFBBB8EB09304F51847AF910A7391D678A901CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0046D8CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046D9F8
Failed to proceed to next wizard page; aborting., xrefs: 0046D9E4

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: add31560b0341e522612951ad2314b824f5c06f277653e44a4d324fe3becfdea
Instruction ID: 84e2974eb34e4f2dda2b8c8cb2eefec3d4715c8d151fead2dfc4afe0ae77ca03
Opcode Fuzzy Hash: add31560b0341e522612951ad2314b824f5c06f277653e44a4d324fe3becfdea
Instruction Fuzzy Hash: 4D319E70F04204EFD711EB69D989BA977F5EB05304F6500BBE408AB3A2D7786E44CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A0E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E26C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,00484FCF,?,00000001,?,?,00484FCF,?,00000001,00000000), ref: 0042E288

RegCloseKey.ADVAPI32(?,0047A1C6,?,?,00000001,00000000,00000000,0047A1E1), ref: 0047A1AF

Strings

%s\%s_is1, xrefs: 0047A158
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0047A13A

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 355d5f519cdb4b3bbdb6712eda2a271a8158444f82fadfbc4a71708306ea76ac
Instruction ID: 0d63d1a050f55a8da938840af3d9f6bfa62d29ba12cdbe4796c61ae60ad15f2e
Opcode Fuzzy Hash: 355d5f519cdb4b3bbdb6712eda2a271a8158444f82fadfbc4a71708306ea76ac
Instruction Fuzzy Hash: 8E216474B042449FEB01DFA9CC516EEBBF8EB89704F90847AE404E7381D7789E158B59

Uniqueness

Uniqueness Score: -1.00%

Function 0045080C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004508A1
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 004508D2

Strings

open, xrefs: 004508C5

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: ecebf72486316a37e3830fd15e4a4b51011a10e5760c3bac1abab3b5df80333e
Instruction ID: f57ce05e9eba324e121f638db0535f08eb0d68243c76b72727f5d658c61a4d86
Opcode Fuzzy Hash: ecebf72486316a37e3830fd15e4a4b51011a10e5760c3bac1abab3b5df80333e
Instruction Fuzzy Hash: 4C216075E00604BFDB00EFA9C981E9EB7F8EB44705F10817AB904F7292D7789A45CB88

Uniqueness

Uniqueness Score: -1.00%

Function 004559F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00455A94
GetLastError.KERNEL32(0000003C,00000000,00455ADD,?,?,?), ref: 00455AA5

Part of subcall function 0042DD14: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042DD27

Strings

<, xrefs: 00455A4E

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: d516e6598b8be20c8747e6ec9c3ac67b1ec18d9ef1beef7a885f0700c60fe9ff
Instruction ID: 1dd1e4a4b05f96b02f6cdc30b2026c57645841094811f513de853399c4f5318c
Opcode Fuzzy Hash: d516e6598b8be20c8747e6ec9c3ac67b1ec18d9ef1beef7a885f0700c60fe9ff
Instruction Fuzzy Hash: 482151B0A00649AFDB00DF65D8926AE7BE8EF08345F50413BF844E7281E7789E49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049D420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049D420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049D420,00000000,00401A82,?,?,0040222E,022FCCD8,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049D420,0049D420,00000000,00401A82,?,?,0040222E,022FCCD8,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049D420,00000000,00401A82,?,?,0040222E,022FCCD8,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049D420,00401A89,00000000,00401A82,?,?,0040222E,022FCCD8,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: 6cd487279c882ad8b73ab70f6921dc77a3e8d3550fda99517b88d6d0f9ae5c50
Instruction ID: 570f99ef1d3d95e4b4d80a2adc1962b98f522b57bc72750d6ce688ebb538822c
Opcode Fuzzy Hash: 6cd487279c882ad8b73ab70f6921dc77a3e8d3550fda99517b88d6d0f9ae5c50
Instruction Fuzzy Hash: CE110131B042046FEB25AF799F1A62AAAD4D79575CB64087FF404F32D2D9BD9C02826C

Uniqueness

Uniqueness Score: -1.00%

Function 00498416 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00498451

Strings

@, xrefs: 0049841C
/INITPROCWND=$%x , xrefs: 0049847C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: 3a83e6e038dbafd0e3ea01eb6dd6426255c1a8b46f58718dc6178500fe069b44
Instruction ID: a9318bdce5e824465d4436be78f64917a5ae5ef5b8220d929174e0d313b11457
Opcode Fuzzy Hash: 3a83e6e038dbafd0e3ea01eb6dd6426255c1a8b46f58718dc6178500fe069b44
Instruction Fuzzy Hash: EF119370A082059FDB01DBA9D851BAEBBE8EF49314F11847BE504E7292EA3C99058B58

Uniqueness

Uniqueness Score: -1.00%

Function 004478B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 00447966

Strings

Unknown Method, xrefs: 0044793F
NIL Interface Exception, xrefs: 00447908

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: ea7a85b9692c4460c5906b58765fb64bf6ee6b5f46e4d7caecedcff591b2af5e
Instruction ID: 10ddd43a001eab7360299ad3f405319ab988bcee1c7d5b08318f9ee426dd8228
Opcode Fuzzy Hash: ea7a85b9692c4460c5906b58765fb64bf6ee6b5f46e4d7caecedcff591b2af5e
Instruction Fuzzy Hash: 9211E9716042089FEB10EFA58D51A6FBBBDEB09304F91403AF500F7281C7789D01C769

Uniqueness

Uniqueness Score: -1.00%

Function 00497C88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00497D50,?,00497D44,00000000,00497D2B), ref: 00497CF6
CloseHandle.KERNEL32(00497D90,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00497D50,?,00497D44,00000000), ref: 00497D0D

Part of subcall function 00497BE0: GetLastError.KERNEL32(00000000,00497C78,?,?,?,?), ref: 00497C04

Strings

D, xrefs: 00497CD0

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: a880bfa9a77c93c91fa9ab75ae7060b7f78cb32e3cfe05dc5138aae6885ad4e0
Instruction ID: a89f5070db7a5e6d261d16ca7c1b7ea99db6432e353ebe52f8e4aa70fd7af1a9
Opcode Fuzzy Hash: a880bfa9a77c93c91fa9ab75ae7060b7f78cb32e3cfe05dc5138aae6885ad4e0
Instruction Fuzzy Hash: 1001A1B0608248AFDB00DBA5DC42FAF7BACDF09704F60013BF504E72C1E6785E008668

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042E1C8
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042E208

Strings

Inno Setup: No Icons, xrefs: 0042E1C6

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 5fa1588eb3983bc8147b11ac52db8119f930d32b550c0df0fd023eaaf2352da0
Instruction ID: e7333c3f072e055346127a6a42ec618886ffe365ff3054ef7f5207155727e60c
Opcode Fuzzy Hash: 5fa1588eb3983bc8147b11ac52db8119f930d32b550c0df0fd023eaaf2352da0
Instruction Fuzzy Hash: 3C01DB32745371A9F73145137D41B7B65CC8B42B60F64057BF941FA2C1DA68AC0592BE

Uniqueness

Uniqueness Score: -1.00%

Function 004535CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,?,00000000,0045362D,?,?,-00000001,?), ref: 00453607
GetLastError.KERNEL32(00000000,?,00000000,0045362D,?,?,-00000001,?), ref: 0045360F

Strings

@8H, xrefs: 0045363D

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: @8H
API String ID: 1799206407-3762495883
Opcode ID: 65c44507f9335e4e2a077e4ee2190135d3d5d768f820153090acd923ffb3f295
Instruction ID: 2a718f5fbeded0ca4f0ca1a684ecb9b724474f3cd93569f9f0dcaab09f3de9c7
Opcode Fuzzy Hash: 65c44507f9335e4e2a077e4ee2190135d3d5d768f820153090acd923ffb3f295
Instruction Fuzzy Hash: 49F0F971A04204BBCB10DF7AAC4249EF7ECDB49362711457BFC14D3342E6784E088598

Uniqueness

Uniqueness Score: -1.00%

Function 004998EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047E3D0: FreeLibrary.KERNEL32(00000000,00482E1B), ref: 0047E3E6

Part of subcall function 0047E0A8: GetTickCount.KERNEL32 ref: 0047E0F2

Part of subcall function 00457A90: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 00457AAF

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0049A243), ref: 00499941
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0049A243), ref: 00499947

Strings

Detected restart. Removing temporary directory., xrefs: 004998FB

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: cf4eeb9d2890f889123e5d43942b6b9d65dcdfa64d28096ccc0edee5f77a06bc
Instruction ID: 3ff60914118e938cb0b4ccf38de38d34f2fcffefe5e82e60aedbfe03ba6cc694
Opcode Fuzzy Hash: cf4eeb9d2890f889123e5d43942b6b9d65dcdfa64d28096ccc0edee5f77a06bc
Instruction Fuzzy Hash: 7DE0E5B12086446EDE1277AB6C1796B3F8CD74A76CB11447FF80491652E82D4C108A3D

Uniqueness

Uniqueness Score: -1.00%

Function 00455E10 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455E2F
Sleep.KERNEL32(?), ref: 00455E3F
GetLastError.KERNEL32 ref: 00455E52
GetLastError.KERNEL32 ref: 00455E5C

Memory Dump Source

Source File: 00000001.00000002.2810735169.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2810706069.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810812058.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810840534.000000000049C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810873970.000000000049D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2810906532.00000000004AD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_starwindconverter.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 162f6e589a9a3ecbf727cd3144cb36b5133ad9a431805f826c669b7668a8d72d
Instruction ID: 0e0098d5c51f6c3332c54b3c49cab550602dc5c9badc8da443834b62d3c24bba
Opcode Fuzzy Hash: 162f6e589a9a3ecbf727cd3144cb36b5133ad9a431805f826c669b7668a8d72d
Instruction Fuzzy Hash: BCF02B32F00914E74F30A76AA88393F628CDA417A6720012BFC04DB303D53CDE0586A8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vc_redist.x64.130.exePID: 4116, Parent PID: 5944COMMON

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 007F66A3 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 325
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 007F6718
_memset.LIBCMT ref: 007F6726
GetFileAttributesW.KERNELBASE(?,?,?,?,00000000,?,00000000), ref: 007F672F
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F674A
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000000,?,00000000), ref: 007F679C
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F67A6
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000000,?,00000000), ref: 007F67F1
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F67FB
FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000000,?,00000000), ref: 007F684D
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F685E
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000000,?,00000000), ref: 007F6940
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000000,?,00000000), ref: 007F6954
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000000,?,00000000), ref: 007F697E
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000000,?,00000000), ref: 007F69A1
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000000,?,00000000), ref: 007F69BA
FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000000,?,00000000), ref: 007F69C9
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F69DD
RemoveDirectoryW.KERNELBASE(?,?,?,?,00000000,?,00000000), ref: 007F69F0
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F69FE
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000000,?,00000000), ref: 007F6A29
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F6A52
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F6A73
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F6A94
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F6AB5
FindClose.KERNEL32(000000FF,?,?,?,00000000,?,00000000), ref: 007F6AE9

Strings

dirutil.cpp, xrefs: 007F676C, 007F6A43
*.*, xrefs: 007F6826
DEL, xrefs: 007F6972

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp_memset$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$dirutil.cpp
API String ID: 4152325254-1252831301
Opcode ID: 7d9ebde762362cbfd67ca2badac17df97d40787ed6215c585a5788c1a8bcbf58
Instruction ID: a9f1432fc91738673770d5acf3f00c51ebd9ea9b98a8ca62dcbeb54d67cdf830
Opcode Fuzzy Hash: 7d9ebde762362cbfd67ca2badac17df97d40787ed6215c585a5788c1a8bcbf58
Instruction Fuzzy Hash: 41B1CA7260011DAADB319B34CC09BBA77B6AFC4714F1581A9E718E3350EA7ADD91DB10

Uniqueness

Uniqueness Score: -1.00%

Function 007F7378 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 184encryptionfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F73CF
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000000,F0000040,00000000,?,00000000,00000000,?,?,007D95E8,00000000,?,?,00000000), ref: 007F73F4
GetLastError.KERNEL32(?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 007F73FE
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?,?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000), ref: 007F743A
GetLastError.KERNEL32(?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 007F7444
CryptHashData.ADVAPI32(?,?,?,00000000,?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?), ref: 007F7495
ReadFile.KERNELBASE(?,?,00001000,?,00000000,?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000), ref: 007F74BA
GetLastError.KERNEL32(?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 007F74C0
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000), ref: 007F74FC
GetLastError.KERNEL32(?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 007F7506
SetFilePointerEx.KERNELBASE(?,?,?,?,00000001,?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000), ref: 007F754F
GetLastError.KERNEL32(?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 007F7559
GetLastError.KERNEL32(?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 007F7580
CryptDestroyHash.ADVAPI32(?,?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 007F75BF
CryptReleaseContext.ADVAPI32(?,00000000,?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000), ref: 007F75D4

Strings

cryputil.cpp, xrefs: 007F75A5

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease_memset
String ID: cryputil.cpp
API String ID: 961722652-2185294990
Opcode ID: 4631d176ef70968a1862ce47cb56d03d86a5bcf2b5698bbe5613d6c5ad2bef3d
Instruction ID: eac2ed635e8ab93145bdde1eff8732b7ed43ea03a69ce3eba45f1b8a926789a4
Opcode Fuzzy Hash: 4631d176ef70968a1862ce47cb56d03d86a5bcf2b5698bbe5613d6c5ad2bef3d
Instruction Fuzzy Hash: BA51B271A0425AFAEB214F649C84BFA7BB8BB08701F1040B5A748E6250E6BDCE94DF55

Uniqueness

Uniqueness Score: -1.00%

Function 007F50CA Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 151libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00000000,?,?,007F52B2,00000000,?,00000000), ref: 007F50E8
GetLastError.KERNEL32(?,?,007F52B2,00000000,?,00000000,?,?,?,?,?,?,?,?,007E386B,007C2222), ref: 007F50F4
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 007F5158
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 007F5164
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 007F516E
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 007F5179
CoCreateInstance.OLE32(00815E58,00000000,00000001,007FACB0,?,?,?,007F52B2,00000000,?,00000000), ref: 007F51B3
ExitProcess.KERNEL32 ref: 007F5268

Strings

xmlutil.cpp, xrefs: 007F511E
Wow64EnableWow64FsRedirection, xrefs: 007F5166
Wow64RevertWow64FsRedirection, xrefs: 007F5170
Wow64DisableWow64FsRedirection, xrefs: 007F515E
kernel32.dll, xrefs: 007F50D4
IsWow64Process, xrefs: 007F5152

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: 384d02b2a7056deb0ece3a2809de9d6a9ba7f6667c4a5ca2dd19ff5babdb1f17
Instruction ID: 1404ff259dd74b1c67f1200fc5b2c8a0599ac972911e8ec968d18166ad2036af
Opcode Fuzzy Hash: 384d02b2a7056deb0ece3a2809de9d6a9ba7f6667c4a5ca2dd19ff5babdb1f17
Instruction Fuzzy Hash: C8513D71A4061EBBDB108FA4CC49BBEBBB8BF44751F104565E714EB280D7B9DA40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 007EF195 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 136threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00815D9C,00000000,00000000,?,00000340,?,?,007C312E,?,Failed to read data for message.,pipe.cpp,00000340,?,?,?,?), ref: 007EF1CB
GetCurrentProcessId.KERNEL32(?,007C312E,?,Failed to read data for message.,pipe.cpp,00000340,?,?,?,?,00000000), ref: 007EF1DA
GetCurrentThreadId.KERNEL32 ref: 007EF1E3
GetLocalTime.KERNEL32(?,?,007C312E,?,Failed to read data for message.,pipe.cpp,00000340,?,?,?,?,00000000), ref: 007EF1F9
LeaveCriticalSection.KERNEL32(00815D9C,?,.1|,00000000,0000FDE9,?,007C312E,?,Failed to read data for message.,pipe.cpp,00000340,?,?,?,?,00000000), ref: 007EF2F3

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 007EF298
.1|, xrefs: 007EF2AE, 007EF2FE, 007EF291, 007EF29D, 007EF2BE

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$.1|
API String ID: 296830338-1898314500
Opcode ID: 8968a30708d9c7030f7d09489720f91f98cc671991220f707379d55929ef2458
Instruction ID: 57a306ebb2c3ee3f2427b81beb9e7112a876287a5b6900f78f26e26fcbf7d44e
Opcode Fuzzy Hash: 8968a30708d9c7030f7d09489720f91f98cc671991220f707379d55929ef2458
Instruction Fuzzy Hash: 0A416D76A0124AEBCB109FE6DC899FEB7B9BB4C311B10403AE605E6250D7389D81DB61

Uniqueness

Uniqueness Score: -1.00%

Function 007D8BE8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 112filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007D8C21
FindFirstFileW.KERNEL32(?,?,?,*.*,?,?,.unverified,?,?,?), ref: 007D8C9A
lstrlenW.KERNEL32(?,?,?), ref: 007D8CC1
FindNextFileW.KERNEL32(00000000,00000010,?,?), ref: 007D8D23
FindClose.KERNEL32(00000000,?,?), ref: 007D8D32

Part of subcall function 007F66A3: _memset.LIBCMT ref: 007F6718
Part of subcall function 007F66A3: _memset.LIBCMT ref: 007F6726
Part of subcall function 007F66A3: GetFileAttributesW.KERNELBASE(?,?,?,?,00000000,?,00000000), ref: 007F672F
Part of subcall function 007F66A3: GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 007F674A

Strings

*.*, xrefs: 007D8C75
.unverified, xrefs: 007D8C30

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: FileFind_memset$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 2873512992-2528915496
Opcode ID: 7de87feaad70ac9853e5ccdd8bbb4cea8b19b59c1f452344bfb4cc84175b04ef
Instruction ID: fd5123525ab7bb7f203ef4a6edfa6b42c3ae932ff0fc922a027c9f15eae386e0
Opcode Fuzzy Hash: 7de87feaad70ac9853e5ccdd8bbb4cea8b19b59c1f452344bfb4cc84175b04ef
Instruction Fuzzy Hash: CF41A471A0166CAEDB60AB64DC49BED7779EF08311F5001E6E508A12D1EA789E80CF25

Uniqueness

Uniqueness Score: -1.00%

Function 007EF326 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,00000000,?,00000000,?,00000000,?,00000000,00000000,?,007EF4E7,00000000,?,00000000,?,00000001), ref: 007EF345
GetLastError.KERNEL32(?,007EF4E7,00000000,?,00000000,?,00000001,?,007C157A,00000000,00000000,00000000,?,?,007D971D,00000002), ref: 007EF34F
LocalFree.KERNEL32(00000000,00000000,?,00000000,?,007EF4E7,00000000,?,00000000,?,00000001,?,007C157A,00000000,00000000,00000000), ref: 007EF3BA

Strings

logutil.cpp, xrefs: 007EF36F

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: a87535f9af32a9bc25812fd0ff9fe4cd35998f079fe7b5e0578eefdb55115b42
Instruction ID: b2f1fcd61b1f3bfc5480ddad9d2ca0af41b9cc8971ec5e88510f1d6a2b9feb58
Opcode Fuzzy Hash: a87535f9af32a9bc25812fd0ff9fe4cd35998f079fe7b5e0578eefdb55115b42
Instruction Fuzzy Hash: 3B11C176201249FBDB21CFA6CD05EAE3779FFC8720F104025F505D5161D3399A50D761

Uniqueness

Uniqueness Score: -1.00%

Function 007F5710 Relevance: 4.5, APIs: 3, Instructions: 43fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F573B
FindFirstFileW.KERNELBASE(00000000,?,00000000,?,80070002), ref: 007F574B
FindClose.KERNEL32(00000000), ref: 007F5757

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Find$CloseFileFirst_memset
String ID:
API String ID: 3141757445-0
Opcode ID: 3a1ae7e652be121fdb5e18eaea7ff485c92ea4d7492e1d551eef9ae34d207ded
Instruction ID: 9b7b5f3ee962fa9054d24c816043016c219d71542505836603b648d960bca7e3
Opcode Fuzzy Hash: 3a1ae7e652be121fdb5e18eaea7ff485c92ea4d7492e1d551eef9ae34d207ded
Instruction Fuzzy Hash: 5101A976A0060CEFD710EFA8ED899BAF3BCEF44719F404165FA15D3280D678AD498B94

Uniqueness

Uniqueness Score: -1.00%

Function 007F235D Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000340,?,007F097E,?,00000340,00000001,?,00000000,?,?,?,?,007EF6D3,?), ref: 007F2371
RtlReAllocateHeap.NTDLL(00000000,?,007F097E,?,00000340,00000001,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000), ref: 007F2378

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: cd070edfb0c13e9ca46aa1fd8ec747dc5e794ade64e12f87241d240a70f143ca
Instruction ID: cf218c2629730da404bef4f357dd8f7b44f63da6138b1ff149abc6e599d28084
Opcode Fuzzy Hash: cd070edfb0c13e9ca46aa1fd8ec747dc5e794ade64e12f87241d240a70f143ca
Instruction Fuzzy Hash: C9D0C97229420ABB8F005FB4DC09CAA7B6CFB54222704C401F919C2110C63ED020DA65

Uniqueness

Uniqueness Score: -1.00%

Function 007CC7EA Relevance: 211.0, APIs: 57, Strings: 63, Instructions: 1021stringCOMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(007C2142,007C2146,007C2142,?,00000000,007C2142,ignored ,00000000,00000000,007C1D56,007C2142,007C2146,007C1E8E,007C2222,007C1F0E,00000000), ref: 007CC85B
GetLastError.KERNEL32 ref: 007CC868
CompareStringW.KERNELBASE(0000007F,00000001,007C1E8C,000000FF,00801B8C,000000FF,007C21DE,00000000,007C1D56,007C2142,007C2146,007C1E8E,007C2222,007C1F0E,00000000,?), ref: 007CC8EC
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,log,000000FF), ref: 007CC908
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00801B80,000000FF), ref: 007CC924
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00801B7C,000000FF), ref: 007CC940
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,help,000000FF), ref: 007CC95C
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00801B6C,000000FF), ref: 007CC978
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,quiet,000000FF), ref: 007CC994
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,00801B5C,000000FF), ref: 007CC9B0
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,silent,000000FF), ref: 007CC9CC
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,passive,000000FF), ref: 007CC9E8
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,norestart,000000FF), ref: 007CCA20
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,forcerestart,000000FF), ref: 007CCA47
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,promptrestart,000000FF), ref: 007CCA6E
CompareStringW.KERNEL32(0000007F,00000001,00000000,000000FF,layout,000000FF), ref: 007CCA91
lstrlenW.KERNEL32(00000000), ref: 007CD0F3
lstrlenW.KERNEL32(burn.), ref: 007CD100
lstrlenW.KERNEL32(burn.), ref: 007CD114
lstrlenW.KERNEL32(burn.,burn.,00000000), ref: 007CD11D
CompareStringW.KERNEL32(0000007F,00000001,00000000,00000000), ref: 007CD130
LocalFree.KERNEL32(00000000,00000000,007C1D56,007C2142,007C2146), ref: 007CD213

Strings

serialcacheandexecute, xrefs: 007CCC2F
log, xrefs: 007CC8FA
Failed to parse elevated connection., xrefs: 007CD2B0
parallelcacheandexecute, xrefs: 007CCC09
Must specify the elevated name, token and parent process id., xrefs: 007CD2A9
disablesystemrestore, xrefs: 007CCC7B
update, xrefs: 007CCB9F
burn.disable.unelevate, xrefs: 007CCFC7
parent, xrefs: 007CCCE5
Failed to parse embedded connection., xrefs: 007CCEAC
Failed to copy path for layout directory., xrefs: 007CCAE8
keepaupaused, xrefs: 007CCBDE
uninstall, xrefs: 007CCAF6
Failed to copy command line., xrefs: 007CC84D
burn.ignoredependencies, xrefs: 007CD003, 007CD00F, 007CD014, 007CD015, 007CD02C, 007CD31B
repair, xrefs: 007CCB25
Failed to copy parent., xrefs: 007CCD24
layout, xrefs: 007CCA83
burn.elevated, xrefs: 007CCDBC
burn.log.append, xrefs: 007CCD6E
Must specify a path for original source., xrefs: 007CD245
burn.embedded.async, xrefs: 007CCEBD
forcerestart, xrefs: 007CCA39
parent:none, xrefs: 007CCD32
burn.related.patch, xrefs: 007CCF68
burn.passthrough, xrefs: 007CCFA0
passive, xrefs: 007CC9DA
core.cpp, xrefs: 007CC892, 007CD23B, 007CD25A, 007CD279, 007CD29F, 007CD2C5, 007CD2EE, 007CD311, 007CD32D, 007CD35D
quiet, xrefs: 007CC986
Must specify a path for log., xrefs: 007CD367
package, xrefs: 007CCB83
Failed to get command line., xrefs: 007CC89C
cache, xrefs: 007CCC4C
Failed to initialize parent to none., xrefs: 007CCD60
burn.related.addon, xrefs: 007CCF4B
burn., xrefs: 007CD0F9, 007CD10E, 007CD113, 007CD11B, 007CD11C
burn.related.upgrade, xrefs: 007CCF2A
Failed to parse unelevated connection., xrefs: 007CCE5A
Missing required parameter for switch: %ls, xrefs: 007CD33C
Failed to allocate the list of ancestors., xrefs: 007CD0DC
burn.embedded, xrefs: 007CCE65
Must specify the embedded name, token and parent process id., xrefs: 007CD2F8
Must specify a path for append log., xrefs: 007CD283
burn.related.detect, xrefs: 007CCEEF
Must specify a value for parent., xrefs: 007CD264
silent, xrefs: 007CC9BE
Failed to allocate the list of dependencies to ignore., xrefs: 007CD06C
modify, xrefs: 007CCB54
Must specify the unelevated name, token and parent process id., xrefs: 007CD2CF
help, xrefs: 007CC94E
burn.unelevated, xrefs: 007CCE13
promptrestart, xrefs: 007CCA60
noaupause, xrefs: 007CCBBB
norestart, xrefs: 007CCA12
originalsource, xrefs: 007CCC98
Failed to copy last used source., xrefs: 007CCCD7
ignored , xrefs: 007CC814
Failed to copy append log file path., xrefs: 007CD28A
burn.related.update, xrefs: 007CCF84
Failed to initialize command line., xrefs: 007CC829
Failed to copy log file path., xrefs: 007CD195
burn.ancestors, xrefs: 007CD073, 007CD07F, 007CD084, 007CD085, 007CD09C, 007CD337
burn.runonce, xrefs: 007CCFE7

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CompareString$lstrlen$ArgvCommandErrorFreeLastLineLocal
String ID: Failed to allocate the list of ancestors.$Failed to allocate the list of dependencies to ignore.$Failed to copy append log file path.$Failed to copy command line.$Failed to copy last used source.$Failed to copy log file path.$Failed to copy parent.$Failed to copy path for layout directory.$Failed to get command line.$Failed to initialize command line.$Failed to initialize parent to none.$Failed to parse elevated connection.$Failed to parse embedded connection.$Failed to parse unelevated connection.$Missing required parameter for switch: %ls$Must specify a path for append log.$Must specify a path for log.$Must specify a path for original source.$Must specify a value for parent.$Must specify the elevated name, token and parent process id.$Must specify the embedded name, token and parent process id.$Must specify the unelevated name, token and parent process id.$burn.$burn.ancestors$burn.disable.unelevate$burn.elevated$burn.embedded$burn.embedded.async$burn.ignoredependencies$burn.log.append$burn.passthrough$burn.related.addon$burn.related.detect$burn.related.patch$burn.related.update$burn.related.upgrade$burn.runonce$burn.unelevated$cache$core.cpp$disablesystemrestore$forcerestart$help$ignored $keepaupaused$layout$log$modify$noaupause$norestart$originalsource$package$parallelcacheandexecute$parent$parent:none$passive$promptrestart$quiet$repair$serialcacheandexecute$silent$uninstall$update
API String ID: 1440157973-175168873
Opcode ID: 08ff4a725727a36c75457ede322bdd91469af9b7f49d9bc778cd4c58643273be
Instruction ID: b498ee01ae51ccfe65cf32be69de5a90590d7cf7ca2881e200a25bb0bbc27035
Opcode Fuzzy Hash: 08ff4a725727a36c75457ede322bdd91469af9b7f49d9bc778cd4c58643273be
Instruction Fuzzy Hash: 81726BB1B44209BBEB219E44CC86F7937A4EB11774F25423DFA74EB2D1D6B89D808B50

Uniqueness

Uniqueness Score: -1.00%

Function 007C6217 Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get @Comments., xrefs: 007C64EB
PerMachine, xrefs: 007C633D
DisplayVersion, xrefs: 007C63CE
Arp, xrefs: 007C635E
Manufacturer, xrefs: 007C6677
Failed to select Update node., xrefs: 007C6666
Failed to set registration paths., xrefs: 007C6737
Failed to get @Name., xrefs: 007C6702
Failed to parse related bundles, xrefs: 007C62AE
Failed to get @Contact., xrefs: 007C6513
Name, xrefs: 007C66EF
Publisher, xrefs: 007C63F3
registration.cpp, xrefs: 007C65B4
Failed to get @Register., xrefs: 007C639B
Classification, xrefs: 007C6710
Failed to get @ProviderKey., xrefs: 007C6311
DisableModify, xrefs: 007C6521
DisableRemove, xrefs: 007C65F5
Contact, xrefs: 007C64FC
Failed to select registration node., xrefs: 007C6251
Failed to get @DisplayName., xrefs: 007C63C0
Registration, xrefs: 007C6226
UpdateUrl, xrefs: 007C6487
Failed to get @Version., xrefs: 007C62CF
ProviderKey, xrefs: 007C62FE
DisplayName, xrefs: 007C63A9
Invalid modify disabled type: %ls, xrefs: 007C65C1
Failed to get @Manufacturer., xrefs: 007C6694
ParentDisplayName, xrefs: 007C64AC
Failed to get @HelpLink., xrefs: 007C642F
Failed to select ARP node., xrefs: 007C637A
Failed to get @UpdateUrl., xrefs: 007C649E
Department, xrefs: 007C66A5
Failed to get @ParentDisplayName., xrefs: 007C64C3
Tag, xrefs: 007C6283
ExecutableName, xrefs: 007C631F
Failed to get @Tag., xrefs: 007C6296
Version, xrefs: 007C62BC
button, xrefs: 007C653A
Failed to get @DisplayVersion., xrefs: 007C63E5
AboutUrl, xrefs: 007C6462
Update, xrefs: 007C664A
Failed to get @Publisher., xrefs: 007C640A
Failed to get @Classification., xrefs: 007C6723
Failed to parse software tag., xrefs: 007C663C
Register, xrefs: 007C6388
Failed to get @PerMachine., xrefs: 007C6350
HelpLink, xrefs: 007C6418
Failed to parse @Version: %ls, xrefs: 007C62F0
yes, xrefs: 007C6560
ProductFamily, xrefs: 007C66CA
Failed to get @HelpTelephone., xrefs: 007C6454
Failed to get @DisableRemove., xrefs: 007C660C
Failed to get @Id., xrefs: 007C6275
Failed to get @Department., xrefs: 007C66BC
Failed to get @AboutUrl., xrefs: 007C6479
Failed to get @DisableModify., xrefs: 007C65E4
HelpTelephone, xrefs: 007C643D
Failed to get @ExecutableName., xrefs: 007C6332
Failed to get @ProductFamily., xrefs: 007C66E1
Comments, xrefs: 007C64D4

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
API String ID: 760788290-2956246334
Opcode ID: cab094c28dfaeead52fae27cccacbe25b30c5774f3739a9131c33f14ecf2f3e3
Instruction ID: 0eebaa74618ae53b64e549bfaa363f07776019038303d93027b7e88b4dc3d80b
Opcode Fuzzy Hash: cab094c28dfaeead52fae27cccacbe25b30c5774f3739a9131c33f14ecf2f3e3
Instruction Fuzzy Hash: BDD19872684A4DBACB11DA50CCC5FBE77A7AB44720F21042DF716A3351DBBD9D41A710

Uniqueness

Uniqueness Score: -1.00%

Function 007C449E Relevance: 102.1, APIs: 8, Strings: 50, Instructions: 592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 007C45BF
SysFreeString.OLEAUT32(00000000), ref: 007C4C3A

Part of subcall function 007F233B: GetProcessHeap.KERNEL32(?,00000000,?,007C3087,?,00000000,?,?,?,00000000), ref: 007F234C
Part of subcall function 007F233B: RtlAllocateHeap.NTDLL(00000000,?,007C3087,?,00000000,?,?,?,00000000), ref: 007F2353

Strings

Failed to find forward transaction boundary: %ls, xrefs: 007C4A65
PerMachine, xrefs: 007C471D
Failed to get @RollbackLogPathVariable., xrefs: 007C4A44
Permanent, xrefs: 007C4738
Failed to select package nodes., xrefs: 007C45FE
Failed to get next node., xrefs: 007C49E0
Failed to parse MSI package., xrefs: 007C48C4
Failed to allocate memory for rollback boundary structs., xrefs: 007C452F
Failed to get package node count., xrefs: 007C461B
Failed to parse dependency providers., xrefs: 007C4AAA
MsuPackage, xrefs: 007C4909
Failed to get @CacheId., xrefs: 007C49FE
InstallCondition, xrefs: 007C47BF
Vital, xrefs: 007C4590, 007C475E
LogPathVariable, xrefs: 007C4779
MsiPackage, xrefs: 007C489A
Failed to allocate memory for package structs., xrefs: 007C4657
Failed to get @Vital., xrefs: 007C4A30
package.cpp, xrefs: 007C4525, 007C464D, 007C49CC, 007C4AD4
Failed to get @Cache., xrefs: 007C49F4
Failed to find backward transaction boundary: %ls, xrefs: 007C4A79
RollbackBoundary, xrefs: 007C44AC
Failed to get @LogPathVariable., xrefs: 007C4A3A
Failed to select rollback boundary nodes., xrefs: 007C44D1
Failed to get @RollbackBoundaryForward., xrefs: 007C4A58
Failed to parse target product codes., xrefs: 007C4C05
Failed to parse payload references., xrefs: 007C4AA0
Failed to get rollback bundary node count., xrefs: 007C44EB
Failed to parse MSP package., xrefs: 007C4A8C
RollbackBoundaryForward, xrefs: 007C47E2
Failed to get @Permanent., xrefs: 007C4A26
Failed to get @InstallCondition., xrefs: 007C4A4E
Failed to parse MSU package., xrefs: 007C4A96
Failed to get @InstallSize., xrefs: 007C4A12
CacheId, xrefs: 007C46CC
Failed to allocate memory for patch sequence information to package lookup., xrefs: 007C4ADE
Failed to get @RollbackBoundaryBackward., xrefs: 007C4A6C
Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage, xrefs: 007C45EB
MspPackage, xrefs: 007C48D0
Failed to get @PerMachine., xrefs: 007C4A1C
RollbackLogPathVariable, xrefs: 007C479C
Failed to get @Id., xrefs: 007C49EA
InstallSize, xrefs: 007C4702
Size, xrefs: 007C46E7
Cache, xrefs: 007C46B1
ExePackage, xrefs: 007C485C
Failed to allocate memory for MSP patch sequence information., xrefs: 007C49D6
RollbackBoundaryBackward, xrefs: 007C481D
Failed to parse EXE package., xrefs: 007C488E
Failed to get @Size., xrefs: 007C4A08

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Cache$CacheId$Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage$ExePackage$Failed to allocate memory for MSP patch sequence information.$Failed to allocate memory for package structs.$Failed to allocate memory for patch sequence information to package lookup.$Failed to allocate memory for rollback boundary structs.$Failed to find backward transaction boundary: %ls$Failed to find forward transaction boundary: %ls$Failed to get @Cache.$Failed to get @CacheId.$Failed to get @Id.$Failed to get @InstallCondition.$Failed to get @InstallSize.$Failed to get @LogPathVariable.$Failed to get @PerMachine.$Failed to get @Permanent.$Failed to get @RollbackBoundaryBackward.$Failed to get @RollbackBoundaryForward.$Failed to get @RollbackLogPathVariable.$Failed to get @Size.$Failed to get @Vital.$Failed to get next node.$Failed to get package node count.$Failed to get rollback bundary node count.$Failed to parse EXE package.$Failed to parse MSI package.$Failed to parse MSP package.$Failed to parse MSU package.$Failed to parse dependency providers.$Failed to parse payload references.$Failed to parse target product codes.$Failed to select package nodes.$Failed to select rollback boundary nodes.$InstallCondition$InstallSize$LogPathVariable$MsiPackage$MspPackage$MsuPackage$PerMachine$Permanent$RollbackBoundary$RollbackBoundaryBackward$RollbackBoundaryForward$RollbackLogPathVariable$Size$Vital$package.cpp
API String ID: 336948655-3675780287
Opcode ID: 6f569694158d635f1898e3c3492c92f9b1673c46c4d39d77a707f610b04ff18c
Instruction ID: b56373e3476e8b916cf8d7ebce4f07eda7d25359ace73fc6b3561335dba0c3b1
Opcode Fuzzy Hash: 6f569694158d635f1898e3c3492c92f9b1673c46c4d39d77a707f610b04ff18c
Instruction Fuzzy Hash: 5C22AEB194020DEBCB119F94CD95FBE77B6BF44320F20802DEA15AB391DB79E9419B10

Uniqueness

Uniqueness Score: -1.00%

Function 007C209F Relevance: 96.8, APIs: 28, Strings: 27, Instructions: 576
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 007C20E3
_memset.LIBCMT ref: 007C20F5

Part of subcall function 007F1A74: GetModuleFileNameW.KERNEL32(6!|,?,00000104,?,00000104,?,00000000,?,?,007C2136,?,00000000,?,?,?,76EEC3F0), ref: 007F1A95

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000,?,?,?,76EEC3F0,?,00000000), ref: 007C2166
GetLastError.KERNEL32(?,?,?,76EEC3F0,?,00000000), ref: 007C2173

Strings

Failed to read section info, unsupported version: %08x, xrefs: 007C2761
Failed to seek to section info., xrefs: 007C23A8, 007C26A6
Failed to read NT header., xrefs: 007C231C
(, xrefs: 007C24D5
section.cpp, xrefs: 007C2195, 007C21F7, 007C224A, 007C227A, 007C22C2, 007C2312, 007C2343, 007C239E, 007C23EE, 007C2441, 007C2496, 007C2565, 007C258A, 007C25AF, 007C2611, 007C264B, 007C269C, 007C2705, 007C272F, 007C2754, 007C2828
Failed to allocate buffer for section info., xrefs: 007C2655
Failed to seek to NT header., xrefs: 007C22CC
Failed to allocate memory for container sizes., xrefs: 007C2832
Failed to read complete image section header, index: %u, xrefs: 007C259A
Failed to read section info., xrefs: 007C270F
Failed to read signature size., xrefs: 007C244B
PE, xrefs: 007C232F
Failed to read DOS header., xrefs: 007C2254
Failed to find valid DOS image header in buffer., xrefs: 007C2284
Failed to seek past optional headers., xrefs: 007C24A0
Failed to find Burn section., xrefs: 007C25B9
Failed to find valid NT image header in buffer., xrefs: 007C234D
.wixburn, xrefs: 007C24E5
Failed to read signature offset., xrefs: 007C23F8
Failed to get path to engine process., xrefs: 007C213C
4, xrefs: 007C25FD
Failed to open handle to engine process path: %ls, xrefs: 007C21A5
Failed to read complete section info., xrefs: 007C2739
Failed to seek to start of file., xrefs: 007C2201
Failed to get total size of bundle., xrefs: 007C2785
Failed to read image section header, index: %u, xrefs: 007C2575
Failed to read section info, data to short: %u, xrefs: 007C2621

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: File_memset$CreateErrorLastModuleName
String ID: ($.wixburn$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get path to engine process.$Failed to get total size of bundle.$Failed to open handle to engine process path: %ls$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$section.cpp
API String ID: 3151910114-3305245485
Opcode ID: 83c6c954c79d5e4ede5e7f4c07f10cce57033244a2cd6f1a5d6604314e2a4db3
Instruction ID: a1a12de5e3dbed22386342329706fe7c0741a423cba3dd7e426555543a0f4974
Opcode Fuzzy Hash: 83c6c954c79d5e4ede5e7f4c07f10cce57033244a2cd6f1a5d6604314e2a4db3
Instruction Fuzzy Hash: 9312BCF1A40629FBEB209B64CC45FB677A4AF04720F1041ADBA0CFA292D67DDD41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 007C6C31 Relevance: 82.7, APIs: 1, Strings: 46, Instructions: 444
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,F08B8007,057CF33B,00020006,00000000), ref: 007C7188

Strings

Failed to create registration key., xrefs: 007C6CB5
SystemComponent, xrefs: 007C6FF9, 007C6FFE
BundleCachePath, xrefs: 007C6CD5, 007C6CDA
URLInfoAbout, xrefs: 007C6EE8, 007C6EED
Failed to update resume mode., xrefs: 007C7163
URLUpdateInfo, xrefs: 007C6F08, 007C6F0D
DisplayVersion, xrefs: 007C6E68, 007C6E6D
%hs, xrefs: 007C6DEC
"%ls" /uninstall /quiet, xrefs: 007C7019
Failed to cache bundle from path: %ls, xrefs: 007C6C88
BundleProviderKey, xrefs: 007C6DAF, 007C6DB4
BundleDetectCode, xrefs: 007C6D2C, 007C6D34
BundleAddonCode, xrefs: 007C6D0E, 007C6D16
DisplayIcon, xrefs: 007C6E0F, 007C6E19
Publisher, xrefs: 007C6E88, 007C6E8D
BundlePatchCode, xrefs: 007C6D4A, 007C6D52
"%ls" %ls, xrefs: 007C7050
NoElevateOnModify, xrefs: 007C70B9
HelpLink, xrefs: 007C6EA8, 007C6EAD
Failed to register the bundle dependency key., xrefs: 007C7149
Failed to write %ls value., xrefs: 007C7127
/uninstall, xrefs: 007C7042, 007C7047
Failed to write software tags., xrefs: 007C7087
/modify, xrefs: 007C703B
UninstallString, xrefs: 007C704B, 007C7055
NoRemove, xrefs: 007C6FD9, 007C6FDE
Contact, xrefs: 007C6F89, 007C6F8E
BundleUpgradeCode, xrefs: 007C6CF0, 007C6CF8
%hu.%hu.%hu.%hu, xrefs: 007C6D84
BundleTag, xrefs: 007C6DCF, 007C6DD4
engine.cpp, xrefs: 007C6E47
ModifyPath, xrefs: 007C709D, 007C70A7
EngineVersion, xrefs: 007C6DF1, 007C6DF6
DisplayName, xrefs: 007C6E48, 007C6E4D
NoModify, xrefs: 007C6FB0, 007C6FB7
EstimatedSize, xrefs: 007C7112, 007C7117, 007C7126
"%ls" /modify, xrefs: 007C70A2
%s,0, xrefs: 007C6E14
3.7.2829.0, xrefs: 007C6DE7
QuietUninstallString, xrefs: 007C7014, 007C701E
ParentDisplayName, xrefs: 007C6F28, 007C6F2D
HelpTelephone, xrefs: 007C6EC8, 007C6ECD
ParentKeyName, xrefs: 007C6F43, 007C6F48
BundleVersion, xrefs: 007C6D89, 007C6D8E
Comments, xrefs: 007C6F66, 007C6F6B
Failed to write update registration., xrefs: 007C70DC

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.7.2829.0$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$engine.cpp
API String ID: 3535843008-1617658161
Opcode ID: e9077d26909c0886d7d75539b0536b10df8b98e7fae047151dd0a3177fe0a277
Instruction ID: f28d2e4139cf16a45e56e7e74e7df5199724aac077509278ae0f08e41ba3af34
Opcode Fuzzy Hash: e9077d26909c0886d7d75539b0536b10df8b98e7fae047151dd0a3177fe0a277
Instruction Fuzzy Hash: BFE19F7070470DEBDB265AA58D86F6B7BFAAB84314F14003CBA44A6352DF79ED14EB10

Uniqueness

Uniqueness Score: -1.00%

Function 007CA947 Relevance: 54.6, APIs: 12, Strings: 19, Instructions: 398
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,00000000,00000000,?,007C8B89,?,?,?,?,?,?,?,?,00000001), ref: 007CA96A
lstrlenW.KERNEL32(?,?,007C8B89,?,?,?,?,?,?,?,?,00000001,00000000), ref: 007CA973
_wcschr.LIBCMT ref: 007CA99A
_wcschr.LIBCMT ref: 007CA9B1
_wcschr.LIBCMT ref: 007CAB22
LeaveCriticalSection.KERNEL32(?,00000000,00000000,007FA5C8,00000000,00000000,00000000,007C8B89,?,007C8B89,?,00000000,007C8B89,00000001,?,007C8B89), ref: 007CAD7B
#8.MSI(?,?,007C8B89,?), ref: 007CADB2

Strings

variable.cpp, xrefs: 007CAB80, 007CABBF, 007CAC36, 007CAC67, 007CACD0, 007CAD1D, 007CAD39
Failed to get formatted length., xrefs: 007CAC40
Failed to allocate string., xrefs: 007CAC97
[%d], xrefs: 007CAAE9
Failed to set record string., xrefs: 007CAC71
Failed to format placeholder string., xrefs: 007CAD64
Failed to allocate buffer for format string., xrefs: 007CA98A
Failed to set variable value., xrefs: 007CAD5D
Failed to determine variable visibility: '%ls'., xrefs: 007CAD4D
Failed to copy string., xrefs: 007CACF6
Failed to format record., xrefs: 007CACDA
Failed to append placeholder., xrefs: 007CAD6B
Failed to allocate variable array., xrefs: 007CAD43
Failed to set record format string., xrefs: 007CABC9
Failed to get variable name., xrefs: 007CAD0B
Failed to reallocate variable array., xrefs: 007CAD27
Failed to append string., xrefs: 007CAB46
Failed to allocate record., xrefs: 007CAB8A
*****, xrefs: 007CAAAA

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _wcschr$CriticalSection$EnterLeavelstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
API String ID: 144789458-2050445661
Opcode ID: 64165b77270fc885f96b8b8ecc576ce4450517360667507a3b5a6ff322c7f37d
Instruction ID: 3bfc7c71cc76bde311762ef5a9886f91939fff6c36ea2eb81e1c79395dd90687
Opcode Fuzzy Hash: 64165b77270fc885f96b8b8ecc576ce4450517360667507a3b5a6ff322c7f37d
Instruction Fuzzy Hash: 27C1E572E4061DFBCB219AA48C45FBE7765AF0075AF11412DFA01F7281D67C9E409BA2

Uniqueness

Uniqueness Score: -1.00%

Function 007E54EE Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 287
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,007E5D18), ref: 007E5500
GetLastError.KERNEL32(?,?,?,007E5D18), ref: 007E550A
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,007E5D18), ref: 007E5548
GetLastError.KERNEL32(?,?,?,007E5D18), ref: 007E5553
ResetEvent.KERNEL32(?,?,?,?,007E5D18), ref: 007E558F
GetLastError.KERNEL32(?,?,?,007E5D18), ref: 007E5599

Strings

Failed to copy stream name: %ls, xrefs: 007E5621
Failed to wait for begin operation event., xrefs: 007E5582
Failed to set file pointer to end of file., xrefs: 007E57EC
Failed to set operation complete event., xrefs: 007E5539
Failed to set file pointer to beginning of file., xrefs: 007E5879
Failed to set end of file., xrefs: 007E5832
Invalid operation for this state., xrefs: 007E55F2
Failed to create file: %ls, xrefs: 007E579D
Failed to allocate buffer for stream., xrefs: 007E572E
cabextract.cpp, xrefs: 007E552F, 007E5578, 007E55BE, 007E55E8, 007E5724, 007E5790, 007E57E2, 007E5828, 007E586F
Failed to reset begin operation event., xrefs: 007E55C8

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 1865021742-2104912459
Opcode ID: 38df01482d90f96abf7b7d22eef1a414c0d2ccd884fef3f5172aac3c641af555
Instruction ID: 56b4555977e16cf12e95f24b49910233e6f4dc106b8ea43aeea078377b1d5a8b
Opcode Fuzzy Hash: 38df01482d90f96abf7b7d22eef1a414c0d2ccd884fef3f5172aac3c641af555
Instruction Fuzzy Hash: CF914772A42E5BB7E33016629D0AB362A95FF08B78F214234F904FE2E0D69DDC1097D5

Uniqueness

Uniqueness Score: -1.00%

Function 007DCC4F Relevance: 53.0, APIs: 1, Strings: 29, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 007DCCAD

Part of subcall function 007F4CFE: _memset.LIBCMT ref: 007F4D0F

Strings

Failed to add obfuscated properties to argument string., xrefs: 007DCECE
Failed to get cached path for package: %ls, xrefs: 007DCDB6
Failed to add patch properties to argument string., xrefs: 007DCF34
Failed to add ADMIN property on admin install., xrefs: 007DD144
Failed to build MSI path., xrefs: 007DCDEC
%ls %ls=ALL, xrefs: 007DD0DE, 007DD1B9
Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 007DD038
Failed to perform minor upgrade of MSI package., xrefs: 007DD064
VersionString, xrefs: 007DCCF8, 007DCD2D
Failed to enable logging for package: %ls to: %ls, xrefs: 007DCE54
IGNOREDEPENDENCIES, xrefs: 007DD0CD, 007DD1A8
REBOOT=ReallySuppress, xrefs: 007DCFCE, 007DD18A
%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 007DD0AF
Failed to run maintanance mode for MSI package., xrefs: 007DD11E
Failed to install MSI package., xrefs: 007DD16C
Failed to add reboot suppression property on uninstall., xrefs: 007DD1A1
Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 007DD0C3
REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 007DD021
Failed to add reboot suppression property on install., xrefs: 007DCFE9
Failed to initialize external UI handler., xrefs: 007DCE23
Failed to uninstall MSI package., xrefs: 007DD213
Failed to add feature action properties to obfuscated argument string., xrefs: 007DCF12
Failed to add properties to argument string., xrefs: 007DCE95
Failed to add feature action properties to argument string., xrefs: 007DCEF0
Failed to add patch properties to obfuscated argument string., xrefs: 007DCF56
ACTION=ADMIN, xrefs: 007DD129
Failed to add the list of dependencies to ignore to the properties., xrefs: 007DD0F2
REINSTALL=ALL, xrefs: 007DCFFF, 007DD076
Failed to add reinstall all property on minor upgrade., xrefs: 007DD016

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memset
String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString
API String ID: 2102423945-2112609193
Opcode ID: 027fbee9fafdbff5ed59fab825420187a63fe5652bf475411b42f562d0e520fc
Instruction ID: 2ebcf930b4b395d7aeeeb494666bd81cba84e54bc5703aa558fa52b8be73a518
Opcode Fuzzy Hash: 027fbee9fafdbff5ed59fab825420187a63fe5652bf475411b42f562d0e520fc
Instruction Fuzzy Hash: 9D02D871640619EFDB319F90CC85EA9B7B6FB98300F1040A6F149A7362D67AAE91CF50

Uniqueness

Uniqueness Score: -1.00%

Function 007F2B14 Relevance: 49.4, APIs: 27, Strings: 1, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 007F2B54
_memset.LIBCMT ref: 007F2B77
_memset.LIBCMT ref: 007F2B91
_memset.LIBCMT ref: 007F2BAB
_memset.LIBCMT ref: 007F2BC5
_memset.LIBCMT ref: 007F2BDF
InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 007F2BF6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007F2C00
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 007F2C47
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007F2C4D
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 007F2C8E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007F2C94
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 007F2CD5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007F2CDB
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 007F2D1C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007F2D22
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 007F2D63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007F2D69
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 007F2E5B
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 007F2E96
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007F2EA0
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 007F2ED6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007F2EE0
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 007F2F17
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007F2F21
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 007F2F67
LocalFree.KERNEL32(?), ref: 007F2F7D

Strings

srputil.cpp, xrefs: 007F2F46

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast$_memset$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: srputil.cpp
API String ID: 3642641498-4105181634
Opcode ID: f87c2e4d1e809d7a933d8eb9f1f54a763a85bc0abbfa9bd9dd9bb44eb8a2ae4d
Instruction ID: 99bd29ac2f70b59cc6549cb48e243581d991f206f25d23490be5dc350185db4f
Opcode Fuzzy Hash: f87c2e4d1e809d7a933d8eb9f1f54a763a85bc0abbfa9bd9dd9bb44eb8a2ae4d
Instruction Fuzzy Hash: CFD162B2D5022DAAD7209F55DC89BFEBBB8BB08310F1045BAE609F7241D6784E45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 007C1B46 Relevance: 42.3, APIs: 7, Strings: 17, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 007C1BA5
_memset.LIBCMT ref: 007C1BC9

Part of subcall function 007C1033: InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 007C1057
Part of subcall function 007C1033: InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 007C1060

CoInitializeEx.OLE32(00000000,00000000,00000003,00000000), ref: 007C1C04
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007C1F03

Part of subcall function 007C1226: CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,?), ref: 007C12AC

Part of subcall function 007C157C: ReleaseMutex.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 007C174B
Part of subcall function 007C157C: CloseHandle.KERNEL32(00000000,?,?,?,007C1DEA,?,?), ref: 007C1754

Part of subcall function 007C18B9: IsWindow.USER32(?), ref: 007C1AC3
Part of subcall function 007C18B9: PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007C1AD6
Part of subcall function 007C18B9: CloseHandle.KERNEL32(00000000,?,?,?,007C1E12,?), ref: 007C1AE5

Strings

Failed to run per-user mode., xrefs: 007C1E18
Failed to get OS info., xrefs: 007C1CD6
Failed to initialize XML util., xrefs: 007C1C7F
Failed to initialize core., xrefs: 007C1D5C
engine.cpp, xrefs: 007C1CCC
Failed to run embedded mode., xrefs: 007C1DD1
Failed to run RunOnce mode., xrefs: 007C1DA9
3.7.2829.0, xrefs: 007C1D1C
Failed to initialize engine state., xrefs: 007C1BE2
Failed to run per-machine mode., xrefs: 007C1DF0
Failed to initialize Wiutil., xrefs: 007C1C60
txt, xrefs: 007C1E5E
Failed to initialize COM., xrefs: 007C1C10
Setup, xrefs: 007C1E68
Failed to initialize Regutil., xrefs: 007C1C41
_Failed, xrefs: 007C1E63
Invalid run mode., xrefs: 007C1D82

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseHandleInitialize$CriticalSection_memset$MessageMutexPostReleaseUninitializeWindow
String ID: 3.7.2829.0$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Invalid run mode.$Setup$_Failed$engine.cpp$txt
API String ID: 3679201541-1932953092
Opcode ID: 4c94be66e7132557803f90c3477021123a60be4ed732982df39aa6ffb1c1561a
Instruction ID: 834ab29fcffc4cf296842ffdc0a4a6e0a4e006b1556543a99108718b9e5b1030
Opcode Fuzzy Hash: 4c94be66e7132557803f90c3477021123a60be4ed732982df39aa6ffb1c1561a
Instruction Fuzzy Hash: 65B173B190121DEBDF20AF648C85FED77B5AB4A301F8440FEE60DA2242D6794E91CF51

Uniqueness

Uniqueness Score: -1.00%

Function 007E6231 Relevance: 35.2, APIs: 11, Strings: 9, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 007E6256
#20.CABINET(007E594A,007E5959,007E5D1C,007E5F23,007E5966,007E60F1,007E5FB8,000000FF,?), ref: 007E62B2
CoUninitialize.OLE32 ref: 007E645E

Strings

<the>.cab, xrefs: 007E62F4
Failed to wait for begin operation event., xrefs: 007E63D9
Failed to extract all files from container., xrefs: 007E6350
Failed to set operation complete event., xrefs: 007E6393
Failed to initialize COM., xrefs: 007E6262
Failed to initialize cabinet.dll., xrefs: 007E62D6
Invalid operation for this state., xrefs: 007E643D
cabextract.cpp, xrefs: 007E62CC, 007E6389, 007E63CF, 007E640C, 007E6433
Failed to reset begin operation event., xrefs: 007E6416

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container.$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-3821814080
Opcode ID: 594dae9c756066b90a81706df103772c9e01aedd64fd8b5bad03bf886f622e95
Instruction ID: 76c3f7de360709d83cb4dfa71001b725db24f36bb8f009b1addbc0786005ab5e
Opcode Fuzzy Hash: 594dae9c756066b90a81706df103772c9e01aedd64fd8b5bad03bf886f622e95
Instruction Fuzzy Hash: 50516A72A433E1F7D7209B678C0AD6E77A4AF2DBA0B154124F915FB3D1D5ACAD00C291

Uniqueness

Uniqueness Score: -1.00%

Function 007C3156 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 183
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(8000FFFF,00000000,74DF3140,?,007C3983,?,?,00000008,00000000,?), ref: 007C316D
ReadFile.KERNELBASE(00000008,00000008,00000004,?,00000000,?,007C3983,?,?,00000008,00000000,?), ref: 007C318D
GetLastError.KERNEL32(?,007C3983,?,?,00000008,00000000,?), ref: 007C3193
ReadFile.KERNELBASE(00000008,00000000,00000008,?,00000000,00000000,00000009,?,007C3983,?,?,00000008,00000000,?), ref: 007C3223
GetLastError.KERNEL32(?,007C3983,?,?,00000008,00000000,?), ref: 007C3229

Strings

Failed to read verification process id from parent pipe., xrefs: 007C32DD
Verification secret from parent is too big., xrefs: 007C31EF
Failed to read size of verification secret from parent pipe., xrefs: 007C31C2
Failed to inform parent process that child is running., xrefs: 007C3339
Verification process id from parent does not match., xrefs: 007C3378
Failed to read verification secret from parent pipe., xrefs: 007C3258
Verification secret from parent does not match., xrefs: 007C3290
pipe.cpp, xrefs: 007C31B8, 007C31E3, 007C324E, 007C3284, 007C32D3, 007C332F, 007C336C
Failed to allocate buffer for verification secret., xrefs: 007C320B

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$pipe.cpp
API String ID: 1233551569-826945260
Opcode ID: fe88f2fa40e683000d2d862cedb3fdce85ff123df4770437c103a0a6e88fa2de
Instruction ID: a10c7570bf480ae5879eb21513d92f7ed90f3c0a28643600362b689c95365858
Opcode Fuzzy Hash: fe88f2fa40e683000d2d862cedb3fdce85ff123df4770437c103a0a6e88fa2de
Instruction Fuzzy Hash: AF51A4B2A4020EFBDB109A94CD8AF7E7B69AB44710F24C03DF711F7291DA7D9A018761

Uniqueness

Uniqueness Score: -1.00%

Function 007CAE56 Relevance: 31.8, APIs: 1, Strings: 20, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(007C2222,00000000,007C1D56,007C21DE), ref: 007CAE76

Strings

WixBundleProviderKey, xrefs: 007CB51F
Failed to add built-in variable: %ls., xrefs: 007CB5A6
WixBundleInstalled, xrefs: 007CB4EA
$, xrefs: 007CB47B
0, xrefs: 007CAE88
#, xrefs: 007CAED5
WixBundleVersion, xrefs: 007CB555
WixBundleAction, xrefs: 007CB4B8
WixBundleActiveParent, xrefs: 007CB509
LogonUser, xrefs: 007CB075
InstallerVersion, xrefs: 007CB033
Date, xrefs: 007CAF71
WixBundleManufacturer, xrefs: 007CB530
', xrefs: 007CB0A6
WixBundleElevated, xrefs: 007CB4FB
WixBundleTag, xrefs: 007CB541
6!|2!|, xrefs: 007CB53D
9, xrefs: 007CB598
InstallerName, xrefs: 007CB018
WixBundleForcedRestartPackage, xrefs: 007CB4DA

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$6!|2!|$9$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleManufacturer$WixBundleProviderKey$WixBundleTag$WixBundleVersion
API String ID: 32694325-4094781185
Opcode ID: 2b6e71e1709e719dff5a62a8e90c6586b08f2cc6277bfa96145a2ed00103899c
Instruction ID: f969d2369ca26522f844cc0f118028292b04f5c1f37402d47ec80e9869a98d38
Opcode Fuzzy Hash: 2b6e71e1709e719dff5a62a8e90c6586b08f2cc6277bfa96145a2ed00103899c
Instruction Fuzzy Hash: E9127BB5C016289BDBA69F45C9097DDBBB6BB88304F0085DD920CBB254C7B52B8DCF85

Uniqueness

Uniqueness Score: -1.00%

Function 007C6893 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 166registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000000,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006,00000000,00000000,00000000,?,?), ref: 007C6A97

Part of subcall function 007F362A: RegSetValueExW.KERNELBASE(?,00020006,00000000,00000004,007C68E2,00000004,00000001,?,007C68E2,00020006,Resume,007C13BB,00000000,00000000,?,?), ref: 007F363F

Strings

Failed to delete run key value., xrefs: 007C6A28
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 007C6961, 007C69C9
Failed to write resume command line value., xrefs: 007C69B6
"%ls" /%ls, xrefs: 007C693A
Failed to delete resume command line value., xrefs: 007C6A73
Failed to write run key value., xrefs: 007C6992
Installed, xrefs: 007C68F9
Failed to format resume command line for RunOnce., xrefs: 007C694E
Failed to create run key., xrefs: 007C6974
Failed to write Resume value., xrefs: 007C68E8
Resume, xrefs: 007C68D5
registration.cpp, xrefs: 007C6A1E, 007C6A69
Failed to write Installed value., xrefs: 007C690C
BundleResumeCommandLine, xrefs: 007C699F, 007C6A37
burn.runonce, xrefs: 007C692F

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseValue
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$burn.runonce$registration.cpp
API String ID: 3132538880-3648537543
Opcode ID: 1c3e9360a166ea4f9a357dad2145ad9a09517d3ec872d4ea5c514d406c785a24
Instruction ID: 5769c9e3b74557805c248c4e341f8ff4ba56ce23bd7aa93bfa1ca2920377a5f6
Opcode Fuzzy Hash: 1c3e9360a166ea4f9a357dad2145ad9a09517d3ec872d4ea5c514d406c785a24
Instruction Fuzzy Hash: A951D7B1540709FADB225A64CC86F7E2BB79B40710F21C02DF605B6361EB7DEE41A711

Uniqueness

Uniqueness Score: -1.00%

Function 007D1377 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 139registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 007D13C1
RegisterClassW.USER32(?), ref: 007D13EF
GetLastError.KERNEL32 ref: 007D13FA
CreateWindowExW.USER32(00000080,00803EB8,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 007D146A
GetLastError.KERNEL32 ref: 007D1474
SetEvent.KERNEL32(?), ref: 007D14B7
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 007D14F6
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 007D151B

Strings

Failed to create window., xrefs: 007D14A8
uithread.cpp, xrefs: 007D1424, 007D149E
Unexpected return value from message pump., xrefs: 007D1503
Failed to register window., xrefs: 007D142E
WixBurnMessageWindow, xrefs: 007D13E8, 007D1516

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ClassErrorLast$CallbackCreateDispatcherEventRegisterUnregisterUserValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 4252647486-288575659
Opcode ID: 5ac24d35a3b428ca6fe16701bbddef69a5a21cb0c85ed34b9aeb2c3d6946cda1
Instruction ID: 7eebb93568e9a3f94077f40684a0529547e5ba0cbface74af210d97606708105
Opcode Fuzzy Hash: 5ac24d35a3b428ca6fe16701bbddef69a5a21cb0c85ed34b9aeb2c3d6946cda1
Instruction Fuzzy Hash: D9418FB2A00249FFDB108FA4DC44AEDBBB9FF04314F60852AF215F6290D778AA44DB51

Uniqueness

Uniqueness Score: -1.00%

Function 007C38B6 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 158sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?), ref: 007C3917
GetLastError.KERNEL32 ref: 007C3921
Sleep.KERNELBASE(00000064), ref: 007C3946

Strings

Failed to open parent pipe: %ls, xrefs: 007C396A
Failed to allocate name of parent cache pipe., xrefs: 007C39BB
\\.\pipe\%ls.Cache, xrefs: 007C39A5
Failed to verify parent pipe: %ls, xrefs: 007C398C
\\.\pipe\%ls, xrefs: 007C38C8
pipe.cpp, xrefs: 007C395D, 007C3A62
Failed to open companion process with PID: %u, xrefs: 007C3A6F
Failed to allocate name of parent pipe., xrefs: 007C38DC

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 408151869-645222887
Opcode ID: 2badf80d7bc9889b018e79be4c3f5307b2e4d7eb6ae05dd4bb287fdde25dd701
Instruction ID: b04bef4722d05364f4cf1144911d6f2afdf0c137d4ae675238b34068d1f17918
Opcode Fuzzy Hash: 2badf80d7bc9889b018e79be4c3f5307b2e4d7eb6ae05dd4bb287fdde25dd701
Instruction Fuzzy Hash: 5A410B72540605FBD7219A60CC0AF7E77A99F85720F20C12CF659D6290E7BDEA109711

Uniqueness

Uniqueness Score: -1.00%

Function 007D07BE Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 233COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007D07DC

Strings

Failed to read UI level., xrefs: 007D0896
Failed to read rollback flag., xrefs: 007D09E9
Failed to read package log., xrefs: 007D0875
Failed to allocate memory for feature actions., xrefs: 007D08F1
Failed to read action., xrefs: 007D0808
Failed to execute MSI package., xrefs: 007D0A14
Failed to allocate memory for slipstream patch actions., xrefs: 007D0961
Failed to read slipstream action., xrefs: 007D09C9
Failed to read parent hwnd., xrefs: 007D0854
Failed to find package: %ls, xrefs: 007D082A
elevation.cpp, xrefs: 007D08E7, 007D0957
Failed to read variables., xrefs: 007D09C2
Failed to read feature action., xrefs: 007D096B

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memset
String ID: Failed to allocate memory for feature actions.$Failed to allocate memory for slipstream patch actions.$Failed to execute MSI package.$Failed to find package: %ls$Failed to read UI level.$Failed to read action.$Failed to read feature action.$Failed to read package log.$Failed to read parent hwnd.$Failed to read rollback flag.$Failed to read slipstream action.$Failed to read variables.$elevation.cpp
API String ID: 2102423945-2584093861
Opcode ID: ef3374845a55d85e2410f66b29ac36a1db0625b54fa1eed8be7fb27a8db4a866
Instruction ID: c9a86183294772f1d59cd02cc5da1d10c2116a3dbb7b3f0606d38aa63d1b1837
Opcode Fuzzy Hash: ef3374845a55d85e2410f66b29ac36a1db0625b54fa1eed8be7fb27a8db4a866
Instruction Fuzzy Hash: 2F71AA7290021CEEDB11EEA4CC89EEEB7B8EB44314F105162F911B7352D2799E51DBE2

Uniqueness

Uniqueness Score: -1.00%

Function 007CD764 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 200COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007CD77F

Strings

Failed to set original source variable., xrefs: 007CD8F6
Failed to load manifest., xrefs: 007CD8CA
Failed to open manifest stream., xrefs: 007CD88D
WixBundleOriginalSource, xrefs: 007CD8E5
Failed to overwrite the %ls built-in variable., xrefs: 007CD84A
Failed to get unique temporary folder for bootstrapper application., xrefs: 007CD924
Failed to load catalog files., xrefs: 007CD965
WixBundleElevated, xrefs: 007CD831, 007CD836, 007CD849
Failed to extract bootstrapper application payloads., xrefs: 007CD945
Failed to get manifest stream from container., xrefs: 007CD8AE
Failed to open attached UX container., xrefs: 007CD870
Failed to initialize variables., xrefs: 007CD81C
Failed to parse command line., xrefs: 007CD7FE

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memset
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$WixBundleElevated$WixBundleOriginalSource
API String ID: 2102423945-1257586656
Opcode ID: d66bee536ee5867e56063eea40e23fd58b8c145de8ead9f4f7e0f0435cc1b297
Instruction ID: 6f72b61bf30963a79443c7f057de93d93f74944931f5080374dfeb6a13bb5164
Opcode Fuzzy Hash: d66bee536ee5867e56063eea40e23fd58b8c145de8ead9f4f7e0f0435cc1b297
Instruction Fuzzy Hash: 38617E76940609AACB62DAA0CC85FDBB7BDEB44710F10443EF55AE3240EE78FA458B51

Uniqueness

Uniqueness Score: -1.00%

Function 007C157C Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 007C174B
CloseHandle.KERNEL32(00000000,?,?,?,007C1DEA,?,?), ref: 007C1754

Part of subcall function 007C28DB: UuidCreate.RPCRT4(?), ref: 007C2912
Part of subcall function 007C28DB: StringFromGUID2.OLE32(?,?,00000027), ref: 007C2925

Strings

Failed to launch unelevated process., xrefs: 007C15D6
Failed to pump messages from parent process., xrefs: 007C171D
Failed to create the message window., xrefs: 007C16A1
Failed to create implicit elevated connection name and secret., xrefs: 007C15AD
Failed to connect to unelevated process., xrefs: 007C15F4
engine.cpp, xrefs: 007C1634, 007C167E
Failed to allocate thread local storage for logging., xrefs: 007C163E
Failed to set elevated pipe into thread local storage for logging., xrefs: 007C1688

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseCreateFromHandleMutexReleaseStringUuid
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create implicit elevated connection name and secret.$Failed to create the message window.$Failed to launch unelevated process.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$engine.cpp
API String ID: 3991521885-93479633
Opcode ID: 2d5956f91d5b80aad052cd39a0e1e7c00b5d4074f3dba1bfe152a899fd75c5ca
Instruction ID: 7c84f6abacca919d0b60117cb20cfe6cbf2997ca81a807edd12bb5989faadb6f
Opcode Fuzzy Hash: 2d5956f91d5b80aad052cd39a0e1e7c00b5d4074f3dba1bfe152a899fd75c5ca
Instruction Fuzzy Hash: 7F4107B2240609FADB219BA0CC49FAB77ADEF85360F50443DF21AD2252EE3DE5059725

Uniqueness

Uniqueness Score: -1.00%

Function 007D8A1A Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007D8A74

Part of subcall function 007F5640: SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,007D7D44,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 007F5656
Part of subcall function 007F5640: GetLastError.KERNEL32(?,007D7D44,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,007D95E8,00000000,?), ref: 007F5660

WinVerifyTrust.WINTRUST(000000FF,00AAC56B,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 007D8AD0
WinVerifyTrust.WINTRUST(000000FF,00AAC56B,?,000000FF,00AAC56B,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 007D8AEA

Strings

Failed authenticode verification of payload: %ls, xrefs: 007D8B1D
cache.cpp, xrefs: 007D8B10, 007D8B63, 007D8BA6
Failed to get provider state from authenticode certificate., xrefs: 007D8B6D
Failed to verify expected payload against actual certificate chain., xrefs: 007D8BC8
Failed to move file pointer to beginning of file., xrefs: 007D8A8C
Failed to get signer chain from authenticode certificate., xrefs: 007D8BB0

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: TrustVerify$ErrorFileLastPointer_memset
String ID: Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to move file pointer to beginning of file.$Failed to verify expected payload against actual certificate chain.$cache.cpp
API String ID: 2460818389-4294895434
Opcode ID: ed53541ce28852acfc3d906cc704ef82cd8a848d03ff3c71f063608d842e3a1b
Instruction ID: 7e1208e1dd4bf1156155d196014ca73a8c4f90e6da047880245f48677bd32af4
Opcode Fuzzy Hash: ed53541ce28852acfc3d906cc704ef82cd8a848d03ff3c71f063608d842e3a1b
Instruction Fuzzy Hash: 2541D7B2D01219EAD751DBA9DC09ADFBBB8EF48360F104127F524F7381DA7C990187A1

Uniqueness

Uniqueness Score: -1.00%

Function 007E0431 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 136fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,00000000,00000000), ref: 007E0483
GetLastError.KERNEL32 ref: 007E0494
GetCurrentProcess.KERNEL32(007C1D72,00000000,00000000,00000002,00000000,00000000), ref: 007E04DD
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 007E04E3
DuplicateHandle.KERNELBASE(00000000), ref: 007E04E6
GetLastError.KERNEL32 ref: 007E04F0
SetFilePointerEx.KERNELBASE(007C1D72,007C2142,007C1D72,00000000,00000000), ref: 007E0557
GetLastError.KERNEL32 ref: 007E0561

Strings

Failed to open file: %ls, xrefs: 007E04CB
container.cpp, xrefs: 007E04BE, 007E051A, 007E058B
Failed to open container., xrefs: 007E05B2
Failed to move file pointer to container offset., xrefs: 007E0595
Failed to duplicate handle to container: %ls, xrefs: 007E0527

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp
API String ID: 2619879409-2168299741
Opcode ID: 4f9f192c93902c807676ac81206d82446e35c84ed2ef99c05d962fd313bfc153
Instruction ID: 65f2c87239272ff6face3a4a3f3513bda6408e99095affddd4617ced8f6648df
Opcode Fuzzy Hash: 4f9f192c93902c807676ac81206d82446e35c84ed2ef99c05d962fd313bfc153
Instruction Fuzzy Hash: 89419DB1A0124AFFDB20DF65DD85E697BB4FB08300F108528F515E6290D3B9AE609F95

Uniqueness

Uniqueness Score: -1.00%

Function 007E5D1C Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,000000FF,?,000000FF), ref: 007E5D4E
GetCurrentProcess.KERNEL32(000000FF,00000000,00000000,00000000), ref: 007E5D66
GetCurrentProcess.KERNEL32(?,00000000), ref: 007E5D6B
DuplicateHandle.KERNELBASE(00000000), ref: 007E5D6E
GetLastError.KERNEL32 ref: 007E5D78
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000), ref: 007E5DE7
GetLastError.KERNEL32 ref: 007E5DF5

Strings

<the>.cab, xrefs: 007E5D45
Failed to add virtual file pointer for cab container., xrefs: 007E5DC5
Failed to duplicate handle to cab container., xrefs: 007E5DA7
Failed to open cabinet file: %hs, xrefs: 007E5E27
cabextract.cpp, xrefs: 007E5D9D, 007E5E1A

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: ce784a147598bc01348ae6a7f3fbc99be6a5267f7023114ccddf4e77490050ca
Instruction ID: 4c447d0dc88c17430041063541e0d834cacada9ea2e50124cae6eddb3fce6284
Opcode Fuzzy Hash: ce784a147598bc01348ae6a7f3fbc99be6a5267f7023114ccddf4e77490050ca
Instruction Fuzzy Hash: 8E312772A0155AFFD7109B65DC8DEAA7B68FB08378F214324F624FB2D0C26D5D108795

Uniqueness

Uniqueness Score: -1.00%

Function 007E6477 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 105COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,007C1D72,00000000,007C2142,007C1D72,00000000,?,007E05AB,007C1D72,?), ref: 007E64AE
GetLastError.KERNEL32(?,007E05AB,007C1D72,?), ref: 007E64B7

Strings

Failed to wait for operation complete., xrefs: 007E658C
Failed to create operation complete event., xrefs: 007E652D
Failed to copy file name., xrefs: 007E6499
Failed to create extraction thread., xrefs: 007E657A
Failed to create begin operation event., xrefs: 007E64E6
cabextract.cpp, xrefs: 007E64DC, 007E6523, 007E6570

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp
API String ID: 545576003-1680384675
Opcode ID: bd1a8fde959607faa1e1d6bcd6390f8a6f6713871c68746244caaa3e0ea9e568
Instruction ID: 6ae7832a174689245f26d49521b7c653a489dc2a68928f5c098d8daaae845e1a
Opcode Fuzzy Hash: bd1a8fde959607faa1e1d6bcd6390f8a6f6713871c68746244caaa3e0ea9e568
Instruction Fuzzy Hash: 3B210BF234134ABEE3202A665CCDD3A269DE7AC7A4F254838F255D72C1E9BDDC114721

Uniqueness

Uniqueness Score: -1.00%

Function 007C9C0E Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007C9D22
_memset.LIBCMT ref: 007C9D31

Strings

Overflow while dealing with variable array buffer allocation, xrefs: 007C9CE8
variable.cpp, xrefs: 007C9C42, 007C9C7F, 007C9CAF, 007C9CDB, 007C9D8C
Failed to allocate room for variables., xrefs: 007C9D99
Failed to allocate room for more variables., xrefs: 007C9CBC
Overflow while growing variable array size, xrefs: 007C9C4C
Failed to copy variable name., xrefs: 007C9D54
Overflow while calculating size of variable array buffer, xrefs: 007C9C89

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memmove_memset
String ID: Failed to allocate room for more variables.$Failed to allocate room for variables.$Failed to copy variable name.$Overflow while calculating size of variable array buffer$Overflow while dealing with variable array buffer allocation$Overflow while growing variable array size$variable.cpp
API String ID: 3555123492-2816863117
Opcode ID: 6c30ae7be494a5e75876077f8bf9fb3dc45454ff012c35dc3a28c774a4ae5e9d
Instruction ID: 6fa2449c6f44542e4faae7eddb2cf49b5d600b9748a4b235e72e03809d8d563f
Opcode Fuzzy Hash: 6c30ae7be494a5e75876077f8bf9fb3dc45454ff012c35dc3a28c774a4ae5e9d
Instruction Fuzzy Hash: D941D7B5740309FBD7249B64CD4BF7AB7A9AF04710F10852DF306BA381EABCA9018754

Uniqueness

Uniqueness Score: -1.00%

Function 007D7915 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 126COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007D7943
LocalFree.KERNEL32(?,?,00000001,80000005,?,00000000,?,00000000,00000003,000007D0), ref: 007D7A7D

Strings

Failed to allocate access for SYSTEM group to path: %ls, xrefs: 007D7991
Failed to allocate access for Administrators group to path: %ls, xrefs: 007D7970
Failed to secure cache path: %ls, xrefs: 007D7A61
cache.cpp, xrefs: 007D7A1A
Failed to allocate access for Users group to path: %ls, xrefs: 007D79D8
Failed to allocate access for Everyone group to path: %ls, xrefs: 007D79B7
Failed to create ACL to secure cache path: %ls, xrefs: 007D7A2A

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: FreeLocal_memset
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
API String ID: 3302596199-4113288589
Opcode ID: b24d8134b040a7c6098763988dfd164609d621ed70a8b79589dd88066461d4bb
Instruction ID: a429776661b7acf697b1bfe44d68e92a98e4618474b00fb0978a0ab9dde7ceec
Opcode Fuzzy Hash: b24d8134b040a7c6098763988dfd164609d621ed70a8b79589dd88066461d4bb
Instruction Fuzzy Hash: 2941D372D04229EADF24AA548C8AFDDB774BB44700F40C0A6F648F7280FA795F54DB50

Uniqueness

Uniqueness Score: -1.00%

Function 007D152B Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,?,?,007C1E12,?), ref: 007D154D
GetLastError.KERNEL32(?,?,007C1E12,?), ref: 007D155A
CreateThread.KERNELBASE(00000000,00000000,Function_00011377,?,00000000,00000000), ref: 007D15AE
GetLastError.KERNEL32(?,?,007C1E12,?), ref: 007D15BB
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,007C1E12,?), ref: 007D1606
CloseHandle.KERNEL32(00000001,?,?,007C1E12,?), ref: 007D1626
FindCloseChangeNotification.KERNELBASE(?,?,?,007C1E12,?), ref: 007D1633

Strings

uithread.cpp, xrefs: 007D1581, 007D15E2
Failed to create the UI thread., xrefs: 007D15EC
Failed to create initialization event., xrefs: 007D158B

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorLast$ChangeEventFindHandleMultipleNotificationObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 1372344712-3599963359
Opcode ID: 15fe19e3d729ba10682339b0dba910282c3f702dd599a019859eac7a6583f160
Instruction ID: 3cc732e6d3700128a73b749c2449b078d58145f18b317d0671e6484256a6f546
Opcode Fuzzy Hash: 15fe19e3d729ba10682339b0dba910282c3f702dd599a019859eac7a6583f160
Instruction Fuzzy Hash: 753150B6D00209FFDB009F98DD859AEBBB9FB08300F60846AE216F6290D77C5A448B51

Uniqueness

Uniqueness Score: -1.00%

Function 007C2FFE Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 120fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00000008,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 007C302C
GetLastError.KERNEL32(?,?,?,00000000), ref: 007C3036
ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,?,?,00000000), ref: 007C30E3
GetLastError.KERNEL32(?,?,?,00000000), ref: 007C30ED

Strings

Failed to allocate data for message., xrefs: 007C30A6
pipe.cpp, xrefs: 007C3099, 007C30C6, 007C3117
Failed to read data for message., xrefs: 007C3121
Failed to read message from pipe., xrefs: 007C30D0

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$pipe.cpp
API String ID: 1948546556-3912962418
Opcode ID: 9dc45e237af7404c3d583cd0ba75b31fb9dea6fc015482f1d44d0505cd45a09b
Instruction ID: 3c213c76576c0a2418951f4ad9f785bf44a86c9dd6d2ddfb2e2fdc19aa2a0f2e
Opcode Fuzzy Hash: 9dc45e237af7404c3d583cd0ba75b31fb9dea6fc015482f1d44d0505cd45a09b
Instruction Fuzzy Hash: 9B416EB2A0021DFBEB119EA4CD85FAEBB79AB04710F20C46DE505EA151D2BD9B409B91

Uniqueness

Uniqueness Score: -1.00%

Function 007D9124 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,?,?,007D95E8,00000000,?,?,00000000,?), ref: 007D913E
GetLastError.KERNEL32(?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000,?,?,00000000,?), ref: 007D914C

Part of subcall function 007D7E2A: _memset.LIBCMT ref: 007D7E54

CloseHandle.KERNEL32(000000FF,?,?,007D95E8,00000000,?,?,00000000,?,?,00000000,00000000), ref: 007D9218

Strings

Failed to open payload at path: %ls, xrefs: 007D9191
Failed to verify signature of payload: %ls, xrefs: 007D91BB
Failed to verify catalog signature of payload: %ls, xrefs: 007D91DC
cache.cpp, xrefs: 007D9184
Failed to verify hash of payload: %ls, xrefs: 007D9201

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_memset
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
API String ID: 1470872789-2757871984
Opcode ID: 423be15f8c97a7f5b178f19340c9c9b1eed74f909ee7d09743770a44755a9c2f
Instruction ID: 36b1b4fa9e661ffe12a7454155b63fb2fb2751d8b0584ab7fd23d375a94c49d5
Opcode Fuzzy Hash: 423be15f8c97a7f5b178f19340c9c9b1eed74f909ee7d09743770a44755a9c2f
Instruction Fuzzy Hash: B221EA31740605FBCB225A54CD09F6E3A76FF85730F20411AFA15A63A0E77EAA51EB11

Uniqueness

Uniqueness Score: -1.00%

Function 007D0E3A Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 007D0E50
GetLastError.KERNEL32 ref: 007D0E5A
CoInitializeEx.OLE32(00000000,00000000), ref: 007D0E9C
CoUninitialize.OLE32(?,007D0347,?,?), ref: 007D0ED9

Strings

Failed to set elevated cache pipe into thread local storage for logging., xrefs: 007D0E89
Failed to initialize COM., xrefs: 007D0EA8
Failed to pump messages in child process., xrefs: 007D0EC7
elevation.cpp, xrefs: 007D0E7F

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
API String ID: 876858697-113251691
Opcode ID: f7a747acbfd02085665493a3c2bfa26f36d71876b50241291cccadb4a52c1233
Instruction ID: 40b9e510ca60b74885a8e0f1ee57a59ebc828813c8441555c7345befea1db922
Opcode Fuzzy Hash: f7a747acbfd02085665493a3c2bfa26f36d71876b50241291cccadb4a52c1233
Instruction Fuzzy Hash: B2112972A41625FBD3216765DC0AB6F7B68EF44B60F044526F904FB390EBACEC0082E5

Uniqueness

Uniqueness Score: -1.00%

Function 007C71FB Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,?,?,00020006,00000000,00000000,00000000,?,00000000,00000001), ref: 007C732B
RegCloseKey.ADVAPI32(00000001,00000000,00000000,?,?,00020006,00000000,00000000,00000000,?,00000000,00000001), ref: 007C7338

Part of subcall function 007F371B: RegCreateKeyExW.KERNELBASE(00000001,00000000,00000000,00000000,00000000,00000001,007C13BB,?,?,00000001,?,007C7275,?,007C13BB,00020006,00000001), ref: 007F373F

Strings

Failed to delete registration key: %ls, xrefs: 007C72DB
%ls.RebootRequired, xrefs: 007C724F
Failed to update resume mode., xrefs: 007C7310
Failed to open registration key., xrefs: 007C7369
Failed to write volatile reboot required registry key., xrefs: 007C7279

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: af17674587dd4c5198445f6327750a973b3dadb92bcde18377f096918fe451b5
Instruction ID: 024803d12c63f5a0ceb1d1a5ee319f839d4f3418b09b620e72e84304d4725699
Opcode Fuzzy Hash: af17674587dd4c5198445f6327750a973b3dadb92bcde18377f096918fe451b5
Instruction Fuzzy Hash: CF418172904248FBDF25AFA0DC8ADAE77BAFF44314B14483EF60162211DB799A50EF51

Uniqueness

Uniqueness Score: -1.00%

Function 007EFF4A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007EFF61
CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,007C2A93,?,?,?,?,00000000,00000000), ref: 007EFFB8
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 007EFFC2
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 007F000C
CloseHandle.KERNEL32(007C2A93,?,?,?,?,00000000,00000000,00000000), ref: 007F0019

Strings

procutil.cpp, xrefs: 007EFFE7
"%ls" %ls, xrefs: 007EFF85

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess_memset
String ID: "%ls" %ls$procutil.cpp
API String ID: 1393943095-4145822745
Opcode ID: fa4a44a6cd1e14737ac6292906ef029ba51ca39f31f2f2f1dcf9b9d1000290ca
Instruction ID: 42d9a99eae49ad414e8a930d7e5ed7228423e9f2122af3fd272d626ce6d76353
Opcode Fuzzy Hash: fa4a44a6cd1e14737ac6292906ef029ba51ca39f31f2f2f1dcf9b9d1000290ca
Instruction Fuzzy Hash: 32216D72A0014EEBDB109FE9CD859EE7BB9EB49310F14003AF604F6211D6798E54DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 007C2A19 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?), ref: 007C2A2D

Part of subcall function 007F1A74: GetModuleFileNameW.KERNEL32(6!|,?,00000104,?,00000104,?,00000000,?,?,007C2136,?,00000000,?,?,?,76EEC3F0), ref: 007F1A95

CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 007C2AB2

Part of subcall function 007EFF4A: _memset.LIBCMT ref: 007EFF61
Part of subcall function 007EFF4A: CreateProcessW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,007C2A93,?,?,?,?,00000000,00000000), ref: 007EFFB8
Part of subcall function 007EFF4A: GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 007EFFC2
Part of subcall function 007EFF4A: CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 007F000C
Part of subcall function 007EFF4A: CloseHandle.KERNEL32(007C2A93,?,?,?,?,00000000,00000000,00000000), ref: 007F0019

Strings

Failed to launch parent process with unelevate disabled: %ls, xrefs: 007C2A9C
%ls -%ls %ls %ls %u, xrefs: 007C2A5E
Failed to get current process path., xrefs: 007C2A45
burn.unelevated, xrefs: 007C2A56
Failed to allocate parameters for elevated process., xrefs: 007C2A72

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseHandle$Process$CreateCurrentErrorFileLastModuleName_memset
String ID: %ls -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to get current process path.$Failed to launch parent process with unelevate disabled: %ls$burn.unelevated
API String ID: 1951228193-688900554
Opcode ID: e75682af217bf05db32173947d7cf6de313ea8e382dce23597189658e8920b0c
Instruction ID: a58b55c5ba2355de44b39383ef952d096bced95ba5c1f5fe882af023eb277850
Opcode Fuzzy Hash: e75682af217bf05db32173947d7cf6de313ea8e382dce23597189658e8920b0c
Instruction Fuzzy Hash: 0D214F72D4021CFBCF21ABA4DC49CEDBBB8AF54750B10816AFA1472222E7794B529B51

Uniqueness

Uniqueness Score: -1.00%

Function 007CE8A3 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,007D1236,00000000,?,007D0EE7,?,00000000,?,?,?,007C1DEA,?), ref: 007CE8B5
GetLastError.KERNEL32(?,?,007D1236,00000000,?,007D0EE7,?,00000000,?,?,?,007C1DEA,?,?), ref: 007CE8BF
GetExitCodeThread.KERNELBASE(?,?,?,?,007D1236,00000000,?,007D0EE7,?,00000000,?,?,?,007C1DEA,?,?), ref: 007CE8FC
GetLastError.KERNEL32(?,?,007D1236,00000000,?,007D0EE7,?,00000000,?,?,?,007C1DEA,?,?), ref: 007CE906

Strings

Failed to get cache thread exit code., xrefs: 007CE935
elevation.cpp, xrefs: 007CE8E4, 007CE92B
Failed to wait for cache thread to terminate., xrefs: 007CE8EE

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
API String ID: 3686190907-1954264426
Opcode ID: 02004ee441a38165ae947623fc865c82ad7aed98ee091d60668fd49d1c2a731a
Instruction ID: 0083b98603f383d0339f168877e8f495f0d142698bb8ca042999bc9ca2b856c6
Opcode Fuzzy Hash: 02004ee441a38165ae947623fc865c82ad7aed98ee091d60668fd49d1c2a731a
Instruction Fuzzy Hash: 7301B972A41226B6D72057619C0EF6A7B98EF01B71F15813CFA08FA2D1D6BDDD0082DA

Uniqueness

Uniqueness Score: -1.00%

Function 007D1133 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 111threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00010E3A,?,00000000,00000000), ref: 007D11BC
GetLastError.KERNEL32(?,?,?,007C1DEA,?,?), ref: 007D11C8

Part of subcall function 007CE8A3: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,007D1236,00000000,?,007D0EE7,?,00000000,?,?,?,007C1DEA,?), ref: 007CE8B5
Part of subcall function 007CE8A3: GetLastError.KERNEL32(?,?,007D1236,00000000,?,007D0EE7,?,00000000,?,?,?,007C1DEA,?,?), ref: 007CE8BF

CloseHandle.KERNEL32(00000000,00000000,?,007D0EE7,?,00000000,?,?,?,007C1DEA,?,?), ref: 007D1247

Strings

Failed to pump messages in child process., xrefs: 007D1221
elevation.cpp, xrefs: 007D11ED
Failed to create elevated cache thread., xrefs: 007D11F7

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$elevation.cpp
API String ID: 3606931770-4134175193
Opcode ID: 9c26fc20f438d6595d3a62228dfa95e72012665bb09dc82f194d824eac980ae7
Instruction ID: 91c9ee07592fd3e6d1932fa1c30eb3f071bffe536fa1a5a93941ed9ff7762ec8
Opcode Fuzzy Hash: 9c26fc20f438d6595d3a62228dfa95e72012665bb09dc82f194d824eac980ae7
Instruction Fuzzy Hash: CF4102B1A01219AFDB00DF99D8859EEBBF8FF48710F10412AF909E7340D679A941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 007F3BEA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(F08B8007,057CF33B,BundleUpgradeCode,007C13BB,00000000,00000000,F08B8007,057CF33B,00020006,00000000,?,?,C5330081), ref: 007F3C27
lstrlenW.KERNEL32(F08B8007,00020006,00000001,F08B8007,00020006,00000001,BundleUpgradeCode,007C13BB,00000000), ref: 007F3C88
lstrlenW.KERNEL32(F08B8007), ref: 007F3C8F
RegSetValueExW.KERNELBASE(00020006,00000000,00000000,00000007,00020006,00000000,00000001,00000000,00000000,00020006,00000001,BundleUpgradeCode,007C13BB,00000000), ref: 007F3CCB

Strings

regutil.cpp, xrefs: 007F3CF7
BundleUpgradeCode, xrefs: 007F3BF2

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: lstrlen$Value
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 198323757-1648651458
Opcode ID: 9f422d40303668541f218b3138e1e6b2fb82bf32f9afd2070ac72bf90d95681e
Instruction ID: 7f9dd684f4dff2b8114d162a577a0a32890ce7d42b0a9185b3be84e764c071a6
Opcode Fuzzy Hash: 9f422d40303668541f218b3138e1e6b2fb82bf32f9afd2070ac72bf90d95681e
Instruction Fuzzy Hash: 474105B1E0020EEBDB01DFA4C984AAEBBB9FF04354F104065EA10BB251D679EA55DB61

Uniqueness

Uniqueness Score: -1.00%

Function 007DC569 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 007DC5CB

Strings

%s%="%s", xrefs: 007DC5F1
Failed to append property string part., xrefs: 007DC640
Failed to escape string., xrefs: 007DC632
Failed to format property value., xrefs: 007DC62B
Failed to format property string part., xrefs: 007DC639

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
API String ID: 3613110473-515423128
Opcode ID: e2b7184039d2614ce76a80dadc289464f3019cd568db5fe4c3ba5a0e8cf6ba17
Instruction ID: 7d6ba7379196de19ae6f66b27ab6430902383217801f19b13bc7b591b6c3b9b6
Opcode Fuzzy Hash: e2b7184039d2614ce76a80dadc289464f3019cd568db5fe4c3ba5a0e8cf6ba17
Instruction Fuzzy Hash: A6317C72D0411BEFCF12AF98DC858AEB7B5FB04300B24456BF611A2341E338AE60DB91

Uniqueness

Uniqueness Score: -1.00%

Function 007CF44E Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007CF465

Strings

Failed to read action., xrefs: 007CF4D0
Failed to read bundle dependency key from message buffer., xrefs: 007CF4B0
Failed to execute package dependency action., xrefs: 007CF529
Failed to read package id from message buffer., xrefs: 007CF48D
Failed to find package: %ls, xrefs: 007CF508

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memset
String ID: Failed to execute package dependency action.$Failed to find package: %ls$Failed to read action.$Failed to read bundle dependency key from message buffer.$Failed to read package id from message buffer.
API String ID: 2102423945-4197210911
Opcode ID: 46a79a93d8b90c9c1a1db9626bb87d618ea32a4216ff715117091fb9888ac410
Instruction ID: 6a79df5c5fda37f647f6635ed30b3ae1f3fff250d89e6e229e82868ce72e87bd
Opcode Fuzzy Hash: 46a79a93d8b90c9c1a1db9626bb87d618ea32a4216ff715117091fb9888ac410
Instruction Fuzzy Hash: 35312C72D40169FBCF12EE90EC09FEE7B79AB14720F104169FA00E6291D7799E24A791

Uniqueness

Uniqueness Score: -1.00%

Function 007EFE13 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,00000000,76EEC3F0,?,00000000), ref: 007EFE35
GetLastError.KERNEL32 ref: 007EFE3F
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?), ref: 007EFE72
GetLastError.KERNEL32 ref: 007EFE8B
FindCloseChangeNotification.KERNELBASE(00000000), ref: 007EFECB

Strings

procutil.cpp, xrefs: 007EFEB9

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLastToken$ChangeCloseFindInformationNotificationOpenProcess
String ID: procutil.cpp
API String ID: 3650908616-1178289305
Opcode ID: 250c1b935191f6d1d9fabad8332c63772710d8493fc68414e0eba96a098eff07
Instruction ID: 377e8b703cd6d17b31ae4e42813d13d452586c2c1c28d7218597f9ef868b544b
Opcode Fuzzy Hash: 250c1b935191f6d1d9fabad8332c63772710d8493fc68414e0eba96a098eff07
Instruction Fuzzy Hash: 82212672A01155FFD720AFA5CC85AAEBBB8FF0C310F108076E505EA461D23CAE44DB91

Uniqueness

Uniqueness Score: -1.00%

Function 007D7800 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(00000000,00000008,00000002,0000001A,?,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 007D783E
GetLastError.KERNEL32 ref: 007D7848
SetFileAttributesW.KERNELBASE(00000000,00000080,00000000,00000001,20000004,?,00000000,00000000,00000000,00000003,000007D0,00000000,00000000,00000000,00000000,?), ref: 007D78B0

Strings

cache.cpp, xrefs: 007D786D
Failed to initialize ACL., xrefs: 007D7877
Failed to allocate administrator SID., xrefs: 007D782F

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
API String ID: 669721577-1117388985
Opcode ID: f5a9c02b5046053c1e4c594948b898a2dbdaba99cdfa4064d08fc16e09997378
Instruction ID: c85edfd09b0c8d7db2ee22535110771baa58c5fb5d65343e3191789045cbf89b
Opcode Fuzzy Hash: f5a9c02b5046053c1e4c594948b898a2dbdaba99cdfa4064d08fc16e09997378
Instruction Fuzzy Hash: 7E11DD71E44104FAEB25A6949C0EFAE7779AB44750F108136F615FB2D0F57C4E04E691

Uniqueness

Uniqueness Score: -1.00%

Function 007F2FFF Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007F2A2D: _memset.LIBCMT ref: 007F2A54
Part of subcall function 007F2A2D: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 007F2A69
Part of subcall function 007F2A2D: LoadLibraryW.KERNELBASE(?,?,00000104,007C1C3B), ref: 007F2AB7
Part of subcall function 007F2A2D: GetLastError.KERNEL32 ref: 007F2AC3

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 007F302A
GetLastError.KERNEL32(?,007C16AF,00000001,00000000,?,?,?,?,007C1DEA,?,?), ref: 007F3039

Strings

srputil.cpp, xrefs: 007F305B
SRSetRestorePointW, xrefs: 007F301F
srclient.dll, xrefs: 007F3008
`Djl, xrefs: 007F3030

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast$AddressDirectoryLibraryLoadProcSystem_memset
String ID: SRSetRestorePointW$`Djl$srclient.dll$srputil.cpp
API String ID: 2131201312-1570538514
Opcode ID: fb6329420b126db264ea6d1f68452f2cf15ef38f871e9c5f598828244541b63f
Instruction ID: 69c3715183c35e65d7966610d2821fb9e1630d3c787d6cd9dc6db19a120259b1
Opcode Fuzzy Hash: fb6329420b126db264ea6d1f68452f2cf15ef38f871e9c5f598828244541b63f
Instruction Fuzzy Hash: 2201A732A8462AD7D23117549C0EB752949EF007B1F014136AF04EA391DD6DDA40D795

Uniqueness

Uniqueness Score: -1.00%

Function 007F4DC3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007F4DD2
InterlockedIncrement.KERNEL32(00815E68), ref: 007F4DEF
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,00815E58), ref: 007F4E0A
CLSIDFromProgID.OLE32(MSXML.DOMDocument,00815E58), ref: 007F4E16

Strings

MSXML.DOMDocument, xrefs: 007F4E11
Msxml2.DOMDocument, xrefs: 007F4E05

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: 2cf6ca79b75503df8014f0c2fc0841babf0f8039d765bbee8adb4079cc14fdc4
Instruction ID: 1b135240fb717b9029a67333bd79e88a4be1e92421408c7c48e9c133df05d61b
Opcode Fuzzy Hash: 2cf6ca79b75503df8014f0c2fc0841babf0f8039d765bbee8adb4079cc14fdc4
Instruction Fuzzy Hash: CEF0A079B80269E7C71017A56C0CBB73EB9FBC1F71F200054EB04C2310D39C9882C6A6

Uniqueness

Uniqueness Score: -1.00%

Function 007D1297 Relevance: 9.1, APIs: 6, Instructions: 84windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 007D12C2
SetWindowLongW.USER32(?,000000EB,00000000), ref: 007D12D1
SetWindowLongW.USER32(?,000000EB,?), ref: 007D12E5
DefWindowProcW.USER32(?,?,?,?), ref: 007D12F5
GetWindowLongW.USER32(?,000000EB), ref: 007D130F
PostQuitMessage.USER32(00000000), ref: 007D136A

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: a1e2a2af23d43ee4f1e86d63f2cfd98a9c9db6bd2a03378bcd129e85226e98a6
Instruction ID: 8d5cc5113e8f1f46470b838205c17da7b49cddc2797ef6f1815306251cf1ee30
Opcode Fuzzy Hash: a1e2a2af23d43ee4f1e86d63f2cfd98a9c9db6bd2a03378bcd129e85226e98a6
Instruction Fuzzy Hash: 5B21BE72204208FFDB115F74DC09E6B7B79FF89320F948526F956962A0C639DC20DB91

Uniqueness

Uniqueness Score: -1.00%

Function 007D0EE7 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 161synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 007D0F3E
CloseHandle.KERNEL32(?), ref: 007D0F46

Strings

Unexpected elevated message sent to child process, msg: %u, xrefs: 007D10D3
Failed to save state., xrefs: 007D0FAC
elevation.cpp, xrefs: 007D10C4

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
API String ID: 4207627910-1576875097
Opcode ID: 145efd4049450a62768b78fb130edcbca7c86a1b47f031fc19e31635305e7c95
Instruction ID: 208012b9f4acd02af35dceb29bae50fb6066ad7aad527e5546d16e3287308c4e
Opcode Fuzzy Hash: 145efd4049450a62768b78fb130edcbca7c86a1b47f031fc19e31635305e7c95
Instruction Fuzzy Hash: AD510979104600FFCB259F54C945E1ABBB6FF0C320B11C45AF99A9B722C736E910EB51

Uniqueness

Uniqueness Score: -1.00%

Function 007E5FB8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?), ref: 007E607B
GetLastError.KERNEL32 ref: 007E6085

Strings

Failed to move file pointer 0x%x bytes., xrefs: 007E60BC
Invalid seek type., xrefs: 007E5FF4
cabextract.cpp, xrefs: 007E60AF

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: 9ff51d535ad68f0180dbc3ee7b8b75ef151b17e37405b08d86117c28d9261fcf
Instruction ID: e5eab2de4738b6d3cfa5c9d0984196f33060086860347d033536a186b3eeb5b1
Opcode Fuzzy Hash: 9ff51d535ad68f0180dbc3ee7b8b75ef151b17e37405b08d86117c28d9261fcf
Instruction Fuzzy Hash: 9A418F71A01259EFCB10CF6AC884E99B7B5FF58364F14C165E818EB261E779ED00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 007F5A70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

MoveFileExW.KERNELBASE(00000003,00000001,000007D0,?,00000000,?,?,?,007F5B97,00000003,00000001,00000001,00000000,00000000,00000000), ref: 007F5A9D
GetLastError.KERNEL32(?,?,?,007F5B97,00000003,00000001,00000001,00000000,00000000,00000000,?,007D7625,?,00000000,00000001,00000001), ref: 007F5AAB
MoveFileExW.KERNELBASE(00000003,00000001,000007D0,00000001,00000000,?,?,?,007F5B97,00000003,00000001,00000001,00000000,00000000,00000000), ref: 007F5B0F
GetLastError.KERNEL32(?,?,?,007F5B97,00000003,00000001,00000001,00000000,00000000,00000000,?,007D7625,?,00000000,00000001,00000001), ref: 007F5B19

Strings

fileutil.cpp, xrefs: 007F5B39

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastMove
String ID: fileutil.cpp
API String ID: 55378915-2967768451
Opcode ID: 54d1fac1b22a191830d59e46cb40dada62253190efde314663b9e201f6e2077a
Instruction ID: 314a0c0bd265a62469adf72a78e0dc2bde5a1556d308d8abd434b3ed53d79c51
Opcode Fuzzy Hash: 54d1fac1b22a191830d59e46cb40dada62253190efde314663b9e201f6e2077a
Instruction Fuzzy Hash: EE21C1B6600A1EEBDF214E55CC48A7E7AA5EF807A0F24812AFB04D7350D67DCD5192A1

Uniqueness

Uniqueness Score: -1.00%

Function 007F593D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(00000000,00000000,00000000,?,?,00000000,?,007F5A4A,00000000,00000000,?,?,?,007D7736,00000000,?), ref: 007F5957
GetLastError.KERNEL32(?,007F5A4A,00000000,00000000,?,?,?,007D7736,00000000,?,00000001,00000003,000007D0,?,?,007D9676), ref: 007F5965
CopyFileW.KERNEL32(00000000,00000000,?,00000000,00000000,?,007F5A4A,00000000,00000000,?,?,?,007D7736,00000000,?,00000001), ref: 007F59C9
GetLastError.KERNEL32(?,007F5A4A,00000000,00000000,?,?,?,007D7736,00000000,?,00000001,00000003,000007D0,?,?,007D9676), ref: 007F59D3

Strings

fileutil.cpp, xrefs: 007F59F3

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: fileutil.cpp
API String ID: 374144340-2967768451
Opcode ID: 3008dfed1cd7e44f94c7c801f6e4fc9092d1c3023744057e8195f89f4bf39cf0
Instruction ID: 6c86c4fc097c7451e35ef716f0dce0b4102373c2f60d5a2ace0447402b5177bd
Opcode Fuzzy Hash: 3008dfed1cd7e44f94c7c801f6e4fc9092d1c3023744057e8195f89f4bf39cf0
Instruction Fuzzy Hash: EB21F972610A1EDBDF304E15CC44B3A3A99EF807B0B508539FB18D7350D66CCC519661

Uniqueness

Uniqueness Score: -1.00%

Function 007F540B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007F5421
SysAllocString.OLEAUT32(?), ref: 007F543D
VariantClear.OLEAUT32(?), ref: 007F54C4
SysFreeString.OLEAUT32(00000000), ref: 007F54CF

Strings

xmlutil.cpp, xrefs: 007F5454

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: xmlutil.cpp
API String ID: 760788290-1270936966
Opcode ID: c74aef6b2166af0fabdcc02e4b98b91b21e04dd4f045600ca98f961b27a426b9
Instruction ID: b3fbacd280278d3a3d98b469cd3957344b97a1d336386985352b426b9238fd76
Opcode Fuzzy Hash: c74aef6b2166af0fabdcc02e4b98b91b21e04dd4f045600ca98f961b27a426b9
Instruction Fuzzy Hash: 0C215C71E0061DAFCB109FA4C888EBEBBA8AF04766F154564EB05EB310D679DD809B90

Uniqueness

Uniqueness Score: -1.00%

Function 007E0D9A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007F378B: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,007D1F19,?,00000009,00000000,?,007D1BE1,80000002,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001), ref: 007F379F

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,?,?,?,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,?,?,?,00000000), ref: 007E0E19
RegCloseKey.ADVAPI32(?,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,?,?,?,00000000,?,?,?,?,00000001,00000000), ref: 007E0E63

Strings

Failed to enumerate uninstall key for related bundles., xrefs: 007E0E3D
Failed to open uninstall registry key., xrefs: 007E0DE2
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 007E0DB6

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: a5d46d61c6d544e398f7fed2616a7af66b1fbb1317705bc60445ef4307e2e549
Instruction ID: 42c3400ddf11294d3b36781a29ab9f1000bd01f539ef730bb230edb9c3412f34
Opcode Fuzzy Hash: a5d46d61c6d544e398f7fed2616a7af66b1fbb1317705bc60445ef4307e2e549
Instruction Fuzzy Hash: CB21A17AD01258FBCF21AFE59C8A8DDBB75AB08320B244579FA25B3150C2795EC0D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 007F65D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000003,00000001,00000000,00000001,?,007F5AFC,00000001,00000000,?,?,?,007F5B97,00000003,00000001,00000001,00000000), ref: 007F65E1
GetLastError.KERNEL32(?,007F5AFC,00000001,00000000,?,?,?,007F5B97,00000003,00000001,00000001,00000000,00000000,00000000,?,007D7625), ref: 007F65EF

Part of subcall function 007F65A8: GetFileAttributesW.KERNEL32(00000003,00000000,?,007F660C,00000003,00000000,?,007F5AFC,00000001,00000000,?,?,?,007F5B97,00000003,00000001), ref: 007F65B1

Part of subcall function 007F65D3: CreateDirectoryW.KERNELBASE(00000003,00000001,00000000,?,007F5AFC,00000001,00000000,?,?,?,007F5B97,00000003,00000001,00000001,00000000,00000000), ref: 007F666A
Part of subcall function 007F65D3: GetLastError.KERNEL32(?,007F5AFC,00000001,00000000,?,?,?,007F5B97,00000003,00000001,00000001,00000000,00000000,00000000,?,007D7625), ref: 007F6674

Strings

dirutil.cpp, xrefs: 007F6640

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CreateDirectoryErrorLast$AttributesFile
String ID: dirutil.cpp
API String ID: 925696554-2193988115
Opcode ID: 34ed4395b5da97b0d11516485c9713a8c4447da597f5608008474ddb8f552f94
Instruction ID: 2695d6c23f41b3ade353f900df22583b21238292d38e3da85ac9d65503c228d0
Opcode Fuzzy Hash: 34ed4395b5da97b0d11516485c9713a8c4447da597f5608008474ddb8f552f94
Instruction Fuzzy Hash: 5D11E27620420EA6DB301B669C48B3B37A9EFD5761F104429FF49DA350EA3DDC019365

Uniqueness

Uniqueness Score: -1.00%

Function 007E05CB Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E05DD

Strings

WixBundleElevated, xrefs: 007E05D1
Failed to open attached container., xrefs: 007E0649
Failed to get path for executing module., xrefs: 007E062B
Failed to get container information for UX container., xrefs: 007E0614

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memset
String ID: Failed to get container information for UX container.$Failed to get path for executing module.$Failed to open attached container.$WixBundleElevated
API String ID: 2102423945-2733515141
Opcode ID: b64f1fc3c4d7400562d93ec5cbf3c10faad099ab60dc554197b2eb1ca856d8e4
Instruction ID: db158408520b31c41238f43804d9ef127b1f7d8f8f2bc5639796191351f07f26
Opcode Fuzzy Hash: b64f1fc3c4d7400562d93ec5cbf3c10faad099ab60dc554197b2eb1ca856d8e4
Instruction Fuzzy Hash: 6911D0B2C01158FBCB10EBE59D49DEEB7BCEA98300B10412AF525E7240E6B84E41C790

Uniqueness

Uniqueness Score: -1.00%

Function 007C10DC Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,?,007C1ED4,?,?,?,?,?), ref: 007C1120
DeleteCriticalSection.KERNEL32(?,00000000,?,?,007C1ED4,?,?,?,?,?), ref: 007C113A
TlsFree.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 007C120B
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 007C1212
_memset.LIBCMT ref: 007C121C

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CriticalDeleteSection$CloseFreeHandle_memset
String ID:
API String ID: 3611737199-0
Opcode ID: 5db74c390188513229eeccb4f570153ad9df3a3286fe278401b8457a838ac48b
Instruction ID: 262d4427569c8087db19a5df4d23cf4657c291235d0aeca3b324f33d145d85a3
Opcode Fuzzy Hash: 5db74c390188513229eeccb4f570153ad9df3a3286fe278401b8457a838ac48b
Instruction Fuzzy Hash: 2F31E8B1A0070AA7DA60EBB5C889FAF73DCAF05700F84492DB659D3142DB3CF6458765

Uniqueness

Uniqueness Score: -1.00%

Function 007F3336 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 153registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,?,?), ref: 007F335F
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,?), ref: 007F3397
lstrlenW.KERNEL32(00000000,?,00000000,00000000,?,?,00000004,00000000,?,?,?,?,?,00020019,00000000,?), ref: 007F34A1

Strings

regutil.cpp, xrefs: 007F340A

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: regutil.cpp
API String ID: 3790715954-955085611
Opcode ID: d3c4b10ea0a9171c1e81b5af38ed599db564dcd87b731a12b1258936dea04b1e
Instruction ID: 6f48d63813474761ff1b77dbbfe06c313f58749cfe162d73924b6f51769932e2
Opcode Fuzzy Hash: d3c4b10ea0a9171c1e81b5af38ed599db564dcd87b731a12b1258936dea04b1e
Instruction Fuzzy Hash: 2E519376A0015DEBDB22DF98C8849BEB7B5EF04310F208579EF15A7341D6389F059BA0

Uniqueness

Uniqueness Score: -1.00%

Function 007F37F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000002,?,00000000,00000000,?,?,007E0DFE), ref: 007F384C
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,007E0DFE,?), ref: 007F386E
RegEnumKeyExW.KERNELBASE(?,?,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,007E0DFE,?,?,?), ref: 007F38B9

Strings

regutil.cpp, xrefs: 007F38E0

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: regutil.cpp
API String ID: 73471667-955085611
Opcode ID: 369f3894308c0bc2d76988a542b9efa2fd7bd687c07fa3bc11404125b05c22f5
Instruction ID: 6fe97e008ad24f88aab14c5a8fc5aeb7a80c3c8889a43b67ccd59079d3bfa048
Opcode Fuzzy Hash: 369f3894308c0bc2d76988a542b9efa2fd7bd687c07fa3bc11404125b05c22f5
Instruction Fuzzy Hash: CD314E71A0112CFBDB119A90CC89DBFBEADEF09B90F204425F605DA211D6BD9F5097E0

Uniqueness

Uniqueness Score: -1.00%

Function 007F308D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F30B2

Strings

d, xrefs: 007F30F7
srputil.cpp, xrefs: 007F313E
`Djl, xrefs: 007F30B7

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memset
String ID: `Djl$d$srputil.cpp
API String ID: 2102423945-4196765992
Opcode ID: 2f273faf040f8ca046d0e6c738f961fd779097db47ec0d102df0791afa204f55
Instruction ID: cb657643d77c86483351572599cc11200dcffa6c4df1819888aa01f68e8dcaae
Opcode Fuzzy Hash: 2f273faf040f8ca046d0e6c738f961fd779097db47ec0d102df0791afa204f55
Instruction Fuzzy Hash: 9511DD71B4061DBADB20DAA4DC85EFFB7B8EB08704F004579A701EB241DA7DDE098B50

Uniqueness

Uniqueness Score: -1.00%

Function 007E0CDA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007F378B: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,007D1F19,?,00000009,00000000,?,007D1BE1,80000002,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001), ref: 007F379F

RegCloseKey.KERNELBASE(00000000,00000000,00000000,?,?,00020019,00000000,?,?,?,?,007E0E36,?,?,?), ref: 007E0D8D

Strings

Failed to initialize package from related bundle id: %ls, xrefs: 007E0D6A
Failed to open uninstall key for potential related bundle: %ls, xrefs: 007E0D01
Failed to ensure there is space for related bundles., xrefs: 007E0D39

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 38d897157c7b9512ab6740711409787e1f1ecefbfcaeb9f382d85c537e2361c8
Instruction ID: 6f74c6121e43a6b3e580623304160bf248a92886ec58aa474ac03dfd56b33b52
Opcode Fuzzy Hash: 38d897157c7b9512ab6740711409787e1f1ecefbfcaeb9f382d85c537e2361c8
Instruction Fuzzy Hash: A82105B6241649FFDB12DA85CC45FBE72B9EB58315F204024F815A6280E7BCEE80A760

Uniqueness

Uniqueness Score: -1.00%

Function 007EF0FA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,007EF2EC,?,?,.1|,00000000,0000FDE9,?,007C312E,?,Failed to read data for message.), ref: 007EF10C
WriteFile.KERNEL32(?,?,?,00000000,?,?,007EF2EC,?,?,.1|,00000000,0000FDE9,?,007C312E,?,Failed to read data for message.), ref: 007EF14E
GetLastError.KERNEL32(?,?,007EF2EC,?,?,.1|,00000000,0000FDE9,?,007C312E,?,Failed to read data for message.,pipe.cpp,00000340,?), ref: 007EF158

Strings

logutil.cpp, xrefs: 007EF182

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: 34f8d188042bb4fda7396a8daba9beff4793862d8cac471a48ce9ece1da70e1d
Instruction ID: b9a2de25668343efa79aa5495e7ab176e15d0052c906c5ca35760efa76d51116
Opcode Fuzzy Hash: 34f8d188042bb4fda7396a8daba9beff4793862d8cac471a48ce9ece1da70e1d
Instruction Fuzzy Hash: EA11CEB130128EFAD7109F9ADD85AAB7AACFF097A4B104139F904D7540D7B8DD4086A1

Uniqueness

Uniqueness Score: -1.00%

Function 007E5F23 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007E5E49: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,00000000,?,?,007E5F51,?,?), ref: 007E5E6E
Part of subcall function 007E5E49: GetLastError.KERNEL32(?,007E5F51,?,?), ref: 007E5E78

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?), ref: 007E5F5F
GetLastError.KERNEL32 ref: 007E5F69

Strings

Failed to read during cabinet extraction., xrefs: 007E5F98
cabextract.cpp, xrefs: 007E5F8E

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 63afd4e0dea82a9472c0c1bb5f673df6430bd02050cabab82e3742c4c000762d
Instruction ID: 66c4d4d1c95d6eff7cb3ba3c5d0f47f8cd75aa39bcd8f7895efe9615531b882c
Opcode Fuzzy Hash: 63afd4e0dea82a9472c0c1bb5f673df6430bd02050cabab82e3742c4c000762d
Instruction Fuzzy Hash: 10010436200649FBDB118F55ED05EAA3BF8FF88724F104128F914EB290D739E901DB50

Uniqueness

Uniqueness Score: -1.00%

Function 007F6182 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(E9007FE1,40000000,00000001,00000000,00000002,00000080,00000000,00000000,007C7081,?,007C5F72,007C7081,00000080,E9007FE1,00000000), ref: 007F619A
GetLastError.KERNEL32(?,007C5F72,007C7081,00000080,E9007FE1,00000000,?,?,007C7081,007C13BB,?,?,?,?,?,DisplayName), ref: 007F61A7
FindCloseChangeNotification.KERNELBASE(00000000,00000000,007C7081,007C5F72,?,007C5F72,007C7081,00000080,E9007FE1,00000000,?,?,007C7081,007C13BB), ref: 007F61FC

Strings

fileutil.cpp, xrefs: 007F61CC

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ChangeCloseCreateErrorFileFindLastNotification
String ID: fileutil.cpp
API String ID: 4091947256-2967768451
Opcode ID: fa1d8da6e5a41d1d84041412cc95c7cb035f72915fa970c90b5e9c2acc8d9ac2
Instruction ID: 887f40a5030607600333200ab8142a2935a434b4e1543d8f42ef58f09d84968b
Opcode Fuzzy Hash: fa1d8da6e5a41d1d84041412cc95c7cb035f72915fa970c90b5e9c2acc8d9ac2
Instruction Fuzzy Hash: 5301D83220051D77D7211A189D09FBA3A55AB81770F154220FF34A63E1D77DC810A2A5

Uniqueness

Uniqueness Score: -1.00%

Function 007E5E49 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,00000000,?,?,007E5F51,?,?), ref: 007E5E6E
GetLastError.KERNEL32(?,007E5F51,?,?), ref: 007E5E78

Strings

Failed to move to virtual file pointer., xrefs: 007E5EA7
cabextract.cpp, xrefs: 007E5E9D

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: 1e3ec0b3940fc401ea5c40f72bd7178097397b37065ddcb6dc40d36ad8892eac
Instruction ID: 8daf7cf59b87d1d8c39eed05cbf1de31ad6dcf4c25165c5bb95d2405a9777609
Opcode Fuzzy Hash: 1e3ec0b3940fc401ea5c40f72bd7178097397b37065ddcb6dc40d36ad8892eac
Instruction Fuzzy Hash: 5E01F232201B4AABE3201A56DC09F177B95AB84B74F10C029F618DE290EABDE8009654

Uniqueness

Uniqueness Score: -1.00%

Function 007F2A2D Relevance: 6.1, APIs: 4, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F2A54
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 007F2A69
LoadLibraryW.KERNELBASE(?,?,00000104,007C1C3B), ref: 007F2AB7
GetLastError.KERNEL32 ref: 007F2AC3

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem_memset
String ID:
API String ID: 1376650706-0
Opcode ID: 1226f819bbec400ad68f62a45a13171695453b87507326b83a0fa112f4bc500b
Instruction ID: a0b72d7615d0e4799dbe7ac05e0407cc48b988c8bfb7424a6052ce68aee32f1b
Opcode Fuzzy Hash: 1226f819bbec400ad68f62a45a13171695453b87507326b83a0fa112f4bc500b
Instruction Fuzzy Hash: 4011E9B660071DB7DB20DB659C49FAB77ADAF84710F208074EA18D7342EA3CD946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 007C1033 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 007C1057
InitializeCriticalSection.KERNEL32(?,?,0000011C), ref: 007C1060

Part of subcall function 007EFE13: OpenProcessToken.ADVAPI32(?,00000008,00000000,76EEC3F0,?,00000000), ref: 007EFE35
Part of subcall function 007EFE13: GetLastError.KERNEL32 ref: 007EFE3F
Part of subcall function 007EFE13: FindCloseChangeNotification.KERNELBASE(00000000), ref: 007EFECB

Part of subcall function 007EFDAD: _memset.LIBCMT ref: 007EFDD5

Strings

Failed to initialize engine section., xrefs: 007C10C9
Failed to verify elevation state., xrefs: 007C10B0

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CriticalInitializeSection$ChangeCloseErrorFindLastNotificationOpenProcessToken_memset
String ID: Failed to initialize engine section.$Failed to verify elevation state.
API String ID: 1157272915-3203524654
Opcode ID: b11bf9c6c2e50ab1f73378542509346a61075d7133927e61eb904a104ed4ff6e
Instruction ID: 2453845a1683903c6951e025830af084e75fc008434b15576ca3e8b40691c475
Opcode Fuzzy Hash: b11bf9c6c2e50ab1f73378542509346a61075d7133927e61eb904a104ed4ff6e
Instruction Fuzzy Hash: 351186B2641615EBD720A7B48C0AF9A73DC9F05350F10452DF515D7282DA7CA94187A5

Uniqueness

Uniqueness Score: -1.00%

Function 007F84E7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007F8123: lstrlenW.KERNEL32(?,?,?,007F8243,?,?,?,00000000,?,?,?,007DF535,?,?,?,00000000), ref: 007F8146

RegCloseKey.ADVAPI32(00000000,007C13BB,?,?,007C13BB,00000000,00000000,?,007C13BB,00000001,00000000), ref: 007F85CC
RegCloseKey.ADVAPI32(00000001,007C13BB,?,?,007C13BB,00000000,00000000,?,007C13BB,00000001,00000000), ref: 007F85E6

Part of subcall function 007F371B: RegCreateKeyExW.KERNELBASE(00000001,00000000,00000000,00000000,00000000,00000001,007C13BB,?,?,00000001,?,007C7275,?,007C13BB,00020006,00000001), ref: 007F373F

Part of subcall function 007F3B02: RegSetValueExW.KERNELBASE(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,007C698C,00000000,?,00020006), ref: 007F3B35

Part of subcall function 007F3B02: RegDeleteValueW.KERNELBASE(00020006,?,00000001,?,?,007C698C,00000000,?,00020006,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006,00000000), ref: 007F3B64

Part of subcall function 007F362A: RegSetValueExW.KERNELBASE(?,00020006,00000000,00000004,007C68E2,00000004,00000001,?,007C68E2,00020006,Resume,007C13BB,00000000,00000000,?,?), ref: 007F363F

Strings

%ls\%ls, xrefs: 007F8548

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls
API String ID: 3924016894-2125769799
Opcode ID: 199b9a5ee36e24adff1b9a6c9278ec64f29cebc5a5952beec7ef24fb985cedf8
Instruction ID: 8f47571e9387a1f198155f5b75cf217e11f15cb74b66603984442ff85243e637
Opcode Fuzzy Hash: 199b9a5ee36e24adff1b9a6c9278ec64f29cebc5a5952beec7ef24fb985cedf8
Instruction Fuzzy Hash: 3531E97190112DFBCF12AFD4CD858EEBB79FF08B00B144466F611A6221DB794B61DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007F526F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007F52A1

Part of subcall function 007F50CA: GetModuleHandleA.KERNEL32(kernel32.dll,?,00000000,?,?,007F52B2,00000000,?,00000000), ref: 007F50E8
Part of subcall function 007F50CA: GetLastError.KERNEL32(?,?,007F52B2,00000000,?,00000000,?,?,?,?,?,?,?,?,007E386B,007C2222), ref: 007F50F4

Strings

WixBundleElevated, xrefs: 007F5282
F!|, xrefs: 007F52F6

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID: F!|$WixBundleElevated
API String ID: 52713655-3480920195
Opcode ID: 186d24ed827b3d06b64f154460da9c43dab47641349162399d401e545394da13
Instruction ID: edd16945e1018490ae24f80df366933e44fb095736f1df8b13b1db5316a7880e
Opcode Fuzzy Hash: 186d24ed827b3d06b64f154460da9c43dab47641349162399d401e545394da13
Instruction Fuzzy Hash: F3312E76A006199FCB00DFA8D884AEEB7F9FF49320F154469EA05EB301DA75D9058B64

Uniqueness

Uniqueness Score: -1.00%

Function 007F4C0C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

#171.MSI(00000000,?,007FA5C8,?), ref: 007F4C66
#171.MSI(00000000,?,?,00000000,?,00000000,00000000,?,007FA5C8,?), ref: 007F4CA7

Part of subcall function 007F497B: #115.MSI(?), ref: 007F49A8
Part of subcall function 007F497B: #116.MSI(?,00000001,?), ref: 007F49C8

Strings

wiutil.cpp, xrefs: 007F4CC5

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: #171$#115#116
String ID: wiutil.cpp
API String ID: 2532461077-4248292292
Opcode ID: a361fd40ed10aaf282127583011b49b6cd56783024494554f81ade7d97c47dec
Instruction ID: 8132aaaae641e74fecf49674986826b772f6ff163b3a3f3304991680add17120
Opcode Fuzzy Hash: a361fd40ed10aaf282127583011b49b6cd56783024494554f81ade7d97c47dec
Instruction Fuzzy Hash: 622137B6A0120DFBDB109FA48C41ABF7BA9AF04350F149029FA14EA341D638DA10EB70

Uniqueness

Uniqueness Score: -1.00%

Function 007F3B02 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,007C698C,00000000,?,00020006), ref: 007F3B35
RegDeleteValueW.KERNELBASE(00020006,?,00000001,?,?,007C698C,00000000,?,00020006,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006,00000000), ref: 007F3B64

Strings

regutil.cpp, xrefs: 007F3B97

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Value$Delete
String ID: regutil.cpp
API String ID: 1738766685-955085611
Opcode ID: 2eaa0b5008ec665e2e25abb2a111e1ecb3b6a44417d64baca9e397635f91f7ea
Instruction ID: fe5bf1dc4ac2ced35d0e0b92d7bb9ecc38ad3534dc489bdcf4dac64026aa5f4f
Opcode Fuzzy Hash: 2eaa0b5008ec665e2e25abb2a111e1ecb3b6a44417d64baca9e397635f91f7ea
Instruction Fuzzy Hash: E111C2B2D5152EB7DF224A54CC1ABBE7A55AF00B70F104224FF20EA390D66DDF1096D0

Uniqueness

Uniqueness Score: -1.00%

Function 007EFA9A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,20000004,?,007D78A6,00000000,00000001,20000004,?,00000000,00000000,00000000), ref: 007EFACB
SetNamedSecurityInfoW.ADVAPI32(00000000,000007D0,00000003,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,20000004,?,007D78A6,00000000), ref: 007EFAE6

Strings

aclutil.cpp, xrefs: 007EFB0C

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: aclutil.cpp
API String ID: 2352087905-2159165307
Opcode ID: c8b080a4b7706997c9531a3b5977f0f603e25e94125c12bbb6ff8418fb3888c5
Instruction ID: 43c285db07035e0a4d440eddb09c95b784fb6150f49b8fc46595e93734c6491c
Opcode Fuzzy Hash: c8b080a4b7706997c9531a3b5977f0f603e25e94125c12bbb6ff8418fb3888c5
Instruction Fuzzy Hash: E701CE73901159FBDF128E91CC05FEE7A6AEF087A4F054130FA04BA220C27ADD20EB90

Uniqueness

Uniqueness Score: -1.00%

Function 007F371B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000001,00000000,00000000,00000000,00000000,00000001,007C13BB,?,?,00000001,?,007C7275,?,007C13BB,00020006,00000001), ref: 007F373F

Strings

ur|, xrefs: 007F3772
regutil.cpp, xrefs: 007F3766

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Create
String ID: regutil.cpp$ur|
API String ID: 2289755597-4207059108
Opcode ID: c547cf37488f41ecc769d4e64cbd613bda50bf2674c865a7655a7794435e0190
Instruction ID: 64b7483e22ef4bc38ff1171a8dde8193eff159bf1021190a172f7f626f9ffc1d
Opcode Fuzzy Hash: c547cf37488f41ecc769d4e64cbd613bda50bf2674c865a7655a7794435e0190
Instruction Fuzzy Hash: 7DF03CB660022EEBDB219E65DC45ABB7A98EF05760F014035BE15DA250D239DA20DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 007F5783 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,007F58B2,?,?,00000000), ref: 007F57A5
GetLastError.KERNEL32(?,?,007F58B2,?,?,00000000), ref: 007F57AF

Strings

fileutil.cpp, xrefs: 007F57D9

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: fileutil.cpp
API String ID: 442123175-2967768451
Opcode ID: bf890b750df644eb99d4f7d924a2d90df0968f79ad6854cf38708a0fb4bfdaf6
Instruction ID: 58610640319ed15f8dad68264b9afa427d92cd4ae99ad4b8308af198b83bd1b5
Opcode Fuzzy Hash: bf890b750df644eb99d4f7d924a2d90df0968f79ad6854cf38708a0fb4bfdaf6
Instruction Fuzzy Hash: B8F04472700619FBDB10AE5ADC09FAF7FADEB80B70F104025BB18E7241D678E90096B1

Uniqueness

Uniqueness Score: -1.00%

Function 007F5640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,007D7D44,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 007F5656
GetLastError.KERNEL32(?,007D7D44,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,007D95E8,00000000,?), ref: 007F5660

Strings

fileutil.cpp, xrefs: 007F5685

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: fileutil.cpp
API String ID: 2976181284-2967768451
Opcode ID: 4285422075bbfd11d64c0d27b392ceb7a53b5e16e1543c8d65a2847fe27b8e67
Instruction ID: 7ed87d1bf5f72a4114026299b9444a62d7069414e1794050f083fcfafb5ca457
Opcode Fuzzy Hash: 4285422075bbfd11d64c0d27b392ceb7a53b5e16e1543c8d65a2847fe27b8e67
Instruction Fuzzy Hash: E2F0317160061AABDB208F55DC08AA67F98EF04BA0B418024BF28DB361D639D910DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 007F36CB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,ni|,00000000,00000000,00000001,?,007C696E,?,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006), ref: 007F36E5

Strings

regutil.cpp, xrefs: 007F3709
ni|, xrefs: 007F36D3

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Create
String ID: ni|$regutil.cpp
API String ID: 2289755597-839305511
Opcode ID: 908d098d6a77681e242cb1a9a14e94b7ff25d62244bef9069614e3793c017da8
Instruction ID: 74e471dd6d65ef2834cf3f336015e66758772bcccd64b5b2d878a7b484940841
Opcode Fuzzy Hash: 908d098d6a77681e242cb1a9a14e94b7ff25d62244bef9069614e3793c017da8
Instruction Fuzzy Hash: 97F0E573900069B7C73029679D0DEA77E2DEFC6B70F014024FB18EA210D26E8820D2F0

Uniqueness

Uniqueness Score: -1.00%

Function 007F6C5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,007C1DEA,00000000,007C1DEA,?,?), ref: 007F6C81
CoCreateInstance.OLE32(00000000,00000000,00000001,008115F8,00000000), ref: 007F6C9A

Strings

Microsoft.Update.AutoUpdate, xrefs: 007F6C7C

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: eb9f316f2accf03b318bf2fb985d0cefb09184d8c1edb22030487b11017290f1
Instruction ID: 66250ceaa4a8208e3dd34fda5d14f3bd130652b093488901933a48d4e4a5992b
Opcode Fuzzy Hash: eb9f316f2accf03b318bf2fb985d0cefb09184d8c1edb22030487b11017290f1
Instruction Fuzzy Hash: 9FF01271600209BEDB00DBA9DD09AFBB7BDEB48744F500425A601E6250DA74AA04C662

Uniqueness

Uniqueness Score: -1.00%

Function 007D1256 Relevance: 4.5, APIs: 3, Instructions: 21synchronizationwindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 007D1264
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007D127A
WaitForSingleObject.KERNEL32(?,00003A98,?,007C1A88,?,00000000,?,?,?,?,?,00000001,?,?,?,?), ref: 007D128B

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: MessageObjectPostSingleWaitWindow
String ID:
API String ID: 1391784381-0
Opcode ID: c49bb0c935eeaee5349df5944f5377cb1ea69e3224686438880f4f543fdf9c45
Instruction ID: 575707449c391fa51836a671fdb864b3629f268c0ccb62bab6b6897220d7148e
Opcode Fuzzy Hash: c49bb0c935eeaee5349df5944f5377cb1ea69e3224686438880f4f543fdf9c45
Instruction Fuzzy Hash: CCE08671340305B7D6161B55EC0AF95FB2DFF45BA1F004026F20CB40A0C7B57520D799

Uniqueness

Uniqueness Score: -1.00%

Function 007F24F6 Relevance: 4.5, APIs: 3, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,007C314C,?,?,?,?,00000000), ref: 007F24FE
RtlFreeHeap.NTDLL(00000000,?,007C314C,?,?,?,?,00000000), ref: 007F2505
GetLastError.KERNEL32(?,007C314C,?,?,?,?,00000000), ref: 007F2513

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: cad6ea4d48b5facfb323b363a9cea06e9e894850c6c99f2ba7050e3634b7ddb9
Instruction ID: a642c8c77d604076442a2d67ceac53499fac44736743d2e2225f5ede28a95c54
Opcode Fuzzy Hash: cad6ea4d48b5facfb323b363a9cea06e9e894850c6c99f2ba7050e3634b7ddb9
Instruction Fuzzy Hash: CDD05BB174410B77D7111BB5DC1973A3B9CBF45751F108430B609C51D1D62EC021D66A

Uniqueness

Uniqueness Score: -1.00%

Function 007F378B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,00000000,007D1F19,?,00000009,00000000,?,007D1BE1,80000002,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001), ref: 007F379F

Strings

regutil.cpp, xrefs: 007F37E0

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Open
String ID: regutil.cpp
API String ID: 71445658-955085611
Opcode ID: 2ef42132f1c97cdfe721e834ea894ba5a0c0b50f6f40f8da479af7b63d6147a9
Instruction ID: a0f0861b03d14b9434c7272539eb0ab3e13eae92dd4950288686bd1c7b42f4b0
Opcode Fuzzy Hash: 2ef42132f1c97cdfe721e834ea894ba5a0c0b50f6f40f8da479af7b63d6147a9
Instruction Fuzzy Hash: 41F0E9F130021EAFEB102D649CD5A76368DAF18770F148138F705CA352D56ECD505371

Uniqueness

Uniqueness Score: -1.00%

Function 007F362A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00020006,00000000,00000004,007C68E2,00000004,00000001,?,007C68E2,00020006,Resume,007C13BB,00000000,00000000,?,?), ref: 007F363F

Strings

regutil.cpp, xrefs: 007F3666

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Value
String ID: regutil.cpp
API String ID: 3702945584-955085611
Opcode ID: 52a8cded4da76332d133b00fc41b81cd6710dcb5d0d2fea04033f232d625d973
Instruction ID: 3475e653cf8778f77e089a3340a178eee2b004479da22e9e3ee18a70fae6d86e
Opcode Fuzzy Hash: 52a8cded4da76332d133b00fc41b81cd6710dcb5d0d2fea04033f232d625d973
Instruction Fuzzy Hash: A0E09232A4062EB7D72059958C0EFB77E4CEF00BB0F018131BB14EB390D569CA10C2E0

Uniqueness

Uniqueness Score: -1.00%

Function 007F5B65 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(%v},00000000,00000000,?,007D7625,?,00000000,00000001,00000001,00000003,000007D0,?,?,00000000), ref: 007F5B80

Strings

%v}, xrefs: 007F5B7D

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Sleep
String ID: %v}
API String ID: 3472027048-2518060776
Opcode ID: b564cb3c812959920651cb044d4d12b23526261bff10f6318b7ed84dd06edeb8
Instruction ID: b97417906090fd4abe371e62d04d6df544e1d7fac4e4b5172e7bee694e686fa4
Opcode Fuzzy Hash: b564cb3c812959920651cb044d4d12b23526261bff10f6318b7ed84dd06edeb8
Instruction Fuzzy Hash: CDF082B214151EF7CF225E4DDC04ABE7B95AB44370B268215FF09D5230C26EC8A19BD9

Uniqueness

Uniqueness Score: -1.00%

Function 007F233B Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,00000000,?,007C3087,?,00000000,?,?,?,00000000), ref: 007F234C
RtlAllocateHeap.NTDLL(00000000,?,007C3087,?,00000000,?,?,?,00000000), ref: 007F2353

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 23d4bb352fd71beebe0373ae52bde3970f5c76c002d0629a13a2acb06d43601d
Instruction ID: 183e7d7807bd10d6ec623b34714c904fce581d8eff6bc048c5bf1ff185989aaa
Opcode Fuzzy Hash: 23d4bb352fd71beebe0373ae52bde3970f5c76c002d0629a13a2acb06d43601d
Instruction Fuzzy Hash: 74C002726A4209B78B005FF8DC09C99779CF754612700C511B919C6151D63DE554D765

Uniqueness

Uniqueness Score: -1.00%

Function 007E8A7B Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 007E8A83

Part of subcall function 007E8A50: GetModuleHandleW.KERNEL32(mscoree.dll,?,007E8A88,00000000,?,007EB4FF,000000FF,0000001E,00000001,00000000,00000000,?,007EBF87,00000000,00000001,00000000), ref: 007E8A5A
Part of subcall function 007E8A50: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007E8A6A

ExitProcess.KERNEL32 ref: 007E8A8C

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: ecd927f371db3fd45fb7b69d8033e2850752f46eeb651956e22e28ffecc23ab8
Instruction ID: 8548fbeecbcad0bce23e88d53bfa23421a4b971c59159eeab9fd9270533ee970
Opcode Fuzzy Hash: ecd927f371db3fd45fb7b69d8033e2850752f46eeb651956e22e28ffecc23ab8
Instruction Fuzzy Hash: CEB09231000148BBCB012F12DC0E8593FAAEF853A0B508021F80D09031DF76AD92DA8A

Uniqueness

Uniqueness Score: -1.00%

Function 007F4887 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F493E

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 3fd63d142d84ce445c5aa8793141d91054466c07d75ffd2ed0f1a5a90da23b79
Instruction ID: 9f35f6de5013ef3dda08a8021e87b486ae56a683411cf30c39c7ae863eb37ef6
Opcode Fuzzy Hash: 3fd63d142d84ce445c5aa8793141d91054466c07d75ffd2ed0f1a5a90da23b79
Instruction Fuzzy Hash: CB21B67120010CAFDB28CE28C895B7B7765EB84760F148229F7168A7E2D77CDE80C790

Uniqueness

Uniqueness Score: -1.00%

Function 007F841F Relevance: 1.6, APIs: 1, Instructions: 73registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007F8123: lstrlenW.KERNEL32(?,?,?,007F8243,?,?,?,00000000,?,?,?,007DF535,?,?,?,00000000), ref: 007F8146

RegCloseKey.KERNELBASE(00000000,?,8000FFFF,?,?,?,8000FFFF,00000000,?,?,?,00000000,000000B9,007E37C3,?,?), ref: 007F84C9

Part of subcall function 007F371B: RegCreateKeyExW.KERNELBASE(00000001,00000000,00000000,00000000,00000000,00000001,007C13BB,?,?,00000001,?,007C7275,?,007C13BB,00020006,00000001), ref: 007F373F

Part of subcall function 007F3B02: RegSetValueExW.KERNELBASE(00020006,?,00000000,00000001,?,00000000,?,000000FF,00000000,00000001,?,?,007C698C,00000000,?,00020006), ref: 007F3B35

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: e8673a8ca341e5561cea91a44be231d83b41af255eb24d8fc8984b8d95f4a33a
Instruction ID: 89ef6cc77024a5f572ef42693743bf8fd6e9578676de900a63b55fd9c60ef0df
Opcode Fuzzy Hash: e8673a8ca341e5561cea91a44be231d83b41af255eb24d8fc8984b8d95f4a33a
Instruction Fuzzy Hash: F6213E72C0002DFBCF22AF94DC458EEFE79EF44740B118161FA15A6220DB354E61EB91

Uniqueness

Uniqueness Score: -1.00%

Function 007F1FE9 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,007D745F,-0000001C,00000000,00000000,?,?,007D8DEB), ref: 007F200A

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 34e95bee1474db373194c9d1e5fbeb0317bc347e2c1739c9878571da1909ef17
Instruction ID: 3e87662ec54e775227b499726974c90b46dfa285e4f663f1c0d569f7eb14f8b5
Opcode Fuzzy Hash: 34e95bee1474db373194c9d1e5fbeb0317bc347e2c1739c9878571da1909ef17
Instruction Fuzzy Hash: A1E0C232340228B7E7102E915C02F9A3B4CAF08772F004012FF44AD282DAA8E000E7A9

Uniqueness

Uniqueness Score: -1.00%

Function 007E60F1 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?), ref: 007E612C

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c89a8fb29e64ce14faa717d04ee3f4ea6b102f8fe6f35a76a7740475dc542ebc
Instruction ID: f90829c4cf5156b7b44cafbc76a8e4929b50b9b3eeab92056285ce391136194a
Opcode Fuzzy Hash: c89a8fb29e64ce14faa717d04ee3f4ea6b102f8fe6f35a76a7740475dc542ebc
Instruction Fuzzy Hash: 64F06D31110648DFCB118F69C848B647BE4BF18779F09C260E9198A2F2C739D811CF10

Uniqueness

Uniqueness Score: -1.00%

Function 007E8CD3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 007E8CDF

Part of subcall function 007E8B93: __lock.LIBCMT ref: 007E8BA1
Part of subcall function 007E8B93: DecodePointer.KERNEL32(00811EE0,00000020,007E8CFA,00000000,00000001,00000000,?,007E8D3A,000000FF,?,007EB7D2,00000011,00000000,?,007E976F,0000000D), ref: 007E8BDD
Part of subcall function 007E8B93: DecodePointer.KERNEL32(?,007E8D3A,000000FF,?,007EB7D2,00000011,00000000,?,007E976F,0000000D,?,007F8A9C,?), ref: 007E8BEE
Part of subcall function 007E8B93: DecodePointer.KERNEL32(-00000004,?,007E8D3A,000000FF,?,007EB7D2,00000011,00000000,?,007E976F,0000000D,?,007F8A9C,?), ref: 007E8C14
Part of subcall function 007E8B93: DecodePointer.KERNEL32(?,007E8D3A,000000FF,?,007EB7D2,00000011,00000000,?,007E976F,0000000D,?,007F8A9C,?), ref: 007E8C27
Part of subcall function 007E8B93: DecodePointer.KERNEL32(?,007E8D3A,000000FF,?,007EB7D2,00000011,00000000,?,007E976F,0000000D,?,007F8A9C,?), ref: 007E8C31

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: 4375161cffd5d6c0d0b3ded8798da31ab2a9ccbde9a3bac97dd694c469e8c680
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: 69B092B258024873DA20254AAC07F063A0987C4B60E240021BA0C1D1A1A9A2A961808A

Uniqueness

Uniqueness Score: -1.00%

Function 007F146F Relevance: 1.3, APIs: 1, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007F2382: GetProcessHeap.KERNEL32(00000000,?,?,007F08DD,?,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000,00000000), ref: 007F238A
Part of subcall function 007F2382: HeapSize.KERNEL32(00000000,?,007F08DD,?,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000,00000000,?), ref: 007F2391

lstrlenW.KERNEL32(00000000,?,00000000,00000000,?,?,?,?,007EF6E8,?,?,?,?,00000340,00000000,00000000), ref: 007F149E

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 45d10e4ec51b0033862f6203bd3dd50de3887c7285bdd41b24b2db3e4ce346c5
Instruction ID: e792e211b55713156ea43f0dabda64bdfac01f81e94313395009053d2bbcc54e
Opcode Fuzzy Hash: 45d10e4ec51b0033862f6203bd3dd50de3887c7285bdd41b24b2db3e4ce346c5
Instruction Fuzzy Hash: 7711B17260020DEBDB219BA8C844BBE77B9EF84371F618528E241A7391DA7D8E519750

Uniqueness

Uniqueness Score: -1.00%

Function 007C131F Relevance: 1.3, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?), ref: 007C1350

Part of subcall function 007F28FD: lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,007C1371,?,?,?), ref: 007F2906
Part of subcall function 007F28FD: _memcpy_s.LIBCMT ref: 007F293A

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Value_memcpy_slstrlen
String ID:
API String ID: 32415546-0
Opcode ID: 844a3c26965d67cdb4f0408b6ccf0e9a233fc34262fef1a4c6c479e26cb6bf9d
Instruction ID: 5475ffe23abdc600171cbcf7289799579b780cffafc8f4888f58f934fb5b272b
Opcode Fuzzy Hash: 844a3c26965d67cdb4f0408b6ccf0e9a233fc34262fef1a4c6c479e26cb6bf9d
Instruction Fuzzy Hash: 2B11A376D00258FFCB11AFA8DC44DDEFBBCAB85314F10857AE910A3222D2354E40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 007F1171 Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,007F2746,?,007FA5C8,00000000,?,00000000,00000004,00000000,00000004,?,00000000), ref: 007F11A2

Part of subcall function 007F2382: GetProcessHeap.KERNEL32(00000000,?,?,007F08DD,?,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000,00000000), ref: 007F238A
Part of subcall function 007F2382: HeapSize.KERNEL32(00000000,?,007F08DD,?,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000,00000000,?), ref: 007F2391

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 59b38dd2ffee17b635e35f0ebbf17a5752533fc6b662215629765034820abdb7
Instruction ID: f26a3560fd7d89ce4cd62af97bf53f770f55396579edf23e95fe32b8fb7538e0
Opcode Fuzzy Hash: 59b38dd2ffee17b635e35f0ebbf17a5752533fc6b662215629765034820abdb7
Instruction Fuzzy Hash: 4601843230020CFBEB105EA5DC84FBA3B5EAF85760F508115FB149B381C679E9008AA0

Uniqueness

Uniqueness Score: -1.00%

Function 007F5A1F Relevance: 1.3, APIs: 1, Instructions: 29sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,007D7736,00000000,?,00000001,00000003,000007D0,?,?,007D9676,00000000,00000000,00000000,00000000), ref: 007F5A36

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 23c212d5c1d424f263c1074d80ec0ed8b4582d04365e495236e036c323455445
Instruction ID: c15bc9e7977f5146de8bf09962313f6f1e3a0cad08bbf037808baad794bc144b
Opcode Fuzzy Hash: 23c212d5c1d424f263c1074d80ec0ed8b4582d04365e495236e036c323455445
Instruction Fuzzy Hash: A3E03732040D1DD7CB216A44DC856BE7E54AB04760B19C315EF08D5232D22EDDB096D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 007E6994 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 148filenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 007F5640: SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,?,007D7D44,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 007F5656
Part of subcall function 007F5640: GetLastError.KERNEL32(?,007D7D44,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,007D95E8,00000000,?), ref: 007F5660

InternetReadFile.WININET(?,00000000,?,?), ref: 007E69D6
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 007E6A05

Strings

downloadengine.cpp, xrefs: 007E6AD8, 007E6B16
Failed while reading from internet., xrefs: 007E6AE2
Failed to seek to start point in file., xrefs: 007E69B6, 007E6A42
UX aborted on cache progress., xrefs: 007E6B27
Failed to write data from internet., xrefs: 007E6B20

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: File$ErrorInternetLastPointerReadWrite
String ID: Failed to seek to start point in file.$Failed to write data from internet.$Failed while reading from internet.$UX aborted on cache progress.$downloadengine.cpp
API String ID: 1734627056-3175886020
Opcode ID: 230cfe83064be626d1085cc7e9342f5d0982759a8ebd829da2db03c324231122
Instruction ID: fb114c2e3c98fc559edfd1b93563fb61e2b7a9fceefcbb1173ba821f401d32b7
Opcode Fuzzy Hash: 230cfe83064be626d1085cc7e9342f5d0982759a8ebd829da2db03c324231122
Instruction Fuzzy Hash: C54170B2A01289FFDF109F95CC899AE7BBAFF18344F20C839F521E6191D77999509B10

Uniqueness

Uniqueness Score: -1.00%

Function 007D8101 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptHashPublicKeyInfo.CRYPT32(00000000,00008004,00000000,00000001,?,?,00000014), ref: 007D8170
GetLastError.KERNEL32 ref: 007D820C

Strings

cache.cpp, xrefs: 007D8231
Failed to get certificate public key identifier., xrefs: 007D823B
Failed to read certificate thumbprint., xrefs: 007D8242
Failed to find expected public key in certificate chain., xrefs: 007D8254

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CryptErrorHashInfoLastPublic
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp
API String ID: 823482589-3408201827
Opcode ID: 9c0e0a1a41bab987454e60326f009eb965db8c073362038ef950c81b5e457baf
Instruction ID: 4b6b229125559555d7516babde45d89528337d2c4a06fbfb1cc413811228e195
Opcode Fuzzy Hash: 9c0e0a1a41bab987454e60326f009eb965db8c073362038ef950c81b5e457baf
Instruction Fuzzy Hash: FA418F71A00219DFCB50CF68C845AAEB7B4FF48720F15415AE910FB391DB79E905CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 007CA0C3 Relevance: 58.1, APIs: 5, Strings: 28, Instructions: 307COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,80070490,?,?,?,?,?,?,?,?,007E3A1D,?,?,?), ref: 007CA0F2
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,007E3A1D,?,?,?,?,?,Chain), ref: 007CA408

Strings

Failed to get variable node count., xrefs: 007CA12C
version, xrefs: 007CA270
Failed to get @Value., xrefs: 007CA3BC
Initializing version variable '%ls' to value '%ls', xrefs: 007CA292
numeric, xrefs: 007CA20D
Failed to get @Type., xrefs: 007CA3CA
Failed to get next node., xrefs: 007CA3A0
Invalid value for @Type: %ls, xrefs: 007CA37A
Value, xrefs: 007CA1B4
Failed to find variable value '%ls'., xrefs: 007CA3E3
Initializing string variable '%ls' to value '%ls', xrefs: 007CA25D
Initializing numeric variable '%ls' to value '%ls', xrefs: 007CA22B
Failed to get @Hidden., xrefs: 007CA3AE
Failed to get @Persisted., xrefs: 007CA3B5
variable.cpp, xrefs: 007CA38C
Failed to select variable nodes., xrefs: 007CA10F
Failed to get @Id., xrefs: 007CA3A7
string, xrefs: 007CA23F
Failed to insert variable '%ls'., xrefs: 007CA3ED
Failed to change variant type., xrefs: 007CA3D1
Variable, xrefs: 007CA0FC
Hidden, xrefs: 007CA17E
Type, xrefs: 007CA1F2
Initializing hidden variable '%ls', xrefs: 007CA2AF
Persisted, xrefs: 007CA199
Failed to set variant value., xrefs: 007CA3C3
Failed to set value of variable: %ls, xrefs: 007CA3F7
Attempt to set built-in variable value: %ls, xrefs: 007CA399

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
API String ID: 3168844106-1657652604
Opcode ID: 7581ed445409e49ab35473ebc7dcf95de90dc6c47e979d2aabfe565f4b2ef45d
Instruction ID: 216eee49d1a160bce7e80ee31a45de2e88f4306982de386e943ebe5165d700fa
Opcode Fuzzy Hash: 7581ed445409e49ab35473ebc7dcf95de90dc6c47e979d2aabfe565f4b2ef45d
Instruction Fuzzy Hash: 52A1ABB2D0026DFBCB10AE94CC89DBEBB79BF08315B10416DFA11B7251D7798E419B92

Uniqueness

Uniqueness Score: -1.00%

Function 007C799F Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 313registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 007C79DC
_MREFOpen@16.MSPDB140-MSVCRT ref: 007C7A02
RegCloseKey.ADVAPI32(007C8B40,?,00000000,?,00000000,?,?,?,?,00000000), ref: 007C7D07

Strings

Unsupported registry key value type. Type = '%u', xrefs: 007C7B93
Failed to open registry key., xrefs: 007C7A72
Failed to change value type., xrefs: 007C7CA1
Registry key not found. Key = '%ls'; variable = '%ls', xrefs: 007C7A37
Failed to query registry key value., xrefs: 007C7B6B
Failed to allocate memory registry value., xrefs: 007C7B1B
Failed to format value string., xrefs: 007C7A0D
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 007C7CD4
Failed to clear variable., xrefs: 007C7A5D
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 007C7AA3
Failed to format key string., xrefs: 007C79E7
Failed to allocate string buffer., xrefs: 007C7BF8
Failed to query registry key value size., xrefs: 007C7AE7
Failed to get expand environment string., xrefs: 007C7C6D
Failed to read registry value., xrefs: 007C7C88
Failed to set variable., xrefs: 007C7CBF
search.cpp, xrefs: 007C7ADD, 007C7B11, 007C7B61, 007C7C63

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'; variable = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
API String ID: 2348241696-822975546
Opcode ID: 5ca192c4047d0b5aea4277bd677af28b00c661185fa7e6ae3eef105f798a502a
Instruction ID: 59e0c0eb544c173e9e6ed483e66048778e2cda18f8269122d4350bc51e55f6e7
Opcode Fuzzy Hash: 5ca192c4047d0b5aea4277bd677af28b00c661185fa7e6ae3eef105f798a502a
Instruction Fuzzy Hash: 93A1C472D4411AFBDF269A94CC05FBE7B79AF04710F10816DFA10B6251DA7D9E00DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007E999B Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,007E7D3B), ref: 007E99A3
__mtterm.LIBCMT ref: 007E99AF

Part of subcall function 007E96E8: DecodePointer.KERNEL32(00000005,007E9B11,?,007E7D3B), ref: 007E96F9
Part of subcall function 007E96E8: TlsFree.KERNEL32(00000011,007E9B11,?,007E7D3B), ref: 007E9713
Part of subcall function 007E96E8: DeleteCriticalSection.KERNEL32(00000000,00000000,76EF5810,?,007E9B11,?,007E7D3B), ref: 007EB698
Part of subcall function 007E96E8: _free.LIBCMT ref: 007EB69B
Part of subcall function 007E96E8: DeleteCriticalSection.KERNEL32(00000011,76EF5810,?,007E9B11,?,007E7D3B), ref: 007EB6C2

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 007E99C5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 007E99D2
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 007E99DF
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 007E99EC
TlsAlloc.KERNEL32(?,007E7D3B), ref: 007E9A3C
TlsSetValue.KERNEL32(00000000,?,007E7D3B), ref: 007E9A57
__init_pointers.LIBCMT ref: 007E9A61
EncodePointer.KERNEL32(?,007E7D3B), ref: 007E9A72
EncodePointer.KERNEL32(?,007E7D3B), ref: 007E9A7F
EncodePointer.KERNEL32(?,007E7D3B), ref: 007E9A8C
EncodePointer.KERNEL32(?,007E7D3B), ref: 007E9A99
DecodePointer.KERNEL32(007E986C,?,007E7D3B), ref: 007E9ABA
__calloc_crt.LIBCMT ref: 007E9ACF
DecodePointer.KERNEL32(00000000,?,007E7D3B), ref: 007E9AE9
GetCurrentThreadId.KERNEL32 ref: 007E9AFB

Strings

FlsSetValue, xrefs: 007E99D4
FlsGetValue, xrefs: 007E99C7
FlsFree, xrefs: 007E99E1
FlsAlloc, xrefs: 007E99BF
KERNEL32.DLL, xrefs: 007E999E

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 6226b8057a38e712d3b86d1d6c1ecb029afe6aec6feab90e6fd254d6c7262433
Instruction ID: 36eb28daa44cb4cfd6a112f020f0af47100a6016d11916dad6fd346c2ab00f82
Opcode Fuzzy Hash: 6226b8057a38e712d3b86d1d6c1ecb029afe6aec6feab90e6fd254d6c7262433
Instruction Fuzzy Hash: 223123B1911650EAD7206B7AFC0969B3FE8FF88320714863AE914D23B1D7798441CF55

Uniqueness

Uniqueness Score: -1.00%

Function 007E401F Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 337COMMON

Download Yara Rule

Strings

Failed to copy display name for pseudo bundle., xrefs: 007E43F1
pseudobundle.cpp, xrefs: 007E4064, 007E4097, 007E418D, 007E4380
Failed to copy repair arguments for related bundle package, xrefs: 007E42B0
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 007E40A1
Failed to copy uninstall arguments for related bundle package, xrefs: 007E4302
Failed to copy key for pseudo bundle., xrefs: 007E4229
Failed to allocate memory for dependency providers., xrefs: 007E438A
Failed to copy install arguments for related bundle package, xrefs: 007E4268
-%ls, xrefs: 007E4037
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 007E4323
Failed to copy version for pseudo bundle., xrefs: 007E43D0
Failed to copy filename for pseudo bundle., xrefs: 007E4106
Failed to copy cache id for pseudo bundle., xrefs: 007E4247
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 007E406E
Failed to allocate memory for pseudo bundle payload hash., xrefs: 007E4197
Failed to copy download source for pseudo bundle., xrefs: 007E4157
Failed to copy local source path for pseudo bundle., xrefs: 007E4129
Failed to append relation type to install arguments for related bundle package, xrefs: 007E4289
Failed to copy key for pseudo bundle payload., xrefs: 007E40E3
Failed to append relation type to repair arguments for related bundle package, xrefs: 007E42D1

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
API String ID: 1357844191-2832335422
Opcode ID: dbf596d4fdc73fdb499ac1435c1df16b7d3773a5e522b2346f0aa7d7909ad7b2
Instruction ID: 47b93deca3c8ff7b5970d9440fd44acc26a8979af119260e1220d0f6ab543b30
Opcode Fuzzy Hash: dbf596d4fdc73fdb499ac1435c1df16b7d3773a5e522b2346f0aa7d7909ad7b2
Instruction Fuzzy Hash: 20C1BD31241789EBDB21DF2ACC46F6A76E5FF88710F204419FA19AB391DB78E8419B10

Uniqueness

Uniqueness Score: -1.00%

Function 007E527D Relevance: 35.2, APIs: 8, Strings: 12, Instructions: 189COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,{8~,00000000), ref: 007E5289
_memset.LIBCMT ref: 007E52A4
CloseHandle.KERNEL32(007DA697,00000000,007E51E1,007E54D4,?,?,?,?,00000000,?,?,00000001,?), ref: 007E5449
CloseHandle.KERNEL32(?,00000000,007E51E1,007E54D4,?,?,?,?,00000000,?,?,00000001,?), ref: 007E5456
CloseHandle.KERNEL32(?,00000000,007E51E1,007E54D4,?,?,?,?,00000000,?,?,00000001,?), ref: 007E5470

Part of subcall function 007C35A5: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 007C35D2
Part of subcall function 007C35A5: GetLastError.KERNEL32(00000000,007C17A1,007CBD3C,007C130D,?), ref: 007C35DB
Part of subcall function 007C35A5: LocalFree.KERNEL32(?,007C130D), ref: 007C373E

Strings

Failed to wait for embedded process to connect to pipe., xrefs: 007E53DC
Failed to create embedded process atpath: %ls, xrefs: 007E53B1
Failed to create embedded pipe., xrefs: 007E5322
burn.embedded.async, xrefs: 007E52E2, 007E5338
{8~, xrefs: 007E5287
Failed to process messages from embedded message., xrefs: 007E53FE
%ls -%ls %ls %ls %u, xrefs: 007E533C
burn.embedded, xrefs: 007E52EC
embedded.cpp, xrefs: 007E53A4
Failed to wait for embedded executable: %ls, xrefs: 007E542D
Failed to allocate embedded command., xrefs: 007E5350
Failed to create embedded pipe name and client token., xrefs: 007E5304

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseHandle$DescriptorSecurity$ConvertCurrentErrorFreeLastLocalProcessString_memset
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process atpath: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$burn.embedded.async$embedded.cpp${8~
API String ID: 1195026954-4054170018
Opcode ID: 06718036d178cc5f5a3505e6a9a76e85a2d9f424c7e96288f4ed0bfb09ec50e3
Instruction ID: bac53163e28eb5fa8703a9561c5e567cae4c212ba339c3f79380dcef8e7756c1
Opcode Fuzzy Hash: 06718036d178cc5f5a3505e6a9a76e85a2d9f424c7e96288f4ed0bfb09ec50e3
Instruction Fuzzy Hash: E251AC72A0165CFBCF11ABE5DC859EEBBB8BF0C714F104026F604F2291D6785A85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007D61CC Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 155windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 007D60BD: LoadBitmapW.USER32(?,00000001), ref: 007D60ED
Part of subcall function 007D60BD: GetLastError.KERNEL32(?,00000001), ref: 007D60F9

LoadCursorW.USER32(00000000,00007F00), ref: 007D622C
RegisterClassW.USER32(?), ref: 007D6240
GetLastError.KERNEL32 ref: 007D624B
CreateWindowExW.USER32(00000080,00806504,?,90000000,?,?,?,?,00000000,00000000,?,?), ref: 007D62AF
GetLastError.KERNEL32 ref: 007D62BB
SetEvent.KERNEL32(?), ref: 007D6307
IsDialogMessageW.USER32(00000000,?), ref: 007D6322
TranslateMessage.USER32(?), ref: 007D6330
DispatchMessageW.USER32(?), ref: 007D633A
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007D6349
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 007D6371
DeleteObject.GDI32(?), ref: 007D6381

Strings

Failed to create window., xrefs: 007D62EF
Unexpected return value from message pump., xrefs: 007D6356
Failed to load splash screen., xrefs: 007D6207
Failed to register window., xrefs: 007D627F
splashscreen.cpp, xrefs: 007D6275, 007D62E5
WixBurnSplashScreen, xrefs: 007D6239, 007D636C

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Message$ErrorLast$ClassLoad$BitmapCreateCursorDeleteDialogDispatchEventObjectRegisterTranslateUnregisterWindow
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
API String ID: 1682452648-2188509422
Opcode ID: 0cb65df4c06d755299bfdd762c001ba902384c1f6e10ac82eec74c6222e8fe17
Instruction ID: a163cdf0791aa83daa6c2611a7f3832f2e97700293368040878d40f1982f4a53
Opcode Fuzzy Hash: 0cb65df4c06d755299bfdd762c001ba902384c1f6e10ac82eec74c6222e8fe17
Instruction Fuzzy Hash: CE51A4B2900219FFDB119FE0DC499AEBFB9FF04750F108526F518EA290D778A950CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007C8011 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 208COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 007C8086
_MREFOpen@16.MSPDB140-MSVCRT ref: 007C81AC

Strings

Failed to get product info., xrefs: 007C8198
Failed to format product code string., xrefs: 007C81BB
Failed to change value type., xrefs: 007C8201
Language, xrefs: 007C805D
Failed to format upgrade code string., xrefs: 007C8091
Unsupported product search type: %u, xrefs: 007C8044
No products found for UpgradeCode: %ls, xrefs: 007C80CE
VersionString, xrefs: 007C8066
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 007C8139
Failed to find product for UpgradeCode: %ls, xrefs: 007C80B8
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 007C822F
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 007C810B
State, xrefs: 007C8054
Failed to set variable., xrefs: 007C821F
Product not found: %ls, xrefs: 007C8164

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Open@16
String ID: Failed to change value type.$Failed to find product for UpgradeCode: %ls$Failed to format product code string.$Failed to format upgrade code string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$No products found for UpgradeCode: %ls$Product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2367264253
Opcode ID: e27ddf30422c7a55e48a51b9d03031e62021c18bdcd974f1e7150a508176e1a0
Instruction ID: a6839b705016cf5aab18d66efe5b03e201810f5040a998906df668f822a197f9
Opcode Fuzzy Hash: e27ddf30422c7a55e48a51b9d03031e62021c18bdcd974f1e7150a508176e1a0
Instruction Fuzzy Hash: 7461A1B1D4052CFBDF519A94CC0AFBEBBB5BB14310F18406DEA007A261DB7D8E449B92

Uniqueness

Uniqueness Score: -1.00%

Function 007C18B9 Relevance: 28.2, APIs: 4, Strings: 12, Instructions: 185windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 007C1AC3
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007C1AD6
CloseHandle.KERNEL32(00000000,?,?,?,007C1E12,?), ref: 007C1AE5

Strings

Failed to create pipes to connect to elevated parent process., xrefs: 007C1935
Failed to create the message window., xrefs: 007C19E3
WixBundleLayoutDirectory, xrefs: 007C1A40
Failed to open log., xrefs: 007C18ED
Failed to set layout directory variable to value provided from command-line., xrefs: 007C1A51
Failed while running , xrefs: 007C1A75
Failed to set action variables., xrefs: 007C1A0F
Failed to initialize internal cache functionality., xrefs: 007C190A
Failed to check global conditions, xrefs: 007C1997
Failed to query registration., xrefs: 007C19F9
Failed to set registration variables., xrefs: 007C1A29
Failed to connect to elevated parent process., xrefs: 007C194B

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseHandleMessagePostWindow
String ID: Failed to check global conditions$Failed to connect to elevated parent process.$Failed to create pipes to connect to elevated parent process.$Failed to create the message window.$Failed to initialize internal cache functionality.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3586352542-3026528549
Opcode ID: 9d82be82383b6dcd39469ef39bcf73589e6c369cee9a19d263697b40d294f80f
Instruction ID: e7d14beae410cc245defeb2d2496b2b0af8690723a09bce65f94aad91729c6ad
Opcode Fuzzy Hash: 9d82be82383b6dcd39469ef39bcf73589e6c369cee9a19d263697b40d294f80f
Instruction Fuzzy Hash: 1751C2B1141B05FADB22DA60CC49FBA33B9AB42350FA0843DF55AD2242EB7CFA45D751

Uniqueness

Uniqueness Score: -1.00%

Function 007DE857 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 144serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000,00000002,?,?,?,?,?,?,?,?,?,007DEC56,?), ref: 007DE888
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,007DEC56,?,?), ref: 007DE895
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,?,007DEC56,?,?), ref: 007DE8D6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,007DEC56,?,?), ref: 007DE8E3
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,007DEC56,?,?), ref: 007DE921
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,007DEC56,?,?), ref: 007DE92B

Part of subcall function 007DE774: ChangeServiceConfigW.ADVAPI32(?,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,?,007DE9AA,?), ref: 007DE78E
Part of subcall function 007DE774: GetLastError.KERNEL32(?,007DE9AA,?,00000003,?,?), ref: 007DE798

CloseServiceHandle.ADVAPI32(00000000), ref: 007DE9EA
CloseServiceHandle.ADVAPI32(00000000), ref: 007DE9F5

Strings

Failed to mark WU service to start on demand., xrefs: 007DE9B0
msuengine.cpp, xrefs: 007DE8BA, 007DE908, 007DE950
wuauserv, xrefs: 007DE8D0
V}, xrefs: 007DE867
Failed to open WU service., xrefs: 007DE912
Failed to open service control manager., xrefs: 007DE8C4
Failed to query status of WU service., xrefs: 007DE95A
Failed to read configuration for WU service., xrefs: 007DE990

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ChangeConfigManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$V}$msuengine.cpp$wuauserv
API String ID: 2017831661-2974990977
Opcode ID: a4e80fa1b5cac521200c05546d41ef4a0009ecb5654206f8b7900517d7b908ff
Instruction ID: 317dad74d0164fdd336fb47ea4d641648b13da43f2315f043a450b23419c0de0
Opcode Fuzzy Hash: a4e80fa1b5cac521200c05546d41ef4a0009ecb5654206f8b7900517d7b908ff
Instruction Fuzzy Hash: B141B532E02219EBDB52AB64CC19BAE7BB4AF14720F144126E414FE390DA7DDC00CB96

Uniqueness

Uniqueness Score: -1.00%

Function 007D0A5C Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 236COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007D0A78

Strings

Failed to read ordered patch order number., xrefs: 007D0C34
Failed to read UI level., xrefs: 007D0B3A
Failed to read rollback flag., xrefs: 007D0C6A
Failed to allocate memory for ordered patches., xrefs: 007D0BAE
Failed to read ordered patch package id., xrefs: 007D0C3B
Failed to read package log., xrefs: 007D0B06
Failed to read action., xrefs: 007D0A9F
Failed to execute MSP package., xrefs: 007D0C95
Failed to read parent hwnd., xrefs: 007D0AE0
Failed to find package: %ls, xrefs: 007D0AC1
elevation.cpp, xrefs: 007D0BA4
Failed to read count of ordered patches., xrefs: 007D0B72
Failed to read variables., xrefs: 007D0C2D
Failed to find ordered patch package: %ls, xrefs: 007D0C45

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memset
String ID: Failed to allocate memory for ordered patches.$Failed to execute MSP package.$Failed to find ordered patch package: %ls$Failed to find package: %ls$Failed to read UI level.$Failed to read action.$Failed to read count of ordered patches.$Failed to read ordered patch order number.$Failed to read ordered patch package id.$Failed to read package log.$Failed to read parent hwnd.$Failed to read rollback flag.$Failed to read variables.$elevation.cpp
API String ID: 2102423945-908036492
Opcode ID: d74285b01739368add3236d188c3071adb0cb8aa4baf71eb5628836cc41acf43
Instruction ID: 39f0ea3ec952aacc82b75875085aebcd9aa2a8f2c063031b6eee935a5ef1697c
Opcode Fuzzy Hash: d74285b01739368add3236d188c3071adb0cb8aa4baf71eb5628836cc41acf43
Instruction Fuzzy Hash: 487138B2D1126DFACB11DA94CC45EEFBBBCAB04720F105266F905F6341E678DA019BE1

Uniqueness

Uniqueness Score: -1.00%

Function 007E7A58 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 207stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,?,?,?,00000000,?,?,?,00000000,?,00000000), ref: 007E7A74

Strings

Invalid BITS engine URL: %ls, xrefs: 007E7A96
Failed while waiting for BITS download., xrefs: 007E7C21
Failed to download BITS job., xrefs: 007E7C13
Failed to add file to BITS job., xrefs: 007E7B48
Failed to set credentials for BITS job., xrefs: 007E7B2C
Failed to initialize BITS job callback., xrefs: 007E7B9F
Failed to create BITS job callback., xrefs: 007E7B90
Falied to start BITS job., xrefs: 007E7C1A
Failed to create BITS job., xrefs: 007E7B06
bitsengine.cpp, xrefs: 007E7A8A, 007E7B86
Failed to complete BITS job., xrefs: 007E7C34
Failed to copy download URL., xrefs: 007E7ABB
Failed to set callback interface for BITS job., xrefs: 007E7BB6

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$bitsengine.cpp
API String ID: 1659193697-2382896028
Opcode ID: 8cd59a7f91b774e7c43d0ed694404811dc7f750f558e13e50b29f56fed0c7c24
Instruction ID: 2992a6fbc4cc4175d138944c70fa496b1ebe3ae50fb189736b9d9a6dbccee291
Opcode Fuzzy Hash: 8cd59a7f91b774e7c43d0ed694404811dc7f750f558e13e50b29f56fed0c7c24
Instruction Fuzzy Hash: E2611631A062A5EBCB059F55CC85E6E7BBCAF1C720B204195F805EB391D73C9D00DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007C58D0 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 163COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 007C5A47

Part of subcall function 007F233B: GetProcessHeap.KERNEL32(?,00000000,?,007C3087,?,00000000,?,?,?,00000000), ref: 007F234C
Part of subcall function 007F233B: RtlAllocateHeap.NTDLL(00000000,?,007C3087,?,00000000,?,?,?,00000000), ref: 007F2353

SysFreeString.OLEAUT32(?), ref: 007C5A01

Strings

Regid, xrefs: 007C59B3
Failed to convert SoftwareTag text to UTF-8, xrefs: 007C5A98
Failed to get @Filename., xrefs: 007C5A83
Failed to get software tag count., xrefs: 007C591A
registration.cpp, xrefs: 007C5955
Failed to get next node., xrefs: 007C5A7C
SoftwareTag, xrefs: 007C58DE
Failed to allocate memory for software tag structs., xrefs: 007C595F
Failed to select software tag nodes., xrefs: 007C5900
Filename, xrefs: 007C5998
Failed to get SoftwareTag text., xrefs: 007C5A91
Failed to get @Regid., xrefs: 007C5A8A

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Regid$SoftwareTag$registration.cpp
API String ID: 336948655-11506941
Opcode ID: 212221f60236ff85e5a80e1e4088fcb9e77701d90dad301a0150ec705f5904bb
Instruction ID: a1796687cb2fc32b3aa369c9f9126a52411897b2598fd3616fd61ff4d8702cf7
Opcode Fuzzy Hash: 212221f60236ff85e5a80e1e4088fcb9e77701d90dad301a0150ec705f5904bb
Instruction Fuzzy Hash: 355180B2D00619EFCB10EFA5CCC5DBDBBB5AF04301B14856DEA05B7241D73AAE819B51

Uniqueness

Uniqueness Score: -1.00%

Function 007C7807 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 140registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 007C783B
RegCloseKey.ADVAPI32(?,00000000,?,?,007C8B4A,?), ref: 007C7991

Part of subcall function 007F378B: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,007D1F19,?,00000009,00000000,?,007D1BE1,80000002,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001), ref: 007F379F

_MREFOpen@16.MSPDB140-MSVCRT ref: 007C7883
RegQueryValueExW.ADVAPI32(?,?,00000000,007C8B4A,00000000,00000000,?,?,?,00000000,?,?,00000001,?,?,?), ref: 007C78D0

Strings

Failed to format value string., xrefs: 007C788E
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 007C7918
Failed to format key string., xrefs: 007C7846
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 007C7960
Registry key not found. Key = '%ls'; variable = '%ls', xrefs: 007C78A6
Failed to open registry key. Key = '%ls', xrefs: 007C78B0
Failed to set variable., xrefs: 007C794B
Failed to query registry key value., xrefs: 007C790B
search.cpp, xrefs: 007C7901

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Open@16$CloseOpenQueryValue
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'; variable = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
API String ID: 3932663376-1654530643
Opcode ID: 518b8fd334e4236ff55f4c33aaf9baacc7f77b71a282e79098069544747ad5bf
Instruction ID: e7cdae198308df9cdb21a665548b054ee67147c1a85ad62a7ba16295fbb749c5
Opcode Fuzzy Hash: 518b8fd334e4236ff55f4c33aaf9baacc7f77b71a282e79098069544747ad5bf
Instruction Fuzzy Hash: 6D4192B2904209FFDF14AF94CC89EBEBBB6AB04304F10442DF30166261DA7D5A50DF51

Uniqueness

Uniqueness Score: -1.00%

Function 007C9049 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C9077

Part of subcall function 007C8FD2: _memset.LIBCMT ref: 007C8FEA
Part of subcall function 007C8FD2: GetVersionExW.KERNEL32(?,?,00000000,007C9096), ref: 007C8FF9
Part of subcall function 007C8FD2: GetLastError.KERNEL32 ref: 007C9003

GetLastError.KERNEL32 ref: 007C909A

Strings

Failed to get OS info., xrefs: 007C90C9
variable.cpp, xrefs: 007C90BF
Failed to set variant value., xrefs: 007C921F

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast_memset$Version
String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
API String ID: 3644159973-1971907631
Opcode ID: e6cf2f5efb1d3b14c6dac50758ce36dcdacbf2897db375879268a13f21fdd0bf
Instruction ID: e4f24b994e1a0ea794abcd18266bdfb2b90b3f48baa0db9344beea78e8120b19
Opcode Fuzzy Hash: e6cf2f5efb1d3b14c6dac50758ce36dcdacbf2897db375879268a13f21fdd0bf
Instruction Fuzzy Hash: 1C51F8B1A0015DABD7609B698C8EFFA7BB8EB48710F0444AEF645E6140D5389E81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 007F2086 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 195sleepfiletimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F20D5
GetTempPathW.KERNEL32(00000104,?,00000001,00000009,00000000), ref: 007F2124
GetLastError.KERNEL32 ref: 007F212E
GetLocalTime.KERNEL32(?,?,?,?,00000000,?), ref: 007F21C7
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 007F2257
GetLastError.KERNEL32 ref: 007F2268
Sleep.KERNEL32(00000064), ref: 007F227A
CloseHandle.KERNEL32(000000FF), ref: 007F22E9

Strings

pathutil.cpp, xrefs: 007F2153
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 007F2229

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime_memset
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 820914711-1101990113
Opcode ID: 8c1b383913d5dbe847345fbbe4b8048450af267a375df99b27e17581a92d4b14
Instruction ID: cba6b3dab76fa262f1cf8d55ff24a8a83e7403ee8963c9978dee5788b95193da
Opcode Fuzzy Hash: 8c1b383913d5dbe847345fbbe4b8048450af267a375df99b27e17581a92d4b14
Instruction Fuzzy Hash: E171827190012DAECB309BA8DC8DABDB7B5FB48710F1102E5E618E6251D7399EC1CF55

Uniqueness

Uniqueness Score: -1.00%

Function 007C51BD Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 147COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFFFEE3,000000FF,007C2146,000000FF,007C2146,007C1F0E,007C2146,007C21D2,007C1E8E,00000000,007C21D2,007C1E8E,007C1E22,F08B8007), ref: 007C522B

Strings

Failed to concat file paths., xrefs: 007C5327
Failed to get next stream., xrefs: 007C5315
Failed to get directory portion of local file path, xrefs: 007C532E
X, xrefs: 007C523A
payload.cpp, xrefs: 007C52F7
Failed to ensure directory exists, xrefs: 007C5335
Failed to extract file., xrefs: 007C533C
Failed to find embedded payload: %ls, xrefs: 007C531F
Payload was not found in container: %ls, xrefs: 007C5305

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$X$payload.cpp
API String ID: 1825529933-3888727562
Opcode ID: 7e9c195e69b5748a6504d4c17ce1d987d4ea5e55495f9f10ef386e2a523ae2c0
Instruction ID: c048f7b80b25e7b88674a48dc462814f112eda0ae0e9610b8497e12e968693a3
Opcode Fuzzy Hash: 7e9c195e69b5748a6504d4c17ce1d987d4ea5e55495f9f10ef386e2a523ae2c0
Instruction Fuzzy Hash: D341F472900A09EBCF028F55CC45F6E7BB1BF44764F20806DE515AB251D7BAF981EB50

Uniqueness

Uniqueness Score: -1.00%

Function 007C28DB Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 118COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 007C2912
StringFromGUID2.OLE32(?,?,00000027), ref: 007C2925

Strings

Failed to create pipe guid., xrefs: 007C297B
Failed to allocate pipe name., xrefs: 007C2957
Failed to allocate pipe secret., xrefs: 007C29C8
Failed to convert pipe guid into string., xrefs: 007C29AB
pipe.cpp, xrefs: 007C2971, 007C29A1
BurnPipe.%s, xrefs: 007C2943

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
API String ID: 4041566446-2510341293
Opcode ID: 79f1370192c79ea78d1f2d54a1584c2cdbfaf3831a720f22609ad6e463de395c
Instruction ID: ce85fee250bfecda36afe102bdadcff12ba16f22d7da02c63e679508ffc117f1
Opcode Fuzzy Hash: 79f1370192c79ea78d1f2d54a1584c2cdbfaf3831a720f22609ad6e463de395c
Instruction Fuzzy Hash: 8E311D72D4031CEADB10DBE5CD49FEEB7B8AB05710F10412AEA09FB251D678A906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007C9885 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 007C98B0
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 007C98CB
GetLastError.KERNEL32 ref: 007C98D4
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,?,?,?), ref: 007C992D
GetLastError.KERNEL32 ref: 007C9933

Strings

Failed to get the Date., xrefs: 007C995D
variable.cpp, xrefs: 007C98F4, 007C9953
Failed to allocate the buffer for the Date., xrefs: 007C9917
Failed to set variant value., xrefs: 007C9978
Failed to get the required buffer length for the Date., xrefs: 007C98FE

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
API String ID: 2700948981-3682088697
Opcode ID: 82fa6c812102cb5e0737ed901201b9b98b3a9f70e91319547b90b294a4a7061e
Instruction ID: 1c9a2f4865460050bc285903b8ee2927f8523d17e68df968a17780fc8fd95c20
Opcode Fuzzy Hash: 82fa6c812102cb5e0737ed901201b9b98b3a9f70e91319547b90b294a4a7061e
Instruction Fuzzy Hash: 973164B1A0020EAADB419BE5CD8AFBEB7B9AF48714F10403DF304F6251DABDA9059751

Uniqueness

Uniqueness Score: -1.00%

Function 007E6851 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,000000FF,?,00000000,?,?,?,007E7355,?), ref: 007E68A1
GetLastError.KERNEL32(?,?,?,007E7355,?,?,000000FF,?,000000FF,00000000,?,00000001,?,?,WiX\Burn,DownloadTimeout), ref: 007E68AF
ReadFile.KERNEL32(00000000,00000008,00000008,00000000,00000000,?,?,?,007E7355,?,?,000000FF,?,000000FF,00000000,?), ref: 007E6904
CloseHandle.KERNEL32(000000FF,000000FF), ref: 007E693A
GetLastError.KERNEL32(?,?,?,007E7355,?,?,000000FF,?,000000FF,00000000,?,00000001,?,?,WiX\Burn,DownloadTimeout), ref: 007E6949

Strings

downloadengine.cpp, xrefs: 007E68D9, 007E6973
Failed to create resume file: %ls, xrefs: 007E68E8
Failed to calculate resume path from working path: %ls, xrefs: 007E6879
Failed to read resume file: %ls, xrefs: 007E6982

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: Failed to calculate resume path from working path: %ls$Failed to create resume file: %ls$Failed to read resume file: %ls$downloadengine.cpp
API String ID: 3160720760-919322122
Opcode ID: 50cab973d278f9f8ab795dd356e8e017e305e6d74edb25c02f3fb59366aaa104
Instruction ID: 0b6a954f879cb25afd91a111585129372c7e24635948b40ef84963093ee29b06
Opcode Fuzzy Hash: 50cab973d278f9f8ab795dd356e8e017e305e6d74edb25c02f3fb59366aaa104
Instruction Fuzzy Hash: 7541E2B1A01249FFDB108F95CC89AAD7BB5FF18350F208539F558EB2A1D3799A40DB11

Uniqueness

Uniqueness Score: -1.00%

Function 007D60BD Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 007D60ED
GetLastError.KERNEL32(?,00000001), ref: 007D60F9
GetObjectW.GDI32(00000000,00000018,?), ref: 007D6141
GetCursorPos.USER32(?), ref: 007D6162
MonitorFromPoint.USER32(?,?,00000002), ref: 007D6174
GetMonitorInfoW.USER32(00000000,?), ref: 007D618A

Strings

splashscreen.cpp, xrefs: 007D611E
(, xrefs: 007D6183
Failed to load splash screen bitmap., xrefs: 007D6128

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$splashscreen.cpp
API String ID: 2342928100-598475503
Opcode ID: a04d8433143161da4f30edea09b5217f2d43f362b38ca922c24892507e671682
Instruction ID: 13c7e99b18a068fd2a4c7b3bd3e7fc023348dd411fad7a88b67bead0a12e3dd9
Opcode Fuzzy Hash: a04d8433143161da4f30edea09b5217f2d43f362b38ca922c24892507e671682
Instruction Fuzzy Hash: 99317071A0070AAFDB10DFB8DD49AAEBBF5BF08700F10852DE515E6291EB79E904CB50

Uniqueness

Uniqueness Score: -1.00%

Function 007E493F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,?,00000000), ref: 007E495D
ReleaseMutex.KERNEL32(?), ref: 007E497D
WaitForSingleObject.KERNEL32(?,000000FF), ref: 007E49BF
ReleaseMutex.KERNEL32(?), ref: 007E49D2
SetEvent.KERNEL32(?), ref: 007E49DB

Strings

Failed to send files in use message from netfx chainer., xrefs: 007E4A1C
Failed to get message from netfx chainer., xrefs: 007E49F6

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 2d7cefa0419e883551640b227880506fc6778ab8e5c647b425f9ab1b73656d9f
Instruction ID: 8b0cf1bc4ba76450c3481ae0542bb803e55080579ff60dddbb3b337f03a3d69e
Opcode Fuzzy Hash: 2d7cefa0419e883551640b227880506fc6778ab8e5c647b425f9ab1b73656d9f
Instruction Fuzzy Hash: 97310631500248BFCB118BA5CC48EEEBBF5FF48320F14C529E465A62A1C779E945CB54

Uniqueness

Uniqueness Score: -1.00%

Function 007CC1E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,?,?,007CC689,?,007C138B,00000000,?,007C13BB,00000001), ref: 007CC1ED
GetLastError.KERNEL32(?,?,007CC689,?,007C138B,00000000,?,007C13BB,00000001), ref: 007CC1F7
GetExitCodeThread.KERNEL32(00000001,00000000,?,?,007CC689,?,007C138B,00000000,?,007C13BB,00000001), ref: 007CC239
GetLastError.KERNEL32(?,?,007CC689,?,007C138B,00000000,?,007C13BB,00000001), ref: 007CC243

Strings

core.cpp, xrefs: 007CC221, 007CC26D
Failed to get cache thread exit code., xrefs: 007CC277
Failed to wait for cache thread to terminate., xrefs: 007CC22B

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
API String ID: 3686190907-2546940223
Opcode ID: c631ea8adb9454cf2c1b3e770b2e807f7b865ff2a7ffec44810cb26569be7e41
Instruction ID: 3872196e3c5e4c48828652927842430db502c76158402d942ecd00e04f5c593c
Opcode Fuzzy Hash: c631ea8adb9454cf2c1b3e770b2e807f7b865ff2a7ffec44810cb26569be7e41
Instruction Fuzzy Hash: 9A117071A4060AFAEB11DBE1DD0AFAD7BA4BF01751F20812CE518E52A1D77DCA00AB59

Uniqueness

Uniqueness Score: -1.00%

Function 007E1267 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E1278

Part of subcall function 007F1A74: GetModuleFileNameW.KERNEL32(6!|,?,00000104,?,00000104,?,00000000,?,?,007C2136,?,00000000,?,?,?,76EEC3F0), ref: 007F1A95

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?), ref: 007E12F3

Part of subcall function 007F1D72: CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,?,00000000,00000003,?,?,00000003,00000001,00000000), ref: 007F1DB6

Strings

Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 007E139A
Failed to open container: %ls., xrefs: 007E12D1
Failed to extract all payloads from container: %ls, xrefs: 007E133E
Failed to extract payload: %ls from container: %ls, xrefs: 007E138E

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CompareString$FileModuleName_memset
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 3323778125-3891707333
Opcode ID: f42897731e74d3ffa60123f659d579c4e51f734daaa91949d533797cbab678d6
Instruction ID: 41e45284c920ac9fdb7b2cd29b2599ff42175b048403e3b647ed2101bc1a5e5b
Opcode Fuzzy Hash: f42897731e74d3ffa60123f659d579c4e51f734daaa91949d533797cbab678d6
Instruction Fuzzy Hash: 9D41C172D01698FBCF11EA968C4ACDEB7B8FF48310B604261F924AB151D2399A40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 007EF8AB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00815D9C,00000001,00000000,00000001,?,?,007D2083,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup), ref: 007EF8BD
CreateFileW.KERNEL32(40000000,00000001,00000000,?,00000080,00000000,?,00000000,?,?,00000000,00815D94,?,?,007D2083,00000001), ref: 007EF95E
GetLastError.KERNEL32(?,?,007D2083,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup,00000000,log,0000000D,00000000), ref: 007EF96E
SetFilePointer.KERNEL32(00000000,00000000,00000002,?,?,007D2083,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup,00000000), ref: 007EF9A9

Part of subcall function 007F2086: _memset.LIBCMT ref: 007F20D5
Part of subcall function 007F2086: GetLocalTime.KERNEL32(?,?,?,?,00000000,?), ref: 007F21C7

LeaveCriticalSection.KERNEL32(00815D9C,?,00000000,00815D94,?,?,007D2083,00000001,?,00000000,?,00000000,00000000,0000000D,00000000,Setup), ref: 007EF9FE

Strings

logutil.cpp, xrefs: 007EF98E

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime_memset
String ID: logutil.cpp
API String ID: 654766419-3545173039
Opcode ID: 382b1c5df008abe0a73b3b85b03ad633c23869b4e51c3b3309667754c3f9d0e6
Instruction ID: 6194d4acc7d13c6ab4fc5fad2dc81240be6342d673d50922a1f17e7c8f7af84f
Opcode Fuzzy Hash: 382b1c5df008abe0a73b3b85b03ad633c23869b4e51c3b3309667754c3f9d0e6
Instruction Fuzzy Hash: BC31C372102158FBCB115F21EC4DAAE7A2AFF48B50B114431F158D7562CB3D9D50D790

Uniqueness

Uniqueness Score: -1.00%

Function 007CF9CA Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 108COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,8900011A,007C17A1,00000001,?,007C17A1,00000001,000000FF,007C17A1,007C17A5,00000000,007C13C5,00000001,00000000,?,007CBD3C), ref: 007CFADA

Strings

Failed to create pipe name and client token., xrefs: 007CFA34
Failed to connect to elevated child process., xrefs: 007CFAB8
elevation.cpp, xrefs: 007CF9FE
UX aborted elevation requirement., xrefs: 007CFA08
Failed to create pipe and cache pipe., xrefs: 007CFA50
Failed to elevate., xrefs: 007CFAC3

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
API String ID: 2962429428-3003415917
Opcode ID: f335b226467399e2a5168c312cd4400570f616f38451df5cfeb406899bfe465a
Instruction ID: d8ce451fd1534d6047471a002613fb1657e28fc69e28e2f0180275e45ef8118b
Opcode Fuzzy Hash: f335b226467399e2a5168c312cd4400570f616f38451df5cfeb406899bfe465a
Instruction Fuzzy Hash: C531D672141705FAD711D620CC45FAFB3AEAB81320F20803EF91DE7281EA7D99455324

Uniqueness

Uniqueness Score: -1.00%

Function 007E5966 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 007E59B3
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 007E59D3
GetLastError.KERNEL32 ref: 007E59DD

Strings

Unexpected call to CabWrite()., xrefs: 007E5995
Failed to write during cabinet extraction., xrefs: 007E5A0C
cabextract.cpp, xrefs: 007E5A02

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 1970631241-3111339858
Opcode ID: f755330f81c5bb76178160578406483f2278e4b1c7ef1a7e6703641d3bd6e177
Instruction ID: d74ccff276b1c0fcef7c917b662414bf5586ce6c91bcb406f30e443c1e63e2c5
Opcode Fuzzy Hash: f755330f81c5bb76178160578406483f2278e4b1c7ef1a7e6703641d3bd6e177
Instruction Fuzzy Hash: 4621F272200A49EFD710CB59DD44D7A77F8FB48328B10412CFA19D7291D679E900DB24

Uniqueness

Uniqueness Score: -1.00%

Function 007E5899 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 007E58FA
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 007E590C
SetFileTime.KERNEL32(?,?,?,?), ref: 007E591F
CloseHandle.KERNEL32(?), ref: 007E592E

Strings

Invalid operation for this state., xrefs: 007E58D6
cabextract.cpp, xrefs: 007E58CA

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: 0f41d5d0acd66dc1ceae83b3c81358e5899e3408b9d6e51c53781f505b5e208e
Instruction ID: 0c5136bbe1525a62c4b1ebbeeca1a435dc17ac35ef9c8a02d0730565d14b227e
Opcode Fuzzy Hash: 0f41d5d0acd66dc1ceae83b3c81358e5899e3408b9d6e51c53781f505b5e208e
Instruction Fuzzy Hash: DD11D371501B0DFFA7109BA9DC898BBB7BCFB08324750452AE511D6191EB7CF942C721

Uniqueness

Uniqueness Score: -1.00%

Function 007F0034 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000001F4,?,{8~,?,?,007DA802,?,000001F4,?,?,?,?,?,?,?,?), ref: 007F0044
GetLastError.KERNEL32(?,?,007DA802,?,000001F4,?,?,?,?,?,?,?,?), ref: 007F0052
GetExitCodeProcess.KERNEL32(000001F4,?), ref: 007F008E
GetLastError.KERNEL32(?,?,007DA802,?,000001F4,?,?,?,?,?,?,?,?), ref: 007F0098

Strings

{8~, xrefs: 007F0038
procutil.cpp, xrefs: 007F00BD

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: procutil.cpp${8~
API String ID: 590199018-3796107435
Opcode ID: 75ccfd9b8166ed08b714832b1344efa32280961980e44f264eaf245f90436efc
Instruction ID: f156e601cb2800a30aebeb15f49797edb1b3c25323cddebb541effb9a553d5f5
Opcode Fuzzy Hash: 75ccfd9b8166ed08b714832b1344efa32280961980e44f264eaf245f90436efc
Instruction Fuzzy Hash: DC11A572A4122AFBD7204B54CC09BBA7AA4EF04770F118225FE04EB352DA7DCE40DAD5

Uniqueness

Uniqueness Score: -1.00%

Function 007F08BB Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000340,000000FF,00000000,00000000,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000), ref: 007F0909
GetLastError.KERNEL32(?,?,?,007EF6D3,?,00000340,00000000,00000000,?,00000000,?,?,?,007EFA98,?,00000340), ref: 007F090F

Part of subcall function 007F2382: GetProcessHeap.KERNEL32(00000000,?,?,007F08DD,?,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000,00000000), ref: 007F238A
Part of subcall function 007F2382: HeapSize.KERNEL32(00000000,?,007F08DD,?,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000,00000000,?), ref: 007F2391

Strings

W, xrefs: 007F08E4
strutil.cpp, xrefs: 007F09E5

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: W$strutil.cpp
API String ID: 3662877508-3697633219
Opcode ID: c8653c01b58d4fe18ee62a68880fd63c94911f3f49bc0f7761ac6e4ca7b8ca74
Instruction ID: 079b4f390d59e7b15f0dbc58141c65b75bc81b01717c3a975a9f68a7e28c2ed2
Opcode Fuzzy Hash: c8653c01b58d4fe18ee62a68880fd63c94911f3f49bc0f7761ac6e4ca7b8ca74
Instruction Fuzzy Hash: 064152B160420EEFEB10CFA4CD45A7D77A8EF04360F204629EA54D7393E6B9ED409B90

Uniqueness

Uniqueness Score: -1.00%

Function 007F7A4A Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F7AB4
InternetCrackUrlW.WININET(?,00000000,90000000,?), ref: 007F7B63
GetLastError.KERNEL32 ref: 007F7B6D

Strings

Tm~, xrefs: 007F7A7E
uriutil.cpp, xrefs: 007F7B9D

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CrackErrorInternetLast_memset
String ID: Tm~$uriutil.cpp
API String ID: 2372571340-3302325040
Opcode ID: d917f03016a59280291962e8ff9422dc7adbcd28e5e98e2f1c7afec7d5822eb7
Instruction ID: 011d9eb4369aefc332a795bfa0320742bd60cd8b4c08ee2878bacc30b68b2b15
Opcode Fuzzy Hash: d917f03016a59280291962e8ff9422dc7adbcd28e5e98e2f1c7afec7d5822eb7
Instruction Fuzzy Hash: CD61C271D0522CDBCB26DF65CC88AEDBBB5BB08704F4044EAE608A2211D7395ED9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 007C60CD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,?,000000FF,007C72B0,PackageVersion,?,?,00000001,00000001,007C72B0,00000001,00020006,00000001), ref: 007C6142
RegCloseKey.ADVAPI32(007C72B0,007C72B0,PackageVersion,?,?,00000001,00000001,007C72B0,00000001,00020006,00000001,00000000), ref: 007C6158

Strings

PackageVersion, xrefs: 007C6124
Failed to remove update registration key: %ls, xrefs: 007C6186
Failed to format key for update registration., xrefs: 007C60F9

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 96ee55d0cfc118406e873911e508b3ee61d645df14cbb5780e37a23220f8728e
Instruction ID: c0890ffe8be0ca0ab0c8f7c61d4d8dd6b608ed40bdc0fe103956441c5e11b959
Opcode Fuzzy Hash: 96ee55d0cfc118406e873911e508b3ee61d645df14cbb5780e37a23220f8728e
Instruction Fuzzy Hash: 9421A371D0060CFFCF11ABD98C86EAEBBB9EF44711F24456DF211A1252E77A5A40EB10

Uniqueness

Uniqueness Score: -1.00%

Function 007F78C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80networkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(?,?,00000001,00000000,?), ref: 007F791A
GetLastError.KERNEL32(?,007E6CA8,00000000,00000033,?,00000000,00000013,00000000,?,?,?,007E6E24,00000000,?,00000000,?), ref: 007F7920
HttpQueryInfoW.WININET(?,?,00000001,00000000,?), ref: 007F7953
GetLastError.KERNEL32(?,007E6CA8,00000000,00000033,?,00000000,00000013,00000000,?,?,?,007E6E24,00000000,?,00000000,?), ref: 007F7959

Strings

inetutil.cpp, xrefs: 007F797A

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorHttpInfoLastQuery
String ID: inetutil.cpp
API String ID: 4218848986-2900720265
Opcode ID: 574e5f61240aa5c3e6b4465cc01915757ed55437eeaa5877364b3da34a188c59
Instruction ID: b166343ba94532f007c81c306726a1e106b933ca5c2fc34e62b7ac7a11e3f202
Opcode Fuzzy Hash: 574e5f61240aa5c3e6b4465cc01915757ed55437eeaa5877364b3da34a188c59
Instruction Fuzzy Hash: FE218EB260410EFBDB01DF94CC84EBEB7ADAF44344B104025F600E6311E6B9EE00DB60

Uniqueness

Uniqueness Score: -1.00%

Function 007E485C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 007F233B: GetProcessHeap.KERNEL32(?,00000000,?,007C3087,?,00000000,?,?,?,00000000), ref: 007F234C
Part of subcall function 007F233B: RtlAllocateHeap.NTDLL(00000000,?,007C3087,?,00000000,?,?,?,00000000), ref: 007F2353

WaitForSingleObject.KERNEL32(?,000000FF), ref: 007E48F2
ReleaseMutex.KERNEL32(?), ref: 007E4921
SetEvent.KERNEL32(?), ref: 007E492A

Strings

NetFxChainer.cpp, xrefs: 007E4896
Failed to allocate buffer., xrefs: 007E48A3

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$NetFxChainer.cpp
API String ID: 944053411-3611226795
Opcode ID: b23935e01d4a711c40737eab77fe9bf1180c81a9cde9e11a5cbd132165f72fc9
Instruction ID: fd1a41c43a97e40bd21e02f3ae9230a3d27c215d94aec5f2e9e94c28325c7595
Opcode Fuzzy Hash: b23935e01d4a711c40737eab77fe9bf1180c81a9cde9e11a5cbd132165f72fc9
Instruction Fuzzy Hash: C421E571900248FFDB10DF64C849AAE7BB5FF49324F108069E915AF392C7B99D02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007F780B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70timenetworkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(00000000,4000000B,?,00000000,00000000), ref: 007F784A
GetLastError.KERNEL32 ref: 007F7854
SystemTimeToFileTime.KERNEL32(?,?), ref: 007F787D
GetLastError.KERNEL32 ref: 007F7887

Strings

inetutil.cpp, xrefs: 007F78A9

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLastTime$FileHttpInfoQuerySystem
String ID: inetutil.cpp
API String ID: 3487154604-2900720265
Opcode ID: 0eacd7da43fee154567c4af607b59926de9f073fa3b79882f73e09cf9c4a37de
Instruction ID: ca6557cae7923ad7f26af3dbb81db1aacf20fb5e6d346a9a17c31c8b8914fb84
Opcode Fuzzy Hash: 0eacd7da43fee154567c4af607b59926de9f073fa3b79882f73e09cf9c4a37de
Instruction Fuzzy Hash: 7311B772B0411ABBE7208BA9DC09BBBBBACAF04790F004025AA05F7250E66CDD00C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 007C9275 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 007C92A3
GetLastError.KERNEL32 ref: 007C92AD

Strings

variable.cpp, xrefs: 007C92D2
Failed to get computer name., xrefs: 007C92DC
Failed to set variant value., xrefs: 007C92F5

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
API String ID: 3560734967-484636765
Opcode ID: 7d8c7e85cb509b1f1f17b0892174e7a0df04d8755766ece33081dbd092bc4841
Instruction ID: 4f2dccda6c07bcd05af13b7da60932ceb7fe1b27198255a2756efe04314bb731
Opcode Fuzzy Hash: 7d8c7e85cb509b1f1f17b0892174e7a0df04d8755766ece33081dbd092bc4841
Instruction Fuzzy Hash: D401A572A41119B6D710DA599C0AFEE77E8BF09720F104129FA00FB380EA6DED0487A5

Uniqueness

Uniqueness Score: -1.00%

Function 007C9A5A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 007C9A8A
GetLastError.KERNEL32 ref: 007C9A94

Strings

variable.cpp, xrefs: 007C9AB4
Failed to get the user name., xrefs: 007C9ABE
Failed to set variant value., xrefs: 007C9ADA

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
API String ID: 2054405381-1522884404
Opcode ID: 8a0a0db4fa364d9efbbbbf4fec53fe11c74ed2bdd35c5580d6cfdf867c4f1434
Instruction ID: dafc8944e0559f8496e6a8a183f8f7c2b2cd1af4d812501e088fc71d5630f9a3
Opcode Fuzzy Hash: 8a0a0db4fa364d9efbbbbf4fec53fe11c74ed2bdd35c5580d6cfdf867c4f1434
Instruction Fuzzy Hash: 5701C472601229A6D720DB199C09FBF77ACAF04710F108169F608E6381DA6CDD058A95

Uniqueness

Uniqueness Score: -1.00%

Function 007E79DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 007E79F0
LeaveCriticalSection.KERNEL32(?), ref: 007E7A35
SetEvent.KERNEL32(?,?,?,?), ref: 007E7A49

Strings

Failed to get state during job modification., xrefs: 007E7A09
Failure while sending progress during BITS job modification., xrefs: 007E7A24

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: dec7f79bda928327a35dee1182ed29f9fa040d9211de811ea1e4222548a7a711
Instruction ID: 82a96081cc8f23c79e65aa57d38fe373a265e5c57cfb82faf1ca06dd73275324
Opcode Fuzzy Hash: dec7f79bda928327a35dee1182ed29f9fa040d9211de811ea1e4222548a7a711
Instruction Fuzzy Hash: A8019EB6205744FBCB15DF5AD889EAF77B8EB4C321B10842DE40AD3240EB78EA00D615

Uniqueness

Uniqueness Score: -1.00%

Function 007F497B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

#115.MSI(?), ref: 007F49A8
#116.MSI(?,00000001,?), ref: 007F49C8

Strings

2, xrefs: 007F4B77
wiutil.cpp, xrefs: 007F4BBC

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: #115#116
String ID: 2$wiutil.cpp
API String ID: 618785432-2873045267
Opcode ID: 733fe11c3ffab0106ba76efa9f2903f4ab03ab2b1f401e277c23b540329c9f55
Instruction ID: 618420218c3ec9641c71ef6145c63aff9586d9a0e75c56fde197c378b91bbdd2
Opcode Fuzzy Hash: 733fe11c3ffab0106ba76efa9f2903f4ab03ab2b1f401e277c23b540329c9f55
Instruction Fuzzy Hash: BE61A2B1A401098FCB18CF28C88567BB7B5FB94324B54867EDA16DF396D738D941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 007F1A74 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(6!|,?,00000104,?,00000104,?,00000000,?,?,007C2136,?,00000000,?,?,?,76EEC3F0), ref: 007F1A95
GetLastError.KERNEL32(?,007C2136,?,00000000,?,?,?,76EEC3F0,?,00000000), ref: 007F1AAC

Strings

pathutil.cpp, xrefs: 007F1AD1
6!|, xrefs: 007F1A92

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: 6!|$pathutil.cpp
API String ID: 2776309574-2612020689
Opcode ID: a6495633ff38a16f53de0cc5bb5ccabddaf64b50e83ecc1894ac218e375cb0bc
Instruction ID: 463091ce83293c19468271fde670d7ba65c8edb287802e0c19269cb18bac9d94
Opcode Fuzzy Hash: a6495633ff38a16f53de0cc5bb5ccabddaf64b50e83ecc1894ac218e375cb0bc
Instruction Fuzzy Hash: 51F0AF7260222EEB932056559C88E7ABA9CDF01BB0F55C125BA04E7351D75DDC0196E0

Uniqueness

Uniqueness Score: -1.00%

Function 007D28DD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 007D2906
GetLastError.KERNEL32 ref: 007D2910

Strings

EngineForApplication.cpp, xrefs: 007D2935
Failed to post elevate message., xrefs: 007D293F

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post elevate message.
API String ID: 2609174426-4098423239
Opcode ID: 44b405554b909f2a691d8c4795758a2bb8e0f86bfba5f6faf6553648e70401d0
Instruction ID: 7ec896ff71bfcfa9fa05d7e0b5408e25e79701aeb43cf632abd8b7fced1c9378
Opcode Fuzzy Hash: 44b405554b909f2a691d8c4795758a2bb8e0f86bfba5f6faf6553648e70401d0
Instruction Fuzzy Hash: AFF0C832785211ABD32056549C0AF167794AF15B30F118135BB18FE3E2D56D9C0383D5

Uniqueness

Uniqueness Score: -1.00%

Function 007D287B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 007D2890
GetLastError.KERNEL32 ref: 007D289A

Strings

Failed to post plan message., xrefs: 007D28C9
EngineForApplication.cpp, xrefs: 007D28BF

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post plan message.
API String ID: 2609174426-2952114608
Opcode ID: c3bbed8d82ae25c36a64010d0214f4b688ee7a59a0c9f2c4673aedfa0a877977
Instruction ID: 1c1924d1b1cee969eec80cd066e47bec777c7bb0276914db0bf2fbfbc6937a1f
Opcode Fuzzy Hash: c3bbed8d82ae25c36a64010d0214f4b688ee7a59a0c9f2c4673aedfa0a877977
Instruction Fuzzy Hash: 96F0A732B45325B6E2302A55AC0DE577F98EF14BB0F018135FA1CEA392D55DD80197D5

Uniqueness

Uniqueness Score: -1.00%

Function 007D281B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,00000000), ref: 007D282E
GetLastError.KERNEL32 ref: 007D2838

Strings

Failed to post detect message., xrefs: 007D2867
EngineForApplication.cpp, xrefs: 007D285D

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post detect message.
API String ID: 2609174426-598219917
Opcode ID: 70b55fd2d4ecef74bef8965bbd4bc4fd1142e9f89e5d553f1b6bfdea09e9b89d
Instruction ID: a84816136e0b7c53d1c37463f888f5eb50a84e53196eec243abb0e9bf1c6d0ad
Opcode Fuzzy Hash: 70b55fd2d4ecef74bef8965bbd4bc4fd1142e9f89e5d553f1b6bfdea09e9b89d
Instruction Fuzzy Hash: 40F0A772B8622576D23025555C0DF576E98EF15BA0B028135F61CEB392D55CD801D2E5

Uniqueness

Uniqueness Score: -1.00%

Function 007D2953 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 007D2968
GetLastError.KERNEL32 ref: 007D2972

Strings

EngineForApplication.cpp, xrefs: 007D2997
Failed to post apply message., xrefs: 007D29A1

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post apply message.
API String ID: 2609174426-1304321051
Opcode ID: 2696d46154605d474389864f1219e24aeaa3eecd1718acd1736218900539dd4a
Instruction ID: 4e1beda4f649d8e1ca423474642c3219a97b8396f24e07b48677b79a5bffc973
Opcode Fuzzy Hash: 2696d46154605d474389864f1219e24aeaa3eecd1718acd1736218900539dd4a
Instruction Fuzzy Hash: BEF0A77278532576D2311655AC09E577F98EF14BB0F018135FA1CFE3A2D56DD801C2D5

Uniqueness

Uniqueness Score: -1.00%

Function 007D29B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009004,?,00000000), ref: 007D29CA
GetLastError.KERNEL32 ref: 007D29D4

Strings

EngineForApplication.cpp, xrefs: 007D29F9
Failed to post shutdown message., xrefs: 007D2A03

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post shutdown message.
API String ID: 2609174426-188808143
Opcode ID: 05ca8907f06d4c3d66f0bc37bc35fd82f714712cfe55cfb9c0e9ec1594a9adbf
Instruction ID: ae11f012194096bdc9d31085533de90a2254271160bbb5a3cd8bcf171f82444c
Opcode Fuzzy Hash: 05ca8907f06d4c3d66f0bc37bc35fd82f714712cfe55cfb9c0e9ec1594a9adbf
Instruction Fuzzy Hash: 96F02732746225B7D3301A959C0AE563B98FF01B70F018035FA1CFA3A2D55CD80183D4

Uniqueness

Uniqueness Score: -1.00%

Function 007F396D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 007F3AD3

Part of subcall function 007F378B: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,007D1F19,?,00000009,00000000,?,007D1BE1,80000002,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001), ref: 007F379F

Strings

regutil.cpp, xrefs: 007F3AC0

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: regutil.cpp
API String ID: 47109696-955085611
Opcode ID: e47da861bdac347d03936f5e83effcc80c529f0cc1f6dafb95a392bb0bcd9fa7
Instruction ID: c6a2ee610b6b031a78b6f91cbc617d5da0e02495d2ddbed4fd86fe9c16f2b754
Opcode Fuzzy Hash: e47da861bdac347d03936f5e83effcc80c529f0cc1f6dafb95a392bb0bcd9fa7
Instruction Fuzzy Hash: 8E41B43690011EEBDF119A668C05ABE76A6AF80350F29C129FB65E7350EB7DCF01A750

Uniqueness

Uniqueness Score: -1.00%

Function 007F31D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,007D1F19,00000000,007D1F19,00000002,00000009,00000000,007D1F19,00000000,?,?,?), ref: 007F3241
RegQueryValueExW.ADVAPI32(?,007D1F19,00000000,?,007D1F19,?,007D1F19,?), ref: 007F327A

Strings

regutil.cpp, xrefs: 007F32DF

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: bff0806562883c5af613e0d28e15255b5833268dd08ed605086fae7bb381af54
Instruction ID: 69dd6fad989c6663f2724687940e1cbd503c1d38acd6a51adf6a6de4fdd43fb4
Opcode Fuzzy Hash: bff0806562883c5af613e0d28e15255b5833268dd08ed605086fae7bb381af54
Instruction Fuzzy Hash: E141E571A0024EEBDF10DF94CC85ABEBBA9FF04310F10496AEA11E6351D7799A549B90

Uniqueness

Uniqueness Score: -1.00%

Function 007F125F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007F12FF
_memmove.LIBCMT ref: 007F130A

Part of subcall function 007F2382: GetProcessHeap.KERNEL32(00000000,?,?,007F08DD,?,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000,00000000), ref: 007F238A
Part of subcall function 007F2382: HeapSize.KERNEL32(00000000,?,007F08DD,?,?,00000000,?,?,?,?,007EF6D3,?,00000340,00000000,00000000,?), ref: 007F2391

Strings

W, xrefs: 007F1285

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: Heap_memmove$ProcessSize
String ID: W
API String ID: 3606272560-655174618
Opcode ID: 4337d811ab13aa5c2fe4b0058768c62c44b60dd9dc8479738dd8d0c6da4f175d
Instruction ID: 5dae057c0fa4cdb1a4493cb4eb691198d887766611fa682225e67b542da9e823
Opcode Fuzzy Hash: 4337d811ab13aa5c2fe4b0058768c62c44b60dd9dc8479738dd8d0c6da4f175d
Instruction Fuzzy Hash: 47217171A0020AEBDB00DFA9CC85DBE77B9FF44334F614629EA11A7345EB39DA009760

Uniqueness

Uniqueness Score: -1.00%

Function 007F19CF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 007F1A51

Strings

\\?\, xrefs: 007F1A16
\\?\UNC, xrefs: 007F1A5B

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: _memmove_s
String ID: \\?\$\\?\UNC
API String ID: 800865076-2523517826
Opcode ID: 377d06be67270ced423d3c6505ca68b1ab560564d20f2750339e1b7360671cf4
Instruction ID: 233f84f40ca1a477ae912a8f960e118c3b01bda98ca2d8ba14ae997a7fdafe1f
Opcode Fuzzy Hash: 377d06be67270ced423d3c6505ca68b1ab560564d20f2750339e1b7360671cf4
Instruction Fuzzy Hash: 8011B66234120CF5E6309645DC06FF67359EB50F60FC18026F758AA282E6A966C1CB65

Uniqueness

Uniqueness Score: -1.00%

Function 007C40BB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,?,007DF8DA,00000000,IGNOREDEPENDENCIES,00000000,?), ref: 007C410E

Strings

IGNOREDEPENDENCIES, xrefs: 007C40CA
Failed to copy the property value., xrefs: 007C413E

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 3617c991cd4cfe2ae65327950941dc2f44d0dac7b214c056a2da460298ec557e
Instruction ID: 1bbea6aa1a55963c2cc082c26d4196e5782b2059ba6de77f33ee1f03a876242f
Opcode Fuzzy Hash: 3617c991cd4cfe2ae65327950941dc2f44d0dac7b214c056a2da460298ec557e
Instruction Fuzzy Hash: 9C11B27150421CEFCF108F94CC94EAA77B5FB04364F2585BEFA6A57251C6349D80C750

Uniqueness

Uniqueness Score: -1.00%

Function 007CC157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 007CC170
CoUninitialize.OLE32(?,?,?,?,?,?), ref: 007CC1D3

Strings

Failed to initialize COM on cache thread., xrefs: 007CC17D

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: 8da57d2e99c9c6f388bab94241d366e91130d4556e1b176bf0b6aea8df19a004
Instruction ID: eecfa2cda583e8396b0f673dfaae4b11da47034706770027badf09036b30a338
Opcode Fuzzy Hash: 8da57d2e99c9c6f388bab94241d366e91130d4556e1b176bf0b6aea8df19a004
Instruction Fuzzy Hash: 760161B1500208FFDB119F65D848FAA7BECEF09354F14842AF909D7211D678A9448B65

Uniqueness

Uniqueness Score: -1.00%

Function 007C7196 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007F378B: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,007D1F19,?,00000009,00000000,?,007D1BE1,80000002,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,?,00000001), ref: 007F379F

RegCloseKey.ADVAPI32(00000000,00000000,00000000,?,?,00020006,00000000,00000000,00000001,?,?,007E1835,000000F9,00000000,000000B9,00000000), ref: 007C71ED

Strings

Failed to update resume mode., xrefs: 007C71D7
Failed to open registration key., xrefs: 007C71BD

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update resume mode.
API String ID: 47109696-3366686031
Opcode ID: 675a4bbf9324dc3150b358e0db4bb832f64dda7e08aa728442b9a04a20c0c6e5
Instruction ID: 653b6d39e66971c9ad579973591e7427c55b3f28c876b810dd5de5b2dce11712
Opcode Fuzzy Hash: 675a4bbf9324dc3150b358e0db4bb832f64dda7e08aa728442b9a04a20c0c6e5
Instruction Fuzzy Hash: DAF0FC7654431CFBDB119695DC05FAE77B6DBC5325F24002DFA01A7250EE78EE00EA10

Uniqueness

Uniqueness Score: -1.00%

Function 007E00D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(F08B8006,00000000,007C1AAE,?,007CD97B,?,007C1AAE,007C1E12,007C1E12,00000000,?,007C1E22,7FAB1868,007C1E22,?,?), ref: 007E0108
_memset.LIBCMT ref: 007E011A

Part of subcall function 007E5AA9: SetEvent.KERNEL32(526A5680,007C2222,007C1E22,?,?,007E00ED,007C2222,00000000,007C1AAE,?,007CD97B,?,007C1AAE,007C1E12,007C1E12,00000000), ref: 007E5ACA
Part of subcall function 007E5AA9: GetLastError.KERNEL32(?,?,007E00ED,007C2222,00000000,007C1AAE,?,007CD97B,?,007C1AAE,007C1E12,007C1E12,00000000,?,007C1E22,7FAB1868), ref: 007E5AD4
Part of subcall function 007E5AA9: CloseHandle.KERNEL32(004005BE,00000000,007C2222,007C1E22,?,?,007E00ED,007C2222,00000000,007C1AAE,?,007CD97B,?,007C1AAE,007C1E12,007C1E12), ref: 007E5B70
Part of subcall function 007E5AA9: CloseHandle.KERNEL32(526A5680,00000000,007C2222,007C1E22,?,?,007E00ED,007C2222,00000000,007C1AAE,?,007CD97B,?,007C1AAE,007C1E12,007C1E12), ref: 007E5B7D
Part of subcall function 007E5AA9: CloseHandle.KERNEL32(7FAD1468,00000000,007C2222,007C1E22,?,?,007E00ED,007C2222,00000000,007C1AAE,?,007CD97B,?,007C1AAE,007C1E12,007C1E12), ref: 007E5B8A

Strings

Failed to close cabinet., xrefs: 007E00F3

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: CloseHandle$ErrorEventLast_memset
String ID: Failed to close cabinet.
API String ID: 1352847294-2920093955
Opcode ID: bff27c44bb987d9360677b5a5220e02deb3285a2409050f6b4cb16dfef240f27
Instruction ID: 0ddd1d26ced1d5cf483cac1afa9acc359d68c17d4e93600523518e5743e59947
Opcode Fuzzy Hash: bff27c44bb987d9360677b5a5220e02deb3285a2409050f6b4cb16dfef240f27
Instruction Fuzzy Hash: BFF02E32201A4876C211555B7C06E1E73999FD9730F300329F568DB3C1DB78AC4142D4

Uniqueness

Uniqueness Score: -1.00%

Function 007F798D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

HttpQueryInfoW.WININET(?,?,00000001,?,00000000), ref: 007F79B6
GetLastError.KERNEL32(?,?,?,007E6BA9,00000000,00000013,00000000,?,?,?,007E6E24,00000000,?,00000000,?,00000000), ref: 007F79C0

Strings

inetutil.cpp, xrefs: 007F79E5

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: ErrorHttpInfoLastQuery
String ID: inetutil.cpp
API String ID: 4218848986-2900720265
Opcode ID: 2faf825f18de938abe4dc10b78c296d22f0301795e872ee140195a507697af0b
Instruction ID: 621b7792e2a343e47d550c9ef48f8ae9e058f6aca733edb4a8054d423a550a12
Opcode Fuzzy Hash: 2faf825f18de938abe4dc10b78c296d22f0301795e872ee140195a507697af0b
Instruction Fuzzy Hash: 3CF096B261011ABBEB209B95CC09FFB7BACEF04760F004115BE44E6210E2BCEE00C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 007F315B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007F2A2D: _memset.LIBCMT ref: 007F2A54
Part of subcall function 007F2A2D: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 007F2A69
Part of subcall function 007F2A2D: LoadLibraryW.KERNELBASE(?,?,00000104,007C1C3B), ref: 007F2AB7
Part of subcall function 007F2A2D: GetLastError.KERNEL32 ref: 007F2AC3

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 007F317C

Strings

RegDeleteKeyExW, xrefs: 007F3171
AdvApi32.dll, xrefs: 007F3161

Memory Dump Source

Source File: 0000000E.00000002.2659169946.00000000007C1000.00000020.00000001.01000000.00000009.sdmp, Offset: 007C0000, based on PE: true

Associated: 0000000E.00000002.2659088098.00000000007C0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659285084.00000000007FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659359120.0000000000814000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.2659409261.000000000081A000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7c0000_vc_redist.jbxd

Similarity

API ID: AddressDirectoryErrorLastLibraryLoadProcSystem_memset
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 2769571726-850864035
Opcode ID: 97586347dc4c45ac3af50f8ab7929479ebc717f7a2bbde024de169321304b021
Instruction ID: 4eebcc46b14eed86f6a7817295805eb75c32177ebfdb4f887605dce512cdba6a
Opcode Fuzzy Hash: 97586347dc4c45ac3af50f8ab7929479ebc717f7a2bbde024de169321304b021
Instruction Fuzzy Hash: F1E08C70902E24DBC7109B14FC0DFD53A6DFF80790F008032E614AA3A1E3780A808780

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report starwindconverter.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\64f25a.rbs

C:\Config.Msi\64f25e.rbs

C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_Converter.exe (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\V2V_ConverterConsole.exe (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-auth.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-cal.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-common.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-compression.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-event-stream.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-http.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-io.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-mqtt.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-s3.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-c-sdkutils.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-checksums.dll (copy)

C:\Program Files\StarWind Software\StarWind V2V Converter\aws-cpp-sdk-core.dll (copy)

Windows Analysis Report
starwindconverter.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre