Edit tour

Windows Analysis Report
ocs-office.exe

Overview

General Information

Sample name:	ocs-office.exe
Analysis ID:	1401771
MD5:	9ca1a4c10e82450b64100ad0723bc23f
SHA1:	2250f749cedc73924c998c8e38448cd739c4095b
SHA256:	2cb1be6c34d9992150169d9abe3236b700f946c6ff9f8f76507d46331d4bb431
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Binary is likely a compiled AutoIt script file

Bypasses PowerShell execution policy

Queries memory information (via WMI often done to detect virtual machines)

Queries pointing device information (via WMI, Win32_PointingDevice, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive printer information (via WMI, Win32_Printer, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Uses ipconfig to lookup or modify the Windows network settings

Writes or reads registry keys via WMI

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

ocs-office.exe (PID: 6556 cmdline: C:\Users\user\Desktop\ocs-office.exe MD5: 9CA1A4C10E82450B64100AD0723BC23F)

ocsoffice.exe (PID: 744 cmdline: C:\Users\user\Downloads\ocsoffice.exe MD5: BCD0D1EA9750CA6F018DA33DD41552B1)

instOCS.exe (PID: 3704 cmdline: instocs.exe MD5: 3F4CD95A8DF390E36298093C74B3BF7E)

OcsSetup.exe (PID: 4600 cmdline: "C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe" /S /NP /NOSPLASH /NO_SYSTRAY /NOW /TAG="office" /SERVER=http://ti.fm2c.com.br/ocsinventory MD5: B2216E895278C44D8168F78188AB4FE9)

OCSInventory.exe (PID: 2284 cmdline: "C:\Program Files\OCS Inventory Agent\ocsinventory.exe" /SAVE_CONF /SERVER=http://ti.fm2c.com.br/ocsinventory /USER= /PWD= /SSL=1 /CA="cacert.pem" /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG="office" /WMI_FLAG_MODE="COMPLETE" /DEFAULT_USER_DOMAIN="" /NO_SYSTRAY MD5: 38E1FC55C0339A770DD39CA6541437B9)

OCSInventory.exe (PID: 6540 cmdline: C:\Program Files\OCS Inventory Agent\ocsinventory.exe MD5: 38E1FC55C0339A770DD39CA6541437B9)

cmd.exe (PID: 4324 cmdline: C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 2124 cmdline: cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cmd.exe (PID: 4476 cmdline: C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)} MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5224 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}" MD5: 04029E121A0CFA5991749937DD22A1D9)

ipconfig.exe (PID: 888 cmdline: "C:\Windows\system32\ipconfig.exe" /displaydns MD5: 62F170FB07FDBB79CEB7147101406EB8)

OcsService.exe (PID: 5376 cmdline: "C:\Program Files\OCS Inventory Agent\OcsService.exe" -install MD5: 67C17EA1BF6EB610DEAC638E4078D6B4)

conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

OcsService.exe (PID: 2488 cmdline: C:\Program Files\OCS Inventory Agent\OcsService.exe MD5: 67C17EA1BF6EB610DEAC638E4078D6B4)

cmd.exe (PID: 5796 cmdline: C:\Windows\system32\cmd.exe" /c "C:\Program Files\OCS Inventory Agent\ocsinventory.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

OCSInventory.exe (PID: 1464 cmdline: C:\Program Files\OCS Inventory Agent\ocsinventory.exe MD5: 38E1FC55C0339A770DD39CA6541437B9)

cmd.exe (PID: 5480 cmdline: C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 3244 cmdline: cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

cmd.exe (PID: 5644 cmdline: C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)} MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2164 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}" MD5: 04029E121A0CFA5991749937DD22A1D9)

ipconfig.exe (PID: 4092 cmdline: "C:\Windows\system32\ipconfig.exe" /displaydns MD5: 62F170FB07FDBB79CEB7147101406EB8)

cleanup

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4476, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}", ProcessId: 5224, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs", CommandLine: cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs", CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4324, ParentProcessName: cmd.exe, ProcessCommandLine: cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs", ProcessId: 2124, ProcessName: cscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}", CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4476, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}", ProcessId: 5224, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Multi AV Scanner detection for submitted file

Source: ocs-office.exe

Virustotal: Detection: 11%

Perma Link

Source: OCSInventory.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Directory created: C:\Program Files\OCS Inventory Agent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Directory created: C:\Program Files\OCS Inventory Agent\Plugins	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Directory created: C:\Program Files\OCS Inventory Agent\Plugins\DO_NOT_REMOVE.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Directory created: C:\Program Files\OCS Inventory Agent\Plugins\o36516user.vbs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\libcurl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\libeay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\ssleay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\msvcr120.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\mfc140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\mfc140u.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\mfcm140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\mfcm140u.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\vcomp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\vcamp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\ucrtbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\ZipArchive.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\zlib1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\ComHTTP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OcsWmi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\SysInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OCSInventory Front.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\Download.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OcsService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OcsSystray.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OcsNotifyUser.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OCS-transform.xsl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\Plugins\Saas.ps1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\uninst.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OCS Inventory NG Agent

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe

File created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OCS-Windows-Agent-Setup-x64.log

Jump to behavior

Source: unknown	HTTPS traffic detected: 119.8.87.215:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.87.215:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: ocs-office.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\openssl-1.0.2r\out32dll\ssleay32.pdb source: OCSInventory.exe, 00000007.00000002.2031169967.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000008.00000002.2195385269.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000016.00000002.2414567170.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\MFCM140U.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcamp140.amd64.pdbGCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsNotifyUser.pdb883GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsService.pdb--)GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsService.exe, 00000011.00000002.2230690850.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000011.00000000.2223938644.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000000.2243858108.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000002.2906285996.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\openssl-1.0.2r\out32dll\libeay32.pdba source: OCSInventory.exe, 00000007.00000002.2030109278.00007FFDFB4A9000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2193943425.00007FFDFB4A9000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000011.00000002.2231658880.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907261387.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413735788.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\MFCM140.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OCSInventory Front.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031403378.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000008.00000002.2196356994.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000011.00000002.2232355200.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000013.00000002.2908044221.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000016.00000002.2415168665.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: OCSInventory.exe, 00000007.00000002.2030509014.00007FFDFB834000.00000002.00000001.01000000.00000019.sdmp, OCSInventory.exe, 00000008.00000002.2194438887.00007FFDFB834000.00000002.00000001.01000000.00000019.sdmp, OcsService.exe, 00000011.00000002.2231151082.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp, OcsService.exe, 00000013.00000002.2906769234.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp, OCSInventory.exe, 00000016.00000002.2413114558.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsWmi.pdb))'GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029595116.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000008.00000002.2192512504.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000011.00000002.2229840960.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000013.00000002.2905102277.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000016.00000002.2411751483.0000000180007000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\openssl-1.0.2r\out32dll\libeay32.pdb source: OCSInventory.exe, 00000007.00000002.2030109278.00007FFDFB4A9000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2193943425.00007FFDFB4A9000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000011.00000002.2231658880.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907261387.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413735788.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsSystray.pdb::3GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OCSInventory.pdb55,GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000000.2027408654.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000007.00000002.2029941666.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000002.2193694096.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000000.2057861583.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000000.2249360801.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000002.2412776468.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\openssl-1.0.2r\out32dll\ssleay32.pdbFF source: OCSInventory.exe, 00000007.00000002.2031169967.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000008.00000002.2195385269.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000016.00000002.2414567170.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OCSInventory.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000000.2027408654.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000007.00000002.2029941666.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000002.2193694096.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000000.2057861583.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000000.2249360801.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000002.2412776468.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\zlib-1.2.8\zlib1.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029529385.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000008.00000002.2192290265.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000011.00000002.2229660959.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000013.00000002.2904927334.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000016.00000002.2411630185.000000006670E000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\Download.pdb//+GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcamp140.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: OCSInventory.exe, 00000007.00000002.2030509014.00007FFDFB834000.00000002.00000001.01000000.00000019.sdmp, OCSInventory.exe, 00000008.00000002.2194438887.00007FFDFB834000.00000002.00000001.01000000.00000019.sdmp, OcsService.exe, 00000011.00000002.2231151082.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp, OcsService.exe, 00000013.00000002.2906769234.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp, OCSInventory.exe, 00000016.00000002.2413114558.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\ComHTTP.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031254054.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000008.00000002.2195594617.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000016.00000002.2414823583.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\SysInfo.pdbWW#GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2030862261.00007FFDFF2BB000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000008.00000002.2194884273.00007FFDFF2BB000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000011.00000002.2232054370.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000013.00000002.2907707881.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000016.00000002.2414173406.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsWmi.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029595116.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000008.00000002.2192512504.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000011.00000002.2229840960.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000013.00000002.2905102277.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000016.00000002.2411751483.0000000180007000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsSystray.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\SysInfo.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2030862261.00007FFDFF2BB000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000008.00000002.2194884273.00007FFDFF2BB000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000011.00000002.2232054370.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000013.00000002.2907707881.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000016.00000002.2414173406.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031330447.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp, OCSInventory.exe, 00000008.00000002.2195863861.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp, OcsService.exe, 00000011.00000002.2232211869.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp, OcsService.exe, 00000013.00000002.2907881081.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp, OCSInventory.exe, 00000016.00000002.2414992126.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsService.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsService.exe, 00000011.00000002.2230690850.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000011.00000000.2223938644.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000000.2243858108.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000002.2906285996.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\ZipArchive\x64\Release Unicode STL MD DLL\ZipArchive.pdbSS GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcomp140.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsNotifyUser.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\zlib-1.2.8\zlib1.pdb## source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029529385.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000008.00000002.2192290265.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000011.00000002.2229660959.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000013.00000002.2904927334.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000016.00000002.2411630185.000000006670E000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\ComHTTP.pdb''"GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031254054.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000008.00000002.2195594617.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000016.00000002.2414823583.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\ZipArchive\x64\Release Unicode STL MD DLL\ZipArchive.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OCSInventory Front.pdbKK(GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031403378.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000008.00000002.2196356994.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000011.00000002.2232355200.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000013.00000002.2908044221.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000016.00000002.2415168665.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\Download.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcomp140.amd64.pdbGCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031477967.00007FFE13315000.00000002.00000001.01000000.0000001C.sdmp, OCSInventory.exe, 00000008.00000002.2196757713.00007FFE13315000.00000002.00000001.01000000.0000001C.sdmp, OcsService.exe, 00000011.00000002.2232501460.00007FFE1A475000.00000002.00000001.01000000.0000001C.sdmp, OcsService.exe, 00000013.00000002.2908212378.00007FFE1A475000.00000002.00000001.01000000.0000001C.sdmp, OCSInventory.exe, 00000016.00000002.2415294839.00007FFE1A475000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: OCSInventory.exe, 00000007.00000002.2030972028.00007FFE002D5000.00000002.00000001.01000000.0000001B.sdmp, OCSInventory.exe, 00000008.00000002.2195052215.00007FFE002D5000.00000002.00000001.01000000.0000001B.sdmp, OcsService.exe, 00000011.00000002.2231886839.00007FFE00305000.00000002.00000001.01000000.0000001B.sdmp, OcsService.exe, 00000013.00000002.2907530308.00007FFE00305000.00000002.00000001.01000000.0000001B.sdmp, OCSInventory.exe, 00000016.00000002.2414004919.00007FFE00305000.00000002.00000001.01000000.0000001B.sdmp

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAFBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF78EAFBC70
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAC2F50 FindFirstFileExW,	0_2_00007FF78EAC2F50
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAFC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF78EAFC7C0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB0A874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF78EB0A874
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB0A350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF78EB0A350
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB0A4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF78EB0A4F8
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB06428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF78EB06428
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAFB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF78EAFB7C0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB071F4 FindFirstFileW,FindClose,	0_2_00007FF78EB071F4
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB072A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF78EB072A8
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_00406313 FindFirstFileA,FindClose,	1_2_00406313
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_004057D8 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	1_2_004057D8
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_00402765 FindFirstFileA,	1_2_00402765
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_00406313 FindFirstFileA,FindClose,	2_2_00406313
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_004057D8 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	2_2_004057D8
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_00402765 FindFirstFileA,	2_2_00402765
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Code function: 3_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	3_2_004059F0
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Code function: 3_2_0040659C FindFirstFileA,FindClose,	3_2_0040659C
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Code function: 3_2_004027A1 FindFirstFileA,	3_2_004027A1
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3B5D90 _errno,_errno,malloc,memset,malloc,malloc,free,free,_errno,MultiByteToWideChar,FindFirstFileW,free,free,free,_errno,FindNextFileW,WideCharToMultiByte,_errno,	7_2_00007FFDFB3B5D90

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB0E87C InternetReadFile,

0_2_00007FF78EB0E87C

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 02 Mar 2024 01:23:36 GMTServer: Apache/2.4.41 (Ubuntu)content-length: 236Cache-control: no-cacheContent-Type: application/x-compressedData Raw: 78 9c 6d 90 31 4f c3 30 10 85 f7 fc 0a cb 4b 26 48 53 10 62 b0 5d 59 ce 25 44 72 ee 5c c7 81 66 ca 50 2a 54 09 52 09 24 c4 cf c7 ae 50 9b 81 ed de f7 de 9d 9e 4e 6c 7e 3e de d9 f7 e1 f3 eb 78 9a 65 5e de ae 72 76 98 f7 a7 d7 e3 fc 26 f3 21 d4 37 8f f9 46 65 c2 83 b3 a3 ca 18 13 ce 93 a5 66 aa 3d 6c d5 fa 5e 14 4b 9d fc 16 9f 01 03 f9 71 22 9c fa a0 7d 18 9c 2a 45 f1 2f 4f 0b e4 42 4b 98 c6 74 5d 7b dd 31 d8 81 19 12 9d 42 db 01 0d 41 f2 72 bd e2 cc 81 6f a9 9a ac 0e 80 66 8c 90 b3 4b e0 2e fa 84 92 2f 62 80 4d 78 8a a9 88 cc 68 2c 5c 17 1f 22 0a a3 03 c9 0d 61 cd 59 ed 75 b3 38 1b dd e2 af 10 ea 0e 54 45 2f 68 49 57 a2 38 cb d4 ba b8 d6 8e cf e9 1d 61 0f aa 07 8c 99 8b cc d2 7c fe db 2f be 83 5e 6c Data Ascii: xm1O0K&HSb]Y%Dr\fPTR$PNl~>xe^rv&!7Fef=l^Kq"}E/OBKt]{1BArofK./bMxh,\"aYu8TE/hIW8a\|/^l
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 02 Mar 2024 01:23:48 GMTServer: Apache/2.4.41 (Ubuntu)content-length: 91Cache-control: no-cacheContent-Type: application/x-compressedData Raw: 78 9c b3 b1 af c8 cd 51 28 4b 2d 2a ce cc cf b3 55 37 d4 33 50 57 48 cd 4b ce 4f c9 cc 4b b7 55 0f 0d 71 d3 b5 50 b7 b7 e3 b2 09 72 0d f0 89 b4 e3 52 50 00 b2 82 03 fc fd 82 5d ed fc fc e3 1d 9d 9d fd 43 fd 42 e2 43 03 5c 1c 43 5c 6d f4 e1 72 5c 20 36 58 07 00 84 71 1b 9f Data Ascii: xQ(K-*U73PWHKOKUqPrRP]CBC\C\mr\ 6Xq
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 02 Mar 2024 01:23:55 GMTServer: Apache/2.4.41 (Ubuntu)content-length: 237Cache-control: no-cacheContent-Type: application/x-compressedData Raw: 78 9c 6d 90 41 4f c3 30 0c 85 ef fd 15 51 2e 3d 41 d6 81 10 87 34 53 d4 ba a5 52 6a 87 34 85 e5 d4 c3 98 d0 24 e8 24 90 10 3f 9f a4 88 6d 07 4e f6 f7 9e 6d 3d 59 6e be df df d8 d7 fe e3 f3 70 9c cb bc b8 5e e5 6c 3f ef 8e 2f 87 f9 b5 cc 47 df 5c dd e7 1b 95 49 07 d6 04 95 31 16 bb c1 12 0e a0 06 c0 5a 8a 13 26 8f ac ef 08 53 1b 01 75 0f aa a6 67 34 a4 e3 e0 82 bf 8e d5 4e f7 cc 82 eb a8 9e 8c f6 80 55 28 79 c1 19 6c a1 1a d3 89 c9 77 3d d0 e8 a3 ba 5e 71 76 a2 9b 08 7f 7b 80 ad 7f 88 03 51 22 2c 79 2c 8d d3 ed c5 bd b4 18 2c 94 bc 22 6c 38 ab 42 65 e0 6c df 45 5b 2c a9 c5 39 b6 ec f0 09 d0 93 0b 53 0c 31 78 ed fc 68 55 21 c5 bf 7a 5a b0 8e 0c b5 53 e3 e0 51 ad 6f a5 b8 e4 2c bd 67 f9 db 0f d7 db 5e 6c Data Ascii: xmAO0Q.=A4SRj4$$?mNm=Ynp^l?/G\I1Z&Sug4NU(ylw=^qv{Q",y,,"l8BelE[,9S1xhU!zZSQo,g^l
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 02 Mar 2024 01:24:10 GMTServer: Apache/2.4.41 (Ubuntu)content-length: 91Cache-control: no-cacheContent-Type: application/x-compressedData Raw: 78 9c b3 b1 af c8 cd 51 28 4b 2d 2a ce cc cf b3 55 37 d4 33 50 57 48 cd 4b ce 4f c9 cc 4b b7 55 0f 0d 71 d3 b5 50 b7 b7 e3 b2 09 72 0d f0 89 b4 e3 52 50 00 b2 82 03 fc fd 82 5d ed fc fc e3 1d 9d 9d fd 43 fd 42 e2 43 03 5c 1c 43 5c 6d f4 e1 72 5c 20 36 58 07 00 84 71 1b 9f Data Ascii: xQ(K-*U73PWHKOKUqPrRP]CBC\C\mr\ 6Xq

Source: global traffic	HTTP traffic detected: GET /paginas/publicFiles/ocsoffice.exe HTTP/1.1User-Agent: AutoItHost: portal.fm2c.com.br
Source: global traffic	HTTP traffic detected: GET /paginas/publicFiles/ocsoffice.exe HTTP/1.1User-Agent: AutoItHost: portal.fm2c.com.brCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: portal.fm2c.com.br

Source: unknown

HTTP traffic detected: POST /ocsinventory HTTP/1.1Host: ti.fm2c.com.brUser-Agent: OCS-NG_WINDOWS_AGENT_v2.9.2.0Accept: */*Content-Type: application/x-compressedContent-Length: 131Data Raw: 78 9c b2 b1 af c8 cd 51 28 4b 2d 2a ce cc cf b3 55 32 d4 33 50 52 48 cd 4b ce 4f c9 cc 4b b7 55 0a 0d 71 d3 b5 50 52 b0 b7 e3 b2 09 72 0d 0c 75 0d 0e b1 e3 52 00 02 1b 17 d7 30 4f 67 57 4f 17 3b 43 13 43 73 03 03 5d 23 03 23 13 5d 03 63 5d 03 23 10 32 32 d6 35 36 b1 d1 87 2b 82 e8 71 f6 f7 0b 71 f5 0b 51 d0 87 f2 81 e6 05 45 da 05 04 f9 fb f8 bb db e8 43 78 5c 36 fa 70 8b 00 00 00 00 ff ff Data Ascii: xQ(K-*U23PRHKOKUqPRruR0OgWO;CCs]##]c]#2256+qqQECx\6p

Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: ocs-office.exe, 00000000.00000002.2304139728.000001814F7BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: OcsSetup.exe, OcsSetup.exe, 00000003.00000003.2251156729.0000000003081000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2263622193.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, OcsSetup.exe, 00000003.00000000.1724965818.000000000040A000.00000008.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: ocsoffice.exe, 00000001.00000000.1715229113.000000000040A000.00000008.00000001.01000000.00000006.sdmp, ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, instOCS.exe, 00000002.00000002.2267468052.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, instOCS.exe, 00000002.00000000.1719645772.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, OcsSetup.exe, 00000003.00000003.2251156729.0000000003081000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2263622193.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, OcsSetup.exe, 00000003.00000000.1724965818.000000000040A000.00000008.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 0000000F.00000002.2170659052.000001E49A993000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2170659052.000001E49A85C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2132643091.000001E48C21A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2383777401.000001E876498000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0J
Source: powershell.exe, 0000001C.00000002.2314383504.000001E866652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000F.00000002.2132643091.000001E48A7E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E866421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: OCSInventory.exe, 00000007.00000002.2029841410.000002017A067000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029801456.000002017A04D000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000003.2029066267.000002017BE40000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000003.2028921381.000002017BE40000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000003.2029009326.000002017BE40000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000003.2028890553.000002017BE40000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000003.2029308939.000002017A04D000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000003.2029037916.000002017BE40000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029815348.000002017A05C000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000003.2028855155.000002017BE40000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000003.2029094718.000002017BE40000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000003.2028952360.000002017BE40000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2189573505.000001D997780000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2190014242.000001D995967000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2058488335.000001D9972C0000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2191515474.000001D995968000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193358121.000001D995968000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2068845045.000001D997760000.00000004.00000800.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2189853413.000001D995947000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2189938683.000001D99595A000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2191316015.000001D995901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventory
Source: OCSInventory.exe, 00000007.00000002.2029715162.000002017A01C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventory/USER=/PWD=/SSL=1/CA=cacert.pem/PROXY_TYPE=0/PROXY=/PROXY_PORT=/PR
Source: OcsSetup.exe, 00000003.00000002.2263622193.0000000000427000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventory12ESS:
Source: instOCS.exe, 00000002.00000002.2267468052.0000000000432000.00000004.00000001.01000000.0000000A.sdmp, instOCS.exe, 00000002.00000002.2268280616.0000000000627000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventory:
Source: instOCS.exe, 00000002.00000002.2268994035.0000000002750000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2263994646.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264098954.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2263622193.000000000042A000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventoryC:
Source: OcsSetup.exe, 00000003.00000002.2263622193.0000000000427000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventoryERVER=http://ti.fm2c.com.br/ocsinventoryS/NP
Source: ocsoffice.exe, 00000001.00000002.2270342274.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventoryOCS
Source: OcsSetup.exe, 00000003.00000002.2263622193.0000000000425000.00000004.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventorySaturdayOSPLASH
Source: OCSInventory.exe, 00000008.00000003.2191316015.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193112052.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2191756385.000001D995901000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventory_
Source: OCSInventory.exe, 00000008.00000003.2191316015.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193112052.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2191756385.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410871338.000001EC3228A000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410952624.000001EC3229D000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410745267.000001EC3227F000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000002.2412303943.000001EC3229F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ti.fm2c.com.br/ocsinventorynt
Source: powershell.exe, 0000000F.00000002.2132643091.000001E48BFEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E867C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000001C.00000002.2314383504.000001E866652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.artpol-software.com
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, OCSInventory.exe, 00000007.00000002.2030907910.00007FFDFF305000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000007.00000002.2031285647.00007FFE126CE000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000007.00000002.2029620541.000000018000C000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000008.00000002.2192641356.000000018000C000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000008.00000002.2195653164.00007FFE126CE000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000008.00000002.2194956078.00007FFDFF305000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000011.00000002.2229893566.000000018000C000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000011.00000002.2232126021.00007FFE003D5000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000013.00000002.2905174952.000000018000C000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000013.00000002.2907782590.00007FFE003D5000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000016.00000002.2414899125.00007FFE126CE000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000016.00000002.2414282409.00007FFE003D5000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000016.00000002.2411803423.000000018000C000.00000002.00000001.01000000.0000001A.sdmp	String found in binary or memory: http://www.ocsinventory-ng.org
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ocsinventory-ng.org%s
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ocsinventory-ng.orgB
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsService.exe, 00000011.00000002.2230743470.00007FF6EED6E000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000000.2243916264.00007FF6EED6E000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: http://www.ocsinventory-ng.orgF
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029969363.00007FF7B4CA6000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000000.2057887829.00007FF7B4CA6000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000000.2249421655.00007FF7B4CA6000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.ocsinventory-ng.orgJ
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ocsinventory-ng.orgL
Source: OcsSetup.exe, 00000003.00000002.2263817012.0000000000473000.00000002.00000001.01000000.0000000D.sdmp, OcsSetup.exe, 00000003.00000003.2251156729.00000000030CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ocsinventory-ng.orgN
Source: OcsSetup.exe, 00000003.00000002.2264098954.0000000000621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ocsinventory-ng.orgPublisherOCS
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031437511.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000008.00000002.2196531442.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000011.00000002.2232416874.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000013.00000002.2908113490.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000016.00000002.2415223849.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.ocsinventory-ng.orgV
Source: OCSInventory.exe	String found in binary or memory: http://www.openssl.org/
Source: OCSInventory.exe, 00000007.00000002.2031213190.00007FFE0E188000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000007.00000002.2030196745.00007FFDFB541000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2194128263.00007FFDFB541000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2195516634.00007FFE0E188000.00000002.00000001.01000000.00000020.sdmp, OcsService.exe, 00000011.00000002.2231779010.00007FFDFBAB1000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907418466.00007FFDFBAB1000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413908506.00007FFDFBAB1000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2414740326.00007FFE0E188000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: OCSInventory.exe, OCSInventory.exe, 00000007.00000002.2030156695.00007FFDFB501000.00000008.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2194043876.00007FFDFB510000.00000004.00000001.01000000.00000018.sdmp, OcsService.exe, 00000011.00000002.2231710053.00007FFDFBA70000.00000008.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907341902.00007FFDFBA71000.00000008.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413829529.00007FFDFBA80000.00000004.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: OCSInventory.exe, 00000007.00000002.2030156695.00007FFDFB501000.00000008.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2194043876.00007FFDFB510000.00000004.00000001.01000000.00000018.sdmp, OcsService.exe, 00000011.00000002.2231710053.00007FFDFBA70000.00000008.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907341902.00007FFDFBA71000.00000008.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413829529.00007FFDFBA80000.00000004.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html.
Source: OCSInventory.exe	String found in binary or memory: http://www.zlib.net/
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029556525.0000000066716000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000008.00000002.2192340700.0000000066716000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000011.00000002.2229759988.0000000066716000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000013.00000002.2904997429.0000000066716000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000016.00000002.2411679589.0000000066716000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: powershell.exe, 0000000F.00000002.2132643091.000001E48A7E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E866421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: OCSInventory.exe	String found in binary or memory: https://curl.haxx.se/
Source: OCSInventory.exe, 00000007.00000002.2031113260.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000008.00000002.2195277999.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000016.00000002.2414471242.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: https://curl.haxx.se/V
Source: OCSInventory.exe	String found in binary or memory: https://curl.haxx.se/docs/copyright.html
Source: OCSInventory.exe, 00000007.00000002.2031113260.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000008.00000002.2195277999.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000016.00000002.2414471242.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: OCSInventory.exe, OCSInventory.exe, 00000007.00000002.2031076819.00007FFE0CFD1000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000008.00000002.2195219918.00007FFE0CFD1000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000016.00000002.2414413188.00007FFE0CFD1000.00000002.00000001.01000000.0000001F.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: powershell.exe, 0000001C.00000002.2314383504.000001E866652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000F.00000002.2132643091.000001E48B412000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E867052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000F.00000002.2170659052.000001E49A993000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2170659052.000001E49A85C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2132643091.000001E48C21A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2383777401.000001E876498000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000F.00000002.2132643091.000001E48BFEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E867C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 0000000F.00000002.2132643091.000001E48BFEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E867C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: ocs-office.exe, 00000000.00000003.2302497939.000001814F495000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303355822.000001814F496000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2302157006.000001814F492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/
Source: ocs-office.exe, 00000000.00000002.2304139728.000001814F7BB000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2302157006.000001814F492000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303990987.000001814F73D000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299557988.000001814F65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe
Source: ocs-office.exe, 00000000.00000002.2304139728.000001814F7BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe%
Source: ocs-office.exe, 00000000.00000002.2304139728.000001814F7BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe8
Source: ocs-office.exe, 00000000.00000003.2299749862.000001814F663000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303809041.000001814F673000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299633468.000001814F65D000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299557988.000001814F65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeE%
Source: ocs-office.exe, 00000000.00000003.2302497939.000001814F495000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303355822.000001814F496000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2302157006.000001814F492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeH
Source: ocs-office.exe, 00000000.00000003.2302497939.000001814F495000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303355822.000001814F496000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2302157006.000001814F492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeQ
Source: ocs-office.exe, 00000000.00000002.2304139728.000001814F7BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeS
Source: ocs-office.exe, 00000000.00000002.2303990987.000001814F73D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeexe
Source: ocs-office.exe, 00000000.00000003.2299749862.000001814F663000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303809041.000001814F673000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299633468.000001814F65D000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299557988.000001814F65B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exet
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: unknown	HTTPS traffic detected: 119.8.87.215:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.87.215:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB10D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00007FF78EB10D24

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB10D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00007FF78EB10D24

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB10A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00007FF78EB10A6C

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAF9034 GetParent,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,PostMessageW,PostMessageW,

0_2_00007FF78EAF9034

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00007FF78EA837B0
Source: ocs-office.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: ocs-office.exe, 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1a619d8c-4
Source: ocs-office.exe, 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_9d080eef-1

Writes or reads registry keys via WMI

Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\System32\cscript.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAFBF80: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00007FF78EAFBF80

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAECE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00007FF78EAECE68

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAFD750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_00007FF78EAFD750
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_0040326B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	1_2_0040326B
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_0040326B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	2_2_0040326B
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Code function: 3_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	3_2_00403461

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_yde5xl00.tis.ps1

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA92E30	0_2_00007FF78EA92E30
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAC2400	0_2_00007FF78EAC2400
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB1F630	0_2_00007FF78EB1F630
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB132AC	0_2_00007FF78EB132AC
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAB30DC	0_2_00007FF78EAB30DC
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAC6DE4	0_2_00007FF78EAC6DE4
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAC2D20	0_2_00007FF78EAC2D20
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB2CE8C	0_2_00007FF78EB2CE8C
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAA0E90	0_2_00007FF78EAA0E90
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA90E70	0_2_00007FF78EA90E70
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB16C34	0_2_00007FF78EB16C34
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB20AEC	0_2_00007FF78EB20AEC
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA82AE0	0_2_00007FF78EA82AE0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAC67F0	0_2_00007FF78EAC67F0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EABA8A0	0_2_00007FF78EABA8A0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB2A59C	0_2_00007FF78EB2A59C
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB2055C	0_2_00007FF78EB2055C
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB2C6D4	0_2_00007FF78EB2C6D4
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAAC3FC	0_2_00007FF78EAAC3FC
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB083D4	0_2_00007FF78EB083D4
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB18360	0_2_00007FF78EB18360
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB16320	0_2_00007FF78EB16320
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAB84C0	0_2_00007FF78EAB84C0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAA4514	0_2_00007FF78EAA4514
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAAC130	0_2_00007FF78EAAC130
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAA02C4	0_2_00007FF78EAA02C4
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA85F3C	0_2_00007FF78EA85F3C
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB1206C	0_2_00007FF78EB1206C
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAABEB4	0_2_00007FF78EAABEB4
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA8BE70	0_2_00007FF78EA8BE70
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB2DB18	0_2_00007FF78EB2DB18
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA93C20	0_2_00007FF78EA93C20
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB2BA0C	0_2_00007FF78EB2BA0C
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA8B9F0	0_2_00007FF78EA8B9F0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAB793C	0_2_00007FF78EAB793C
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA9FA4F	0_2_00007FF78EA9FA4F
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB01A18	0_2_00007FF78EB01A18
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB317C0	0_2_00007FF78EB317C0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAB1750	0_2_00007FF78EAB1750
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA958D0	0_2_00007FF78EA958D0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAAF8D0	0_2_00007FF78EAAF8D0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA8183C	0_2_00007FF78EA8183C
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAC1840	0_2_00007FF78EAC1840
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAFD87C	0_2_00007FF78EAFD87C
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAB95B0	0_2_00007FF78EAB95B0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB156A0	0_2_00007FF78EB156A0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EA8B390	0_2_00007FF78EA8B390
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAC529C	0_2_00007FF78EAC529C
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_00406FC4	1_2_00406FC4
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_004067ED	1_2_004067ED
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_00406FC4	2_2_00406FC4
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_004067ED	2_2_004067ED
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Code function: 3_2_00406925	3_2_00406925
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_66702850	7_2_66702850
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_66708413	7_2_66708413
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_66707EFC	7_2_66707EFC
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_66707D79	7_2_66707D79
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_66701560	7_2_66701560
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_66706F55	7_2_66706F55
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_6670871E	7_2_6670871E
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_667019E0	7_2_667019E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_6670BDB0	7_2_6670BDB0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00000001800031F3	7_2_00000001800031F3
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FF7B4C363F0	7_2_00007FF7B4C363F0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FF7B4C34140	7_2_00007FF7B4C34140
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CFBAB	7_2_00007FFDFB3CFBAB
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3E9BC0	7_2_00007FFDFB3E9BC0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CBB70	7_2_00007FFDFB3CBB70
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DFB90	7_2_00007FFDFB3DFB90
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3B7C40	7_2_00007FFDFB3B7C40
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3EFBE0	7_2_00007FFDFB3EFBE0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C5AA4	7_2_00007FFDFB3C5AA4
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CBA6A	7_2_00007FFDFB3CBA6A
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C7B4C	7_2_00007FFDFB3C7B4C
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DBAE0	7_2_00007FFDFB3DBAE0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C79A0	7_2_00007FFDFB3C79A0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C596D	7_2_00007FFDFB3C596D
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C3A50	7_2_00007FFDFB3C3A50
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB4859E0	7_2_00007FFDFB4859E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CF9F0	7_2_00007FFDFB3CF9F0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D58B0	7_2_00007FFDFB3D58B0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3F58C0	7_2_00007FFDFB3F58C0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DB8C0	7_2_00007FFDFB3DB8C0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3EF870	7_2_00007FFDFB3EF870
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CD930	7_2_00007FFDFB3CD930
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CDFC0	7_2_00007FFDFB3CDFC0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB423F90	7_2_00007FFDFB423F90
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB476030	7_2_00007FFDFB476030
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DA020	7_2_00007FFDFB3DA020
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB431EC0	7_2_00007FFDFB431EC0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3EFE90	7_2_00007FFDFB3EFE90
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CFF40	7_2_00007FFDFB3CFF40
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB431EE0	7_2_00007FFDFB431EE0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C9F0B	7_2_00007FFDFB3C9F0B
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C3F00	7_2_00007FFDFB3C3F00
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3F5F00	7_2_00007FFDFB3F5F00
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C7D9B	7_2_00007FFDFB3C7D9B
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB45DD80	7_2_00007FFDFB45DD80
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CDD90	7_2_00007FFDFB3CDD90
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CFE3A	7_2_00007FFDFB3CFE3A
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3E9E30	7_2_00007FFDFB3E9E30
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DBDF0	7_2_00007FFDFB3DBDF0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C5E10	7_2_00007FFDFB3C5E10
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C5CB0	7_2_00007FFDFB3C5CB0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C3C80	7_2_00007FFDFB3C3C80
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DFC90	7_2_00007FFDFB3DFC90
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB411D30	7_2_00007FFDFB411D30
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C9D50	7_2_00007FFDFB3C9D50
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D1D50	7_2_00007FFDFB3D1D50
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3EDD00	7_2_00007FFDFB3EDD00
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D9D00	7_2_00007FFDFB3D9D00
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D13A0	7_2_00007FFDFB3D13A0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CD3CA	7_2_00007FFDFB3CD3CA
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3BF3D0	7_2_00007FFDFB3BF3D0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB48F370	7_2_00007FFDFB48F370
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3F5420	7_2_00007FFDFB3F5420
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB4253E0	7_2_00007FFDFB4253E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3E7410	7_2_00007FFDFB3E7410
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3B92D0	7_2_00007FFDFB3B92D0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB461270	7_2_00007FFDFB461270
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DB350	7_2_00007FFDFB3DB350
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C71C0	7_2_00007FFDFB3C71C0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C91D3	7_2_00007FFDFB3C91D3
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DB1E0	7_2_00007FFDFB3DB1E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CB1F0	7_2_00007FFDFB3CB1F0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB483210	7_2_00007FFDFB483210
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D9090	7_2_00007FFDFB3D9090
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CD13B	7_2_00007FFDFB3CD13B
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3B7110	7_2_00007FFDFB3B7110
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CB7DB	7_2_00007FFDFB3CB7DB
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D97D0	7_2_00007FFDFB3D97D0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D1760	7_2_00007FFDFB3D1760
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C7840	7_2_00007FFDFB3C7840
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB437840	7_2_00007FFDFB437840
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB40D680	7_2_00007FFDFB40D680
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB45D730	7_2_00007FFDFB45D730
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C5730	7_2_00007FFDFB3C5730
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D3740	7_2_00007FFDFB3D3740
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DB6E0	7_2_00007FFDFB3DB6E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3E76F0	7_2_00007FFDFB3E76F0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3ED5B0	7_2_00007FFDFB3ED5B0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3EF580	7_2_00007FFDFB3EF580
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CB620	7_2_00007FFDFB3CB620
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB483610	7_2_00007FFDFB483610
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB46D4A0	7_2_00007FFDFB46D4A0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CD4D0	7_2_00007FFDFB3CD4D0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3FB460	7_2_00007FFDFB3FB460
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DF460	7_2_00007FFDFB3DF460
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C3490	7_2_00007FFDFB3C3490
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D9530	7_2_00007FFDFB3D9530
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C5550	7_2_00007FFDFB3C5550
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DB550	7_2_00007FFDFB3DB550
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D7550	7_2_00007FFDFB3D7550
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB48CB70	7_2_00007FFDFB48CB70
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3BEC50	7_2_00007FFDFB3BEC50
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB45CBF0	7_2_00007FFDFB45CBF0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3FABE0	7_2_00007FFDFB3FABE0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3F0AA0	7_2_00007FFDFB3F0AA0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3F4A90	7_2_00007FFDFB3F4A90
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D0B20	7_2_00007FFDFB3D0B20
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB43AB10	7_2_00007FFDFB43AB10
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C8B11	7_2_00007FFDFB3C8B11
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D89C0	7_2_00007FFDFB3D89C0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C6A50	7_2_00007FFDFB3C6A50
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C6A08	7_2_00007FFDFB3C6A08
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3E28A0	7_2_00007FFDFB3E28A0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB4908C0	7_2_00007FFDFB4908C0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C8861	7_2_00007FFDFB3C8861
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CA950	7_2_00007FFDFB3CA950
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C6951	7_2_00007FFDFB3C6951
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DA8E0	7_2_00007FFDFB3DA8E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB49E8E0	7_2_00007FFDFB49E8E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D08F0	7_2_00007FFDFB3D08F0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C8F7C	7_2_00007FFDFB3C8F7C
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CCF80	7_2_00007FFDFB3CCF80
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3F3020	7_2_00007FFDFB3F3020
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DB020	7_2_00007FFDFB3DB020
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB43EFF0	7_2_00007FFDFB43EFF0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB47EEC0	7_2_00007FFDFB47EEC0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB452EC0	7_2_00007FFDFB452EC0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D4E70	7_2_00007FFDFB3D4E70
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C0EF0	7_2_00007FFDFB3C0EF0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D0F10	7_2_00007FFDFB3D0F10
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB48ADC0	7_2_00007FFDFB48ADC0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3BAD70	7_2_00007FFDFB3BAD70
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C8E20	7_2_00007FFDFB3C8E20
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3F4E40	7_2_00007FFDFB3F4E40
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3B6E50	7_2_00007FFDFB3B6E50
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C4DDF	7_2_00007FFDFB3C4DDF
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C4DF0	7_2_00007FFDFB3C4DF0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DEE00	7_2_00007FFDFB3DEE00
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3EECD0	7_2_00007FFDFB3EECD0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C2C70	7_2_00007FFDFB3C2C70
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D0D20	7_2_00007FFDFB3D0D20
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DAD40	7_2_00007FFDFB3DAD40
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C63C0	7_2_00007FFDFB3C63C0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CC370	7_2_00007FFDFB3CC370
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB424430	7_2_00007FFDFB424430
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3EE420	7_2_00007FFDFB3EE420
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D0420	7_2_00007FFDFB3D0420
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB424410	7_2_00007FFDFB424410
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3E2400	7_2_00007FFDFB3E2400
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3B62B0	7_2_00007FFDFB3B62B0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C82B0	7_2_00007FFDFB3C82B0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB476270	7_2_00007FFDFB476270
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB476264	7_2_00007FFDFB476264
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB476282	7_2_00007FFDFB476282
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB47627F	7_2_00007FFDFB47627F
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB482330	7_2_00007FFDFB482330
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DA2E0	7_2_00007FFDFB3DA2E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB4981D0	7_2_00007FFDFB4981D0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D8170	7_2_00007FFDFB3D8170
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CA196	7_2_00007FFDFB3CA196
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB49E240	7_2_00007FFDFB49E240
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DC250	7_2_00007FFDFB3DC250
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB41E1E0	7_2_00007FFDFB41E1E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DE200	7_2_00007FFDFB3DE200
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D80A0	7_2_00007FFDFB3D80A0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB48A0A0	7_2_00007FFDFB48A0A0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D4090	7_2_00007FFDFB3D4090
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3E6130	7_2_00007FFDFB3E6130
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C40E0	7_2_00007FFDFB3C40E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CA770	7_2_00007FFDFB3CA770
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB43A780	7_2_00007FFDFB43A780
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D8750	7_2_00007FFDFB3D8750
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C66F2	7_2_00007FFDFB3C66F2
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3BC700	7_2_00007FFDFB3BC700
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D6700	7_2_00007FFDFB3D6700
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CC5A0	7_2_00007FFDFB3CC5A0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3B65B0	7_2_00007FFDFB3B65B0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C85C0	7_2_00007FFDFB3C85C0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3D25E0	7_2_00007FFDFB3D25E0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C45EE	7_2_00007FFDFB3C45EE
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DA610	7_2_00007FFDFB3DA610
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3DC4D0	7_2_00007FFDFB3DC4D0
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3C6520	7_2_00007FFDFB3C6520
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB444520	7_2_00007FFDFB444520
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3CA540	7_2_00007FFDFB3CA540

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: String function: 00007FF78EAA8D58 appears 76 times
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: String function: 00007FFDFB3B2A20 appears 54 times
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: String function: 00007FFDFB426620 appears 47 times
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: String function: 00007FFDFB41D140 appears 169 times
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: String function: 00007FFDFB3B2D40 appears 339 times
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: String function: 00007FFDFB3B1AB0 appears 54 times
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: String function: 00007FFDFB3B2140 appears 205 times
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: String function: 00007FFDFB4A7470 appears 2081 times
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: String function: 00007FFDFB428210 appears 39 times
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: String function: 00007FFDFB4279D0 appears 905 times

Source: ocs-office.exe, 00000000.00000003.2300666556.000001814F505000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs ocs-office.exe
Source: ocs-office.exe, 00000000.00000003.2301803097.000001814F50A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs ocs-office.exe
Source: ocs-office.exe, 00000000.00000003.2300837185.000001814F4D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FV_ORIGINALFILENAMERT vs ocs-office.exe
Source: ocs-office.exe, 00000000.00000003.2301494982.000001814F508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs ocs-office.exe
Source: ocs-office.exe, 00000000.00000003.1633738226.000001814F464000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FV_ORIGINALFILENAMERT vs ocs-office.exe
Source: ocs-office.exe, 00000000.00000003.1633738226.000001814F464000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs ocs-office.exe
Source: ocs-office.exe, 00000000.00000003.2302212127.000001814F47B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FV_ORIGINALFILENAME vs ocs-office.exe
Source: ocs-office.exe, 00000000.00000003.2300925550.000001814F4EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FV_ORIGINALFILENAMERT vs ocs-office.exe

Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ocsinventory front.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: sysinfo.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mfc140u.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ocswmi.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mfc140u.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mfc140u.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: libcurl.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ssleay32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ocsinventory front.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: sysinfo.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mfc140u.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: libeay32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ocswmi.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: libcurl.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ssleay32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: apphelp.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: libeay32.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: ocsinventory front.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: sysinfo.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: mfc140u.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: zlib1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: userenv.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: sysinfo.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: mfc140u.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: ocswmi.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: msvcp140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: version.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: mpr.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: wldp.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: profapi.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: libeay32.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: ocsinventory front.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: sysinfo.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: mfc140u.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: zlib1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: userenv.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: sysinfo.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: mfc140u.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: ocswmi.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: mfc140u.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: msvcp140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: version.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: mpr.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: wldp.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: profapi.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: netapi32.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: netutils.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: wkscli.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: srvcli.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: amsi.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Section loaded: mswsock.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wsock32.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ocsinventory front.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: sysinfo.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mfc140u.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: msvcp140.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: vcruntime140_1.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: libeay32.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: zlib1.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ocswmi.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: libeay32.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: version.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: userenv.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mpr.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wldp.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: profapi.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: libcurl.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ssleay32.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: amsi.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: secur32.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: sspicli.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: mswsock.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: devobj.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: msasn1.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: napinsp.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: wshbth.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: nlaapi.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: winrnr.dll
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\cscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll

Source: classification engine

Classification label: mal100.evad.winEXE@44/69@2/2

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB03778 GetLastError,FormatMessageW,

0_2_00007FF78EB03778

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAECCE0 AdjustTokenPrivileges,CloseHandle,	0_2_00007FF78EAECCE0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAED5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00007FF78EAED5CC
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_0040326B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	1_2_0040326B
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_0040326B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	2_2_0040326B
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Code function: 3_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	3_2_00403461

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB059D8 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_00007FF78EB059D8

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAFBE00 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00007FF78EAFBE00

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB06D04 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00007FF78EB06D04

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EA86580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00007FF78EA86580

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe

File created: C:\Program Files\OCS Inventory Agent

Jump to behavior

Source: C:\Users\user\Desktop\ocs-office.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ocsoffice[1].exe

Jump to behavior

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Mutant created: \Sessions\1\BaseNamedObjects\OCSINVENTORY-088FA840-B10D-11D3-BC36-006067709674
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Mutant created: \BaseNamedObjects\OCSSERVICE-088FA840-B10D-11D3-BC36-006067709674
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5268:120:WilError_03
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Mutant created: \BaseNamedObjects\OCSINVENTORY-088FA840-B10D-11D3-BC36-006067709674
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Mutant created: \Sessions\1\BaseNamedObjects\instOCSNG
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3672:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\OcsSetup
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4080:120:WilError_03

Source: C:\Users\user\Downloads\ocsoffice.exe

File created: C:\Users\user\AppData\Local\Temp\nsb5C55.tmp

Jump to behavior

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs

Source: ocs-office.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Downloads\ocsoffice.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ocs-office.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ocs-office.exe

Virustotal: Detection: 11%

Source: OCSInventory.exe	String found in binary or memory: <LAUNCH_BTN> <SIZE>15, 14</SIZE> <CORNERS>2, 2, 2, 2</CORNERS> </LAUNCH_BTN> <LAUNCH_ICON> <SIZE>8, 8</SIZE> </LAUNCH_ICON> <TextNormal>115, 131, 153</TextNormal> <TextHighlighted>115, 131, 153</TextHighlighted>
Source: OCSInventory.exe	String found in binary or memory: TTOM> <SIZE>100, 17</SIZE> <CORNERS>3, 0, 4, 4</CORNERS> </BOTTOM> </BACK> <CAPTION> <LAUNCH_BTN> <SIZE>15, 14</SIZE> <CORNERS>2, 2, 2, 2</CORNERS> </LAUNCH_BTN> <LAUNCH_ICON> <SIZE>8, 8</SIZE> </L
Source: OCSInventory.exe	String found in binary or memory: <CORNERS>2, 0, 2, 16</CORNERS> </BOTTOM> </BACK> <CAPTION> <LAUNCH_ICON> <SIZE>12, 12</SIZE> </LAUNCH_ICON> <TextNormal>255, 255, 255</TextNormal> <TextHighlighted>255, 255, 255</TextHighlighted> </CAPTION> <S
Source: OCSInventory.exe	String found in binary or memory: <SIZE>15, 14</SIZE> <CORNERS>2, 2, 2, 2</CORNERS> </LAUNCH_BTN> <LAUNCH_ICON> <SIZE>8, 8</SIZE> </LAUNCH_ICON> <TextNormal>83, 84, 89</TextNormal> <TextHighlighted>83, 84, 89</TextHighlighted> </CAPTION> <SEPA
Source: OCSInventory.exe	String found in binary or memory: SIZE>100, 17</SIZE> <CORNERS>3, 0, 4, 4</CORNERS> </BOTTOM> </BACK> <CAPTION> <LAUNCH_BTN> <SIZE>15, 14</SIZE> <CORNERS>2, 2, 2, 2</CORNERS> </LAUNCH_BTN> <LAUNCH_ICON> <SIZE>8, 8</SIZE> </LAUNCH_ICON>

Source: unknown	Process created: C:\Users\user\Desktop\ocs-office.exe C:\Users\user\Desktop\ocs-office.exe
Source: C:\Users\user\Desktop\ocs-office.exe	Process created: C:\Users\user\Downloads\ocsoffice.exe C:\Users\user\Downloads\ocsoffice.exe
Source: C:\Users\user\Downloads\ocsoffice.exe	Process created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe instocs.exe
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Process created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe "C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe" /S /NP /NOSPLASH /NO_SYSTRAY /NOW /TAG="office" /SERVER=http://ti.fm2c.com.br/ocsinventory
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe "C:\Program Files\OCS Inventory Agent\ocsinventory.exe" /SAVE_CONF /SERVER=http://ti.fm2c.com.br/ocsinventory /USER= /PWD= /SSL=1 /CA="cacert.pem" /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG="office" /WMI_FLAG_MODE="COMPLETE" /DEFAULT_USER_DOMAIN="" /NO_SYSTRAY
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs"
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /displaydns
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OcsService.exe "C:\Program Files\OCS Inventory Agent\OcsService.exe" -install
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\OCS Inventory Agent\OcsService.exe C:\Program Files\OCS Inventory Agent\OcsService.exe
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c "C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs"
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /displaydns
Source: C:\Users\user\Desktop\ocs-office.exe	Process created: C:\Users\user\Downloads\ocsoffice.exe C:\Users\user\Downloads\ocsoffice.exe	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Process created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe instocs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Process created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe "C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe" /S /NP /NOSPLASH /NO_SYSTRAY /NOW /TAG="office" /SERVER=http://ti.fm2c.com.br/ocsinventory	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe "C:\Program Files\OCS Inventory Agent\ocsinventory.exe" /SAVE_CONF /SERVER=http://ti.fm2c.com.br/ocsinventory /USER= /PWD= /SSL=1 /CA="cacert.pem" /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG="office" /WMI_FLAG_MODE="COMPLETE" /DEFAULT_USER_DOMAIN="" /NO_SYSTRAY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe C:\Program Files\OCS Inventory Agent\ocsinventory.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OcsService.exe "C:\Program Files\OCS Inventory Agent\OcsService.exe" -install	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /displaydns
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c "C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /displaydns

Source: C:\Users\user\Desktop\ocs-office.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Downloads\ocsoffice.exe

File written: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\ocsdat.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Directory created: C:\Program Files\OCS Inventory Agent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Directory created: C:\Program Files\OCS Inventory Agent\Plugins	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Directory created: C:\Program Files\OCS Inventory Agent\Plugins\DO_NOT_REMOVE.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Directory created: C:\Program Files\OCS Inventory Agent\Plugins\o36516user.vbs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\libcurl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\libeay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\ssleay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\msvcr120.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\mfc140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\mfc140u.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\mfcm140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\mfcm140u.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\vcomp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\vcamp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\ucrtbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\ZipArchive.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\zlib1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\ComHTTP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OcsWmi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\SysInfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OCSInventory Front.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\Download.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OcsService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OcsSystray.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OcsNotifyUser.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\OCS-transform.xsl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\Plugins\Saas.ps1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Directory created: C:\Program Files\OCS Inventory Agent\uninst.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OCS Inventory NG Agent

Jump to behavior

Source: ocs-office.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ocs-office.exe

Static file information: File size 1166336 > 1048576

Source: ocs-office.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ocs-office.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ocs-office.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ocs-office.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ocs-office.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ocs-office.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ocs-office.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ocs-office.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\openssl-1.0.2r\out32dll\ssleay32.pdb source: OCSInventory.exe, 00000007.00000002.2031169967.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000008.00000002.2195385269.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000016.00000002.2414567170.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\MFCM140U.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcamp140.amd64.pdbGCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsNotifyUser.pdb883GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsService.pdb--)GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsService.exe, 00000011.00000002.2230690850.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000011.00000000.2223938644.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000000.2243858108.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000002.2906285996.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\openssl-1.0.2r\out32dll\libeay32.pdba source: OCSInventory.exe, 00000007.00000002.2030109278.00007FFDFB4A9000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2193943425.00007FFDFB4A9000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000011.00000002.2231658880.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907261387.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413735788.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\MFCM140.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OCSInventory Front.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031403378.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000008.00000002.2196356994.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000011.00000002.2232355200.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000013.00000002.2908044221.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000016.00000002.2415168665.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: OCSInventory.exe, 00000007.00000002.2030509014.00007FFDFB834000.00000002.00000001.01000000.00000019.sdmp, OCSInventory.exe, 00000008.00000002.2194438887.00007FFDFB834000.00000002.00000001.01000000.00000019.sdmp, OcsService.exe, 00000011.00000002.2231151082.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp, OcsService.exe, 00000013.00000002.2906769234.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp, OCSInventory.exe, 00000016.00000002.2413114558.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsWmi.pdb))'GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029595116.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000008.00000002.2192512504.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000011.00000002.2229840960.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000013.00000002.2905102277.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000016.00000002.2411751483.0000000180007000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\openssl-1.0.2r\out32dll\libeay32.pdb source: OCSInventory.exe, 00000007.00000002.2030109278.00007FFDFB4A9000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2193943425.00007FFDFB4A9000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000011.00000002.2231658880.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907261387.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413735788.00007FFDFBA19000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsSystray.pdb::3GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OCSInventory.pdb55,GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000000.2027408654.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000007.00000002.2029941666.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000002.2193694096.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000000.2057861583.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000000.2249360801.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000002.2412776468.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\openssl-1.0.2r\out32dll\ssleay32.pdbFF source: OCSInventory.exe, 00000007.00000002.2031169967.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000008.00000002.2195385269.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000016.00000002.2414567170.00007FFE0E16D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OCSInventory.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000000.2027408654.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000007.00000002.2029941666.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000002.2193694096.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000000.2057861583.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000000.2249360801.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000002.2412776468.00007FF7B4C3C000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\zlib-1.2.8\zlib1.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029529385.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000008.00000002.2192290265.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000011.00000002.2229660959.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000013.00000002.2904927334.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000016.00000002.2411630185.000000006670E000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\Download.pdb//+GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcamp140.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: OCSInventory.exe, 00000007.00000002.2030509014.00007FFDFB834000.00000002.00000001.01000000.00000019.sdmp, OCSInventory.exe, 00000008.00000002.2194438887.00007FFDFB834000.00000002.00000001.01000000.00000019.sdmp, OcsService.exe, 00000011.00000002.2231151082.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp, OcsService.exe, 00000013.00000002.2906769234.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp, OCSInventory.exe, 00000016.00000002.2413114558.00007FFDFB684000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\ComHTTP.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031254054.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000008.00000002.2195594617.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000016.00000002.2414823583.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\SysInfo.pdbWW#GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2030862261.00007FFDFF2BB000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000008.00000002.2194884273.00007FFDFF2BB000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000011.00000002.2232054370.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000013.00000002.2907707881.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000016.00000002.2414173406.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsWmi.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029595116.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000008.00000002.2192512504.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000011.00000002.2229840960.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000013.00000002.2905102277.0000000180007000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000016.00000002.2411751483.0000000180007000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsSystray.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\SysInfo.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2030862261.00007FFDFF2BB000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000008.00000002.2194884273.00007FFDFF2BB000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000011.00000002.2232054370.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000013.00000002.2907707881.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000016.00000002.2414173406.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031330447.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp, OCSInventory.exe, 00000008.00000002.2195863861.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp, OcsService.exe, 00000011.00000002.2232211869.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp, OcsService.exe, 00000013.00000002.2907881081.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp, OCSInventory.exe, 00000016.00000002.2414992126.00007FFE126F1000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsService.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsService.exe, 00000011.00000002.2230690850.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000011.00000000.2223938644.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000000.2243858108.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000002.2906285996.00007FF6EED67000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\ZipArchive\x64\Release Unicode STL MD DLL\ZipArchive.pdbSS GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcomp140.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OcsNotifyUser.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\zlib-1.2.8\zlib1.pdb## source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029529385.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000008.00000002.2192290265.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000011.00000002.2229660959.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000013.00000002.2904927334.000000006670E000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000016.00000002.2411630185.000000006670E000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\ComHTTP.pdb''"GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031254054.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000008.00000002.2195594617.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000016.00000002.2414823583.00007FFE126C7000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\External_Deps\ZipArchive\x64\Release Unicode STL MD DLL\ZipArchive.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\OCSInventory Front.pdbKK(GCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031403378.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000008.00000002.2196356994.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000011.00000002.2232355200.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000013.00000002.2908044221.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000016.00000002.2415168665.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\Users\charl\Documents\GitHub\WindowsAgent64\Release\Download.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcomp140.amd64.pdbGCTL source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031477967.00007FFE13315000.00000002.00000001.01000000.0000001C.sdmp, OCSInventory.exe, 00000008.00000002.2196757713.00007FFE13315000.00000002.00000001.01000000.0000001C.sdmp, OcsService.exe, 00000011.00000002.2232501460.00007FFE1A475000.00000002.00000001.01000000.0000001C.sdmp, OcsService.exe, 00000013.00000002.2908212378.00007FFE1A475000.00000002.00000001.01000000.0000001C.sdmp, OCSInventory.exe, 00000016.00000002.2415294839.00007FFE1A475000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: OCSInventory.exe, 00000007.00000002.2030972028.00007FFE002D5000.00000002.00000001.01000000.0000001B.sdmp, OCSInventory.exe, 00000008.00000002.2195052215.00007FFE002D5000.00000002.00000001.01000000.0000001B.sdmp, OcsService.exe, 00000011.00000002.2231886839.00007FFE00305000.00000002.00000001.01000000.0000001B.sdmp, OcsService.exe, 00000013.00000002.2907530308.00007FFE00305000.00000002.00000001.01000000.0000001B.sdmp, OCSInventory.exe, 00000016.00000002.2414004919.00007FFE00305000.00000002.00000001.01000000.0000001B.sdmp

Source: ocs-office.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ocs-office.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ocs-office.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ocs-office.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ocs-office.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: ucrtbase.dll.3.dr

Static PE information: 0xBBF7FB0E [Fri Dec 6 21:30:54 2069 UTC]

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB1AF20 LoadLibraryA,GetProcAddress,

0_2_00007FF78EB1AF20

Source: services.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x561f
Source: instOCS.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x746c5
Source: KillProcDLL.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0xad9e
Source: nsExec.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x2c08
Source: uninst.exe.3.dr	Static PE information: real checksum: 0x5ad785 should be: 0x7386f
Source: System.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0xd8f8
Source: System.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0xdd14
Source: ocsoffice.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x5f7e3c
Source: System.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0xd8f8
Source: UserInfo.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x1e00
Source: UserInfo.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x67f6
Source: ocsoffice[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x5f7e3c

Source: mfc140.dll.3.dr	Static PE information: section name: .didat
Source: mfc140u.dll.3.dr	Static PE information: section name: .didat
Source: mfcm140.dll.3.dr	Static PE information: section name: .nep
Source: mfcm140u.dll.3.dr	Static PE information: section name: .nep
Source: vcruntime140.dll.3.dr	Static PE information: section name: _RDATA
Source: vcomp140.dll.3.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAB78FD push rdi; ret	0_2_00007FF78EAB7904
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAB7399 push rdi; ret	0_2_00007FF78EAB73A2
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB405F71 push rcx; ret	7_2_00007FFDFB405F72
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB460DE2 push rcx; ret	7_2_00007FFDFB460DE3
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB406111 push rcx; ret	7_2_00007FFDFB406112

Source: msvcr120.dll.3.dr

Static PE information: section name: .text entropy: 6.9566713846558015

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /displaydns

Source: C:\Users\user\Desktop\ocs-office.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ocsoffice[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\OcsService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\vcomp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\libeay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\OCSInventory Front.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\OcsSystray.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\Download.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\vcamp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\KillProcDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\OcsWmi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ocs-office.exe	File created: C:\Users\user\Downloads\ocsoffice.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\OcsNotifyUser.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\SetACL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Downloads\ocsoffice.exe	File created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\ssleay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\mfcm140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\ZipArchive.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\services.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\mfc140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\mfcm140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Downloads\ocsoffice.exe	File created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\libcurl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File created: C:\Users\user\AppData\Local\Temp\nsm5E69.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\SysInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\uninst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Program Files\OCS Inventory Agent\ComHTTP.dll	Jump to dropped file
Source: C:\Users\user\Downloads\ocsoffice.exe	File created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\Downloads\ocsoffice.exe	File created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\System.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe

File created: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OCS-Windows-Agent-Setup-x64.log

Jump to behavior

Source: C:\Program Files\OCS Inventory Agent\OcsService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\OCS Inventory Service

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAA4514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00007FF78EAA4514

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe

Code function: 7_2_00007FFDFB4253E0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

7_2_00007FFDFB4253E0

Source: C:\Users\user\Desktop\ocs-office.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ocs-office.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ocs-office.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\ocsoffice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PhysicalMemoryArray
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PhysicalMemoryArray

Queries pointing device information (via WMI, Win32_PointingDevice, often done to detect virtual machines)

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PointingDevice
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PointingDevice

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_DiskDrive
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PhysicalMemoryArray
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_PhysicalMemoryArray

Queries sensitive printer information (via WMI, Win32_Printer, often done to detect virtual machines)

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Printer
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Printer

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk

Queries sensitive sound device information (via WMI, Win32_SoundDevice, often done to detect virtual machines)

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_SoundDevice
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_SoundDevice

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\Configuration name: DriverDesc
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\Properties name: DriverDesc
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96c-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\ocs-office.exe	Window / User API: threadDelayed 3268	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4346
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2521
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2927
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2251

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\services.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\mfc140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\vcomp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\mfcm140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\OcsSystray.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\Download.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\vcamp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\KillProcDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsm5E69.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\OcsNotifyUser.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\uninst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\ComHTTP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\SetACL.exe	Jump to dropped file
Source: C:\Users\user\Downloads\ocsoffice.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\Downloads\ocsoffice.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\mfcm140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Dropped PE file which has not been started: C:\Program Files\OCS Inventory Agent\ZipArchive.dll	Jump to dropped file

Source: C:\Users\user\Desktop\ocs-office.exe

Evaded block: after key decision

graph_0-100887

Source: C:\Users\user\Desktop\ocs-office.exe	API coverage: 6.9 %
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	API coverage: 5.5 %

Source: C:\Users\user\Desktop\ocs-office.exe TID: 6576	Thread sleep time: -32680s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe TID: 3064	Thread sleep count: 113 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2032	Thread sleep count: 4346 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2032	Thread sleep count: 2521 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 416	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4488	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe TID: 1244	Thread sleep count: 48 > 30
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe TID: 1244	Thread sleep time: -48000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1904	Thread sleep count: 2927 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1904	Thread sleep count: 2251 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2344	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Bios
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Bios
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Last function: Thread delayed
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAFBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF78EAFBC70
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAC2F50 FindFirstFileExW,	0_2_00007FF78EAC2F50
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAFC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF78EAFC7C0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB0A874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF78EB0A874
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB0A350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF78EB0A350
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB0A4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF78EB0A4F8
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB06428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF78EB06428
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAFB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF78EAFB7C0
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB071F4 FindFirstFileW,FindClose,	0_2_00007FF78EB071F4
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB072A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF78EB072A8
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_00406313 FindFirstFileA,FindClose,	1_2_00406313
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_004057D8 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	1_2_004057D8
Source: C:\Users\user\Downloads\ocsoffice.exe	Code function: 1_2_00402765 FindFirstFileA,	1_2_00402765
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_00406313 FindFirstFileA,FindClose,	2_2_00406313
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_004057D8 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	2_2_004057D8
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	Code function: 2_2_00402765 FindFirstFileA,	2_2_00402765
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Code function: 3_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	3_2_004059F0
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Code function: 3_2_0040659C FindFirstFileA,FindClose,	3_2_0040659C
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Code function: 3_2_004027A1 FindFirstFileA,	3_2_004027A1
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB3B5D90 _errno,_errno,malloc,memset,malloc,malloc,free,free,_errno,MultiByteToWideChar,FindFirstFileW,free,free,free,_errno,FindNextFileW,WideCharToMultiByte,_errno,	7_2_00007FFDFB3B5D90

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAA1D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF78EAA1D80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: OCSInventory.exe	Binary or memory string: VMware
Source: OCSInventory.exe, 00000016.00000002.2412384666.000001EC322DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,VMware VMCI Bus Device)
Source: OCSInventory.exe, 00000016.00000003.2410745267.000001EC3227F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,VMware VMCI Bus Deviceevice
Source: OCSInventory.exe, 00000016.00000002.2414173406.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: MicrosoftQEMUXenVMwareVirtual HDVirtual MachineVBOXVirtualBoxVirtual CDWSA Get IPv4 address...Failed to load <WSAStartup> function from wsock32.dll !
Source: OCSInventory.exe, 00000008.00000003.2191316015.000001D995912000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193138521.000001D995912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 66Microsoft Hyper-V Virtualization Infrastructure Driverdn;
Source: OCSInventory.exe, 00000016.00000002.2412303943.000001EC322BC000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410952624.000001EC322BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HMicrosoft Hyper-V Generation Counter
Source: OCSInventory.exe, 00000016.00000002.2412384666.000001EC322DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,VMware VMCI Bus Deviceon
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031403378.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000008.00000002.2196356994.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000011.00000002.2232355200.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000013.00000002.2908044221.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000016.00000002.2415168665.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: ?SetVirtualMachines@COCSInventoryState@@QEAAXPEB_W@Z
Source: OCSInventory.exe, OCSInventory.exe, 00000008.00000003.2190745262.000001D997780000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2190104058.000001D997780000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2409239112.000001EC32D58000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2409305516.000001EC32D70000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2409165390.000001EC32D34000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2409918315.000001EC32D8F000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2408981922.000001EC32D30000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2409734595.000001EC32D8F000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2409518675.000001EC32D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VIRTUALMACHINES
Source: OCSInventory.exe, 00000016.00000002.2412253744.000001EC3228B000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410871338.000001EC3228A000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410745267.000001EC3227F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lMicrosoft Hyper-V Virtualization Infrastructure Driver();
Source: ocs-office.exe, 00000000.00000003.2302497939.000001814F495000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303355822.000001814F496000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299316240.000001814F770000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2304050623.000001814F770000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2302157006.000001814F492000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tComputer System ProductUF8L8T71434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.Noney*
Source: OCSInventory.exe	Binary or memory string: Virtual HD
Source: OCSInventory.exe, 00000008.00000003.2190288810.000001D9977A4000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2189796044.000001D99779C000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000002.2412454459.000001EC32303000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000002.2412476657.000001EC32307000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000002.2412476657.000001EC3230F000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000002.2412476657.000001EC3230C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <VIRTUALMACHINES />
Source: OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.driveintec
Source: OCSInventory.exe, 00000008.00000003.2191316015.000001D995947000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193277809.000001D995947000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2189853413.000001D995947000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2180395080.000001D995946000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2181153915.000001D995946000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HMicrosoft Hyper-V Generation CounterX
Source: OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PnPSignedDriverDisk driveDISKDRIVESCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskSCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000{4d36e967-e325-11ce-bfc1-08002be10318}Bus Number 0, Target Id 0, LUN 0\Device\00000023(Standard disk drives)VMware Virtual disk SCSI Disk Devicedisk.infMicrosoft20060621000000.****+*Disk drive10.0.19041.1865Microsoft Windows9
Source: OCSInventory.exe, 00000008.00000003.2191692441.000001D99593C000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193220048.000001D99593C000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2191316015.000001D99593C000.00000004.00000020.00020000.00000000.sdmp, OcsService.exe, 00000013.00000002.2905552943.00000170E8855000.00000004.00000020.00020000.00000000.sdmp, OcsService.exe, 00000013.00000003.2903794985.00000170E8855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000002.2412303943.000001EC322BC000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410952624.000001EC322BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: OCSInventory.exe, 00000008.00000003.2181153915.000001D995946000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: OCSInventory.exe, 00000008.00000003.2181153915.000001D995946000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRomNECVMWarVMware_SATA_CD001.00
Source: OCSInventory.exe, 00000016.00000002.2414173406.00007FFE0038B000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: VMware Inc.,
Source: OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DiskVMware__Virtual_disk____2.0_
Source: OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: OCSInventory.exe, 00000008.00000003.2181153915.000001D995946000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: ocs-office.exe, 00000000.00000003.2299316240.000001814F770000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2304050623.000001814F770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWV'
Source: OCSInventory.exe, 00000016.00000002.2412384666.000001EC322DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc. Processor$a
Source: OCSInventory.exe, 00000008.00000003.2181153915.000001D995946000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PnPSignedDriverCD-ROM DriveCDROMSCSI\CdRomNECVMWarVMware_SATA_CD001.00SCSI\CdRomSCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000{4d36e965-e325-11ce-bfc1-08002be10318}Bus Number 0, Target Id 0, LUN 0\Device\00000025(Standard CD-ROM drives)NECVMWar VMware SATA CD00cdrom.infMicrosoft20060621000000.****+*CD-ROM Drive10.0.19041.1266Microsoft Windows3
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031403378.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000008.00000002.2196356994.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000011.00000002.2232355200.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000013.00000002.2908044221.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000016.00000002.2415168665.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: REGISTRYHARDWAREMEMORIESBIOSCONTROLLERSSLOTSPORTSMONITORSDRIVESSTORAGESMODEMSINPUTSPRINTERSNETWORKSVIDEOSSOUNDSVIRTUALMACHINESSOFTWARESCPUS%s\.KERNEL32.DLLGetDiskFreeSpaceExW%x%cw,ccs=UTF-8%c%c%02x%c%2XPROLOG
Source: OCSInventory.exe, 00000008.00000003.2191316015.000001D995947000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193277809.000001D995947000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2189853413.000001D995947000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2180395080.000001D995946000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2181153915.000001D995946000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HMicrosoft Hyper-V Generation CounterN 00.000P3
Source: OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,VMware VMCI Bus Device)onitor7
Source: OCSInventory.exe, 00000008.00000003.2191316015.000001D995912000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193138521.000001D995912000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000002.2412253744.000001EC3228B000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410871338.000001EC3228A000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410745267.000001EC3227F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lMicrosoft Hyper-V Virtualization Infrastructure Driver
Source: OCSInventory.exe, 00000016.00000003.2410745267.000001EC3227F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductUF8L8T71434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.Noney*
Source: OCSInventory.exe, 00000008.00000003.2189607209.000001D995947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031403378.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000008.00000002.2196356994.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000011.00000002.2232355200.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000013.00000002.2908044221.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000016.00000002.2415168665.00007FFE13222000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: ?GetVirtualMachines@COCSInventoryState@@QEAAPEB_WXZ
Source: OCSInventory.exe, 00000016.00000002.2412303943.000001EC322BC000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410952624.000001EC322BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HMicrosoft Hyper-V Generation Counteroller000L3
Source: OCSInventory.exe, 00000016.00000002.2412253744.000001EC3228B000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410871338.000001EC3228A000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410745267.000001EC3227F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 66emMicrosoft Hyper-V Virtualization Infrastructure DriverQ

Source: C:\Users\user\Downloads\ocsoffice.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\ocs-office.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB10A00 BlockInput,

0_2_00007FF78EB10A00

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EA837B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF78EA837B0

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAA5BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF78EAA5BC0

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB1AF20 LoadLibraryA,GetProcAddress,

0_2_00007FF78EB1AF20

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAECDC4 GetProcessHeap,HeapAlloc,InitializeAcl,

0_2_00007FF78EAECDC4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAC8FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF78EAC8FE4
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EABAF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78EABAF58
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAA59C8 SetUnhandledExceptionFilter,	0_2_00007FF78EAA59C8
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EAA57E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78EAA57E4
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_6670D6FC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6670D6FC
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_6670CCB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_6670CCB4
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_0000000180005830 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0000000180005830
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00000001800059B4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00000001800059B4
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FF7B4C3A210 SetUnhandledExceptionFilter,	7_2_00007FF7B4C3A210
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FF7B4C39C60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF7B4C39C60
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FF7B4C3A02C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF7B4C3A02C
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB4A7574 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FFDFB4A7574

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}"

Source: C:\Users\user\Desktop\ocs-office.exe

0_2_00007FF78EAECE68

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EA837B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF78EA837B0

Source: C:\Users\user\Desktop\ocs-office.exe

0_2_00007FF78EAA4514

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB14C58 GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00007FF78EB14C58

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe "C:\Program Files\OCS Inventory Agent\ocsinventory.exe" /SAVE_CONF /SERVER=http://ti.fm2c.com.br/ocsinventory /USER= /PWD= /SSL=1 /CA="cacert.pem" /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG="office" /WMI_FLAG_MODE="COMPLETE" /DEFAULT_USER_DOMAIN="" /NO_SYSTRAY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe C:\Program Files\OCS Inventory Agent\ocsinventory.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OcsService.exe "C:\Program Files\OCS Inventory Agent\OcsService.exe" -install	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs	Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /displaydns
Source: C:\Program Files\OCS Inventory Agent\OcsService.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c "C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /displaydns

Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe "c:\program files\ocs inventory agent\ocsinventory.exe" /save_conf /server=http://ti.fm2c.com.br/ocsinventory /user= /pwd= /ssl=1 /ca="cacert.pem" /proxy_type=0 /proxy= /proxy_port= /proxy_user= /proxy_pwd= /debug=0 /tag="office" /wmi_flag_mode="complete" /default_user_domain="" /no_systray
Source: C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	Process created: C:\Program Files\OCS Inventory Agent\OCSInventory.exe "c:\program files\ocs inventory agent\ocsinventory.exe" /save_conf /server=http://ti.fm2c.com.br/ocsinventory /user= /pwd= /ssl=1 /ca="cacert.pem" /proxy_type=0 /proxy= /proxy_port= /proxy_user= /proxy_pwd= /debug=0 /tag="office" /wmi_flag_mode="complete" /default_user_domain="" /no_systray			Jump to behavior

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAEC858 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00007FF78EAEC858

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAED540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00007FF78EAED540

Source: ocs-office.exe, 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: ocs-office.exe	Binary or memory string: Shell_TrayWnd
Source: OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CSystemTrayTaskbarCreatedTrayNotifyWndTrayClockWClassShell_TrayWnd8

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EABFD20 cpuid

0_2_00007FF78EABFD20

Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId			Jump to behavior
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EB08BF4 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,wcscat,wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,wcscpy,

0_2_00007FF78EB08BF4

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAE2BCF GetUserNameW,

0_2_00007FF78EAE2BCF

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAC2650 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00007FF78EAC2650

Source: C:\Users\user\Desktop\ocs-office.exe

Code function: 0_2_00007FF78EAA1D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF78EAA1D80

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: ocs-office.exe	Binary or memory string: WIN_81
Source: ocs-office.exe	Binary or memory string: WIN_XP
Source: ocs-office.exe	Binary or memory string: WIN_XPe
Source: ocs-office.exe	Binary or memory string: WIN_VISTA
Source: ocs-office.exe, 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: ocs-office.exe	Binary or memory string: WIN_7
Source: ocs-office.exe	Binary or memory string: WIN_8
Source: ocs-office.exe, 00000000.00000003.1633738226.000001814F464000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XPON6@h7

Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB14074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00007FF78EB14074
Source: C:\Users\user\Desktop\ocs-office.exe	Code function: 0_2_00007FF78EB13940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_00007FF78EB13940
Source: C:\Program Files\OCS Inventory Agent\OCSInventory.exe	Code function: 7_2_00007FFDFB41F1E0 htons,htonl,socket,setsockopt,bind,WSAGetLastError,strchr,memcpy,htonl,socket,connect,closesocket,closesocket,socket,WSAGetLastError,closesocket,listen,WSAGetLastError,	7_2_00007FFDFB41F1E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	931 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	11 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	11 Windows Service	21 Access Token Manipulation	1 Software Packing	NTDS	168 System Information Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Windows Service	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	971 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	561 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	3 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Valid Accounts	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	561 Virtualization/Sandbox Evasion	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	12 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ocs-office.exe	3%	ReversingLabs
ocs-office.exe	11%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files\OCS Inventory Agent\ComHTTP.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\ComHTTP.dll	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\Download.exe	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\Download.exe	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\OCSInventory Front.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\OCSInventory Front.dll	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\OCSInventory.exe	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\OCSInventory.exe	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\OcsNotifyUser.exe	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\OcsNotifyUser.exe	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\OcsService.exe	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\OcsService.exe	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\OcsSystray.exe	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\OcsSystray.exe	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\OcsWmi.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\OcsWmi.dll	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\SysInfo.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\SysInfo.dll	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\ZipArchive.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\ZipArchive.dll	0%	Virustotal	Browse
C:\Program Files\OCS Inventory Agent\libcurl.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\libeay32.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\mfc140.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\mfc140u.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\mfcm140.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\mfcm140u.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\msvcp140.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\msvcr120.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\ssleay32.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\ucrtbase.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\uninst.exe	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\vcamp140.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\vcomp140.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\vcruntime140.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\vcruntime140_1.dll	0%	ReversingLabs
C:\Program Files\OCS Inventory Agent\zlib1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ocsoffice[1].exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\UserInfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\KillProcDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\SetACL.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\UserInfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsProcess.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\services.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsm5E69.tmp\System.dll	0%	ReversingLabs
C:\Users\user\Downloads\ocsoffice.exe	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
portal.fm2c.com.br	0%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.m	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
http://ti.fm2c.com.br/ocsinventoryOCS	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe%	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventory	0%	Avira URL Cloud	safe
http://www.ocsinventory-ng.orgPublisherOCS	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/	0%	Avira URL Cloud	safe
http://www.ocsinventory-ng.org%s	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe8	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeH	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/	0%	Virustotal		Browse
http://ti.fm2c.com.br/ocsinventory	0%	Virustotal		Browse
http://ti.fm2c.com.br/ocsinventoryOCS	0%	Virustotal		Browse
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeexe	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventorySaturdayOSPLASH	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeE%	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventory/USER=/PWD=/SSL=1/CA=cacert.pem/PROXY_TYPE=0/PROXY=/PROXY_PORT=/PR	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventorynt	0%	Avira URL Cloud	safe
http://www.artpol-software.com	0%	Avira URL Cloud	safe
http://www.ocsinventory-ng.orgN	0%	Avira URL Cloud	safe
http://www.ocsinventory-ng.orgL	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeS	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventorynt	0%	Virustotal		Browse
http://www.artpol-software.com	0%	Virustotal		Browse
http://www.ocsinventory-ng.orgJ	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeQ	0%	Avira URL Cloud	safe
http://www.ocsinventory-ng.orgF	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventory/USER=/PWD=/SSL=1/CA=cacert.pem/PROXY_TYPE=0/PROXY=/PROXY_PORT=/PR	0%	Virustotal		Browse
http://ti.fm2c.com.br/ocsinventory:	0%	Avira URL Cloud	safe
http://www.ocsinventory-ng.orgB	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventoryERVER=http://ti.fm2c.com.br/ocsinventoryS/NP	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventoryC:	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0J	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exet	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventory_	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe	0%	Avira URL Cloud	safe
http://ti.fm2c.com.br/ocsinventory:	0%	Virustotal		Browse
http://ti.fm2c.com.br/ocsinventory12ESS:	0%	Avira URL Cloud	safe
http://www.ocsinventory-ng.orgV	0%	Avira URL Cloud	safe
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe	0%	Virustotal		Browse
http://ti.fm2c.com.br/ocsinventoryC:	0%	Virustotal		Browse
http://ti.fm2c.com.br/ocsinventoryERVER=http://ti.fm2c.com.br/ocsinventoryS/NP	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ti.fm2c.com.br	119.8.228.120	true	false		unknown
portal.fm2c.com.br	119.8.87.215	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ti.fm2c.com.br/ocsinventory	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.openssl.org/V	OCSInventory.exe, 00000007.00000002.2031213190.00007FFE0E188000.00000002.00000001.01000000.00000020.sdmp, OCSInventory.exe, 00000007.00000002.2030196745.00007FFDFB541000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2194128263.00007FFDFB541000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2195516634.00007FFE0E188000.00000002.00000001.01000000.00000020.sdmp, OcsService.exe, 00000011.00000002.2231779010.00007FFDFBAB1000.00000002.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907418466.00007FFDFBAB1000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413908506.00007FFDFBAB1000.00000002.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2414740326.00007FFE0E188000.00000002.00000001.01000000.00000020.sdmp	false		high
http://ti.fm2c.com.br/ocsinventoryOCS	ocsoffice.exe, 00000001.00000002.2270342274.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://portal.fm2c.com.br/	ocs-office.exe, 00000000.00000003.2302497939.000001814F495000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303355822.000001814F496000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2302157006.000001814F492000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe%	ocs-office.exe, 00000000.00000002.2304139728.000001814F7BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html.	OCSInventory.exe, 00000007.00000002.2030156695.00007FFDFB501000.00000008.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2194043876.00007FFDFB510000.00000004.00000001.01000000.00000018.sdmp, OcsService.exe, 00000011.00000002.2231710053.00007FFDFBA70000.00000008.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907341902.00007FFDFBA71000.00000008.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413829529.00007FFDFBA80000.00000004.00000001.01000000.00000018.sdmp	false		high
https://curl.haxx.se/docs/http-cookies.html	OCSInventory.exe, OCSInventory.exe, 00000007.00000002.2031076819.00007FFE0CFD1000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000008.00000002.2195219918.00007FFE0CFD1000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000016.00000002.2414413188.00007FFE0CFD1000.00000002.00000001.01000000.0000001F.sdmp	false		high
http://www.ocsinventory-ng.orgPublisherOCS	OcsSetup.exe, 00000003.00000002.2264098954.0000000000621000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	OCSInventory.exe, OCSInventory.exe, 00000007.00000002.2030156695.00007FFDFB501000.00000008.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000008.00000002.2194043876.00007FFDFB510000.00000004.00000001.01000000.00000018.sdmp, OcsService.exe, 00000011.00000002.2231710053.00007FFDFBA70000.00000008.00000001.01000000.00000018.sdmp, OcsService.exe, 00000013.00000002.2907341902.00007FFDFBA71000.00000008.00000001.01000000.00000018.sdmp, OCSInventory.exe, 00000016.00000002.2413829529.00007FFDFBA80000.00000004.00000001.01000000.00000018.sdmp	false		high
http://www.ocsinventory-ng.org%s	OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exe8	ocs-office.exe, 00000000.00000002.2304139728.000001814F7BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/copyright.htmlD	OCSInventory.exe, 00000007.00000002.2031113260.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000008.00000002.2195277999.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000016.00000002.2414471242.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp	false		high
https://contoso.com/	powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://curl.haxx.se/V	OCSInventory.exe, 00000007.00000002.2031113260.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000008.00000002.2195277999.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp, OCSInventory.exe, 00000016.00000002.2414471242.00007FFE0CFE6000.00000002.00000001.01000000.0000001F.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000F.00000002.2170659052.000001E49A993000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2170659052.000001E49A85C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2132643091.000001E48C21A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2383777401.000001E876498000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ocsinventory-ng.org	OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, OCSInventory.exe, 00000007.00000002.2030907910.00007FFDFF305000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000007.00000002.2031285647.00007FFE126CE000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000007.00000002.2029620541.000000018000C000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000008.00000002.2192641356.000000018000C000.00000002.00000001.01000000.0000001A.sdmp, OCSInventory.exe, 00000008.00000002.2195653164.00007FFE126CE000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000008.00000002.2194956078.00007FFDFF305000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000011.00000002.2229893566.000000018000C000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000011.00000002.2232126021.00007FFE003D5000.00000002.00000001.01000000.00000016.sdmp, OcsService.exe, 00000013.00000002.2905174952.000000018000C000.00000002.00000001.01000000.0000001A.sdmp, OcsService.exe, 00000013.00000002.2907782590.00007FFE003D5000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000016.00000002.2414899125.00007FFE126CE000.00000002.00000001.01000000.0000001E.sdmp, OCSInventory.exe, 00000016.00000002.2414282409.00007FFE003D5000.00000002.00000001.01000000.00000016.sdmp, OCSInventory.exe, 00000016.00000002.2411803423.000000018000C000.00000002.00000001.01000000.0000001A.sdmp	false		high
https://oneget.orgX	powershell.exe, 0000000F.00000002.2132643091.000001E48BFEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E867C25000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0D	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.openssl.org/	OCSInventory.exe	false		high
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeH	ocs-office.exe, 00000000.00000003.2302497939.000001814F495000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303355822.000001814F496000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2302157006.000001814F492000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeexe	ocs-office.exe, 00000000.00000002.2303990987.000001814F73D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ti.fm2c.com.br/ocsinventorySaturdayOSPLASH	OcsSetup.exe, 00000003.00000002.2263622193.0000000000425000.00000004.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000F.00000002.2132643091.000001E48A7E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E866421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeE%	ocs-office.exe, 00000000.00000003.2299749862.000001814F663000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303809041.000001814F673000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299633468.000001814F65D000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299557988.000001814F65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000F.00000002.2170659052.000001E49A993000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2170659052.000001E49A85C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2132643091.000001E48C21A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2383777401.000001E876498000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ti.fm2c.com.br/ocsinventory/USER=/PWD=/SSL=1/CA=cacert.pem/PROXY_TYPE=0/PROXY=/PROXY_PORT=/PR	OCSInventory.exe, 00000007.00000002.2029715162.000002017A01C000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 0000000F.00000002.2132643091.000001E48BFEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E867C25000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ti.fm2c.com.br/ocsinventorynt	OCSInventory.exe, 00000008.00000003.2191316015.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193112052.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2191756385.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410871338.000001EC3228A000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410952624.000001EC3229D000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000003.2410745267.000001EC3227F000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000016.00000002.2412303943.000001EC3229F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.artpol-software.com	OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ocsinventory-ng.orgN	OcsSetup.exe, 00000003.00000002.2263817012.0000000000473000.00000002.00000001.01000000.0000000D.sdmp, OcsSetup.exe, 00000003.00000003.2251156729.00000000030CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001C.00000002.2314383504.000001E866652000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.ocsinventory-ng.orgL	OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001C.00000002.2314383504.000001E866652000.00000004.00000800.00020000.00000000.sdmp	false		high
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeS	ocs-office.exe, 00000000.00000002.2304139728.000001814F7BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ocsinventory-ng.orgJ	OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029969363.00007FF7B4CA6000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000008.00000000.2057887829.00007FF7B4CA6000.00000002.00000001.01000000.00000014.sdmp, OCSInventory.exe, 00000016.00000000.2249421655.00007FF7B4CA6000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 0000000F.00000002.2132643091.000001E48B412000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E867052000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exeQ	ocs-office.exe, 00000000.00000003.2302497939.000001814F495000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303355822.000001814F496000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2302157006.000001814F492000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ocsinventory-ng.orgF	OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsService.exe, 00000011.00000002.2230743470.00007FF6EED6E000.00000002.00000001.01000000.00000023.sdmp, OcsService.exe, 00000013.00000000.2243916264.00007FF6EED6E000.00000002.00000001.01000000.00000023.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000001C.00000002.2383777401.000001E8765CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ti.fm2c.com.br/ocsinventory:	instOCS.exe, 00000002.00000002.2267468052.0000000000432000.00000004.00000001.01000000.0000000A.sdmp, instOCS.exe, 00000002.00000002.2268280616.0000000000627000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ocsinventory-ng.orgB	OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ti.fm2c.com.br/ocsinventoryC:	instOCS.exe, 00000002.00000002.2268994035.0000000002750000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2263994646.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264098954.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2263622193.000000000042A000.00000004.00000001.01000000.0000000D.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	ocsoffice.exe, 00000001.00000000.1715229113.000000000040A000.00000008.00000001.01000000.00000006.sdmp, ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, instOCS.exe, 00000002.00000002.2267468052.000000000040A000.00000004.00000001.01000000.0000000A.sdmp, instOCS.exe, 00000002.00000000.1719645772.000000000040A000.00000008.00000001.01000000.0000000A.sdmp, OcsSetup.exe, 00000003.00000003.2251156729.0000000003081000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2263622193.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, OcsSetup.exe, 00000003.00000000.1724965818.000000000040A000.00000008.00000001.01000000.0000000D.sdmp	false		high
http://ti.fm2c.com.br/ocsinventoryERVER=http://ti.fm2c.com.br/ocsinventoryS/NP	OcsSetup.exe, 00000003.00000002.2263622193.0000000000427000.00000004.00000001.01000000.0000000D.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000001C.00000002.2314383504.000001E866652000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.m	ocs-office.exe, 00000000.00000002.2304139728.000001814F7BB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_Error	OcsSetup.exe, OcsSetup.exe, 00000003.00000003.2251156729.0000000003081000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2263622193.000000000040A000.00000004.00000001.01000000.0000000D.sdmp, OcsSetup.exe, 00000003.00000000.1724965818.000000000040A000.00000008.00000001.01000000.0000000D.sdmp	false		high
http://ocsp.sectigo.com0J	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zlib.net/	OCSInventory.exe	false		high
https://portal.fm2c.com.br/paginas/publicFiles/ocsoffice.exet	ocs-office.exe, 00000000.00000003.2299749862.000001814F663000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000002.2303809041.000001814F673000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299633468.000001814F65D000.00000004.00000020.00020000.00000000.sdmp, ocs-office.exe, 00000000.00000003.2299557988.000001814F65B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zlib.net/D	OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2029556525.0000000066716000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000008.00000002.2192340700.0000000066716000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000011.00000002.2229759988.0000000066716000.00000002.00000001.01000000.00000017.sdmp, OcsService.exe, 00000013.00000002.2904997429.0000000066716000.00000002.00000001.01000000.00000017.sdmp, OCSInventory.exe, 00000016.00000002.2411679589.0000000066716000.00000002.00000001.01000000.00000017.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	ocsoffice.exe, 00000001.00000002.2269798656.000000000040A000.00000004.00000001.01000000.00000006.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002C46000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, OcsSetup.exe, 00000003.00000002.2264719899.0000000002DE5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ti.fm2c.com.br/ocsinventory_	OCSInventory.exe, 00000008.00000003.2191316015.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000002.2193112052.000001D995901000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000008.00000003.2191756385.000001D995901000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000000F.00000002.2132643091.000001E48A7E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E866421000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.org	powershell.exe, 0000000F.00000002.2132643091.000001E48BFEF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2314383504.000001E867C25000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ti.fm2c.com.br/ocsinventory12ESS:	OcsSetup.exe, 00000003.00000002.2263622193.0000000000427000.00000004.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ocsinventory-ng.orgV	OcsSetup.exe, 00000003.00000002.2264719899.0000000002855000.00000004.00000020.00020000.00000000.sdmp, OCSInventory.exe, 00000007.00000002.2031437511.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000008.00000002.2196531442.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000011.00000002.2232416874.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp, OcsService.exe, 00000013.00000002.2908113490.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp, OCSInventory.exe, 00000016.00000002.2415223849.00007FFE13241000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/copyright.html	OCSInventory.exe	false		high
https://curl.haxx.se/	OCSInventory.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
119.8.228.120	ti.fm2c.com.br	Singapore		136907	HWCLOUDS-AS-APHUAWEICLOUDSHK	false
119.8.87.215	portal.fm2c.com.br	Singapore		136907	HWCLOUDS-AS-APHUAWEICLOUDSHK	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1401771
Start date and time:	2024-03-02 02:22:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ocs-office.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@44/69@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 71 Number of non-executed functions: 220
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 13.85.23.86, 72.21.81.240
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:23:25	API Interceptor	1x Sleep call for process: OcsSetup.exe modified
02:23:38	API Interceptor	10x Sleep call for process: powershell.exe modified
02:24:42	API Interceptor	19x Sleep call for process: OcsService.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	http://w103.pro/fr35766334/alerte.php?phone=09-70-38-53-21IP:	Get hash	malicious	TechSupportScam	Browse	192.229.211.108
	https://stwesswgckdrkpiskrspws.blob.core.windows.net/stwesswgckdrkpiskrspws/unsb.html#un/22524_md/14/14825/3398/473/706672	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://pp.167-88-166-12.cprapid.com/pp/IP:	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://servicelinknetworker.weebly.com/IP:	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.dhl-tracking.com/IP:	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://outlookoficial.hstn.me/accounnt=service=firt.htmlIP:	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://verfydomainnextwork.weebly.com/IP:	Get hash	malicious	HTMLPhisher	Browse	192.229.211.108
	https://sideverfyingsevicenetwork.weebly.com/IP:	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://manual-restore.pages.dev/IP:	Get hash	malicious	Unknown	Browse	192.229.211.108

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HWCLOUDS-AS-APHUAWEICLOUDSHK	5WTG6N45CH.elf	Get hash	malicious	Mirai	Browse	159.138.222.4
	aA8sPbK4EG.elf	Get hash	malicious	Moobot	Browse	119.8.64.12
	zpIXM3FqqH.elf	Get hash	malicious	Mirai	Browse	119.8.39.77
	huhu.arm5-20240212-0910.elf	Get hash	malicious	Mirai, Okiru	Browse	119.8.40.42
	https://kso.page.link/wps	Get hash	malicious	Unknown	Browse	114.119.189.26
	skyljne.mips.elf	Get hash	malicious	Mirai	Browse	119.8.88.17
	TqA3GrJsfl.elf	Get hash	malicious	Mirai	Browse	119.10.40.126
	https://us.docs.wps.com/module/common/loadplatform?sa=16&st=0t&sid=sicb8ypvckj3kqqy&v=v2	Get hash	malicious	Unknown	Browse	159.138.103.235
	xd.arm.elf	Get hash	malicious	Mirai	Browse	159.139.52.126
	dJSGK4OSJV.elf	Get hash	malicious	Mirai	Browse	114.119.200.56
HWCLOUDS-AS-APHUAWEICLOUDSHK	5WTG6N45CH.elf	Get hash	malicious	Mirai	Browse	159.138.222.4
	aA8sPbK4EG.elf	Get hash	malicious	Moobot	Browse	119.8.64.12
	zpIXM3FqqH.elf	Get hash	malicious	Mirai	Browse	119.8.39.77
	huhu.arm5-20240212-0910.elf	Get hash	malicious	Mirai, Okiru	Browse	119.8.40.42
	https://kso.page.link/wps	Get hash	malicious	Unknown	Browse	114.119.189.26
	skyljne.mips.elf	Get hash	malicious	Mirai	Browse	119.8.88.17
	TqA3GrJsfl.elf	Get hash	malicious	Mirai	Browse	119.10.40.126
	https://us.docs.wps.com/module/common/loadplatform?sa=16&st=0t&sid=sicb8ypvckj3kqqy&v=v2	Get hash	malicious	Unknown	Browse	159.138.103.235
	xd.arm.elf	Get hash	malicious	Mirai	Browse	159.139.52.126
	dJSGK4OSJV.elf	Get hash	malicious	Mirai	Browse	114.119.200.56

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	ortegaHTU6.msi	Get hash	malicious	Unknown	Browse	119.8.87.215
	file.exe	Get hash	malicious	Vidar	Browse	119.8.87.215
	rPedido0013.exe	Get hash	malicious	FormBook, GuLoader	Browse	119.8.87.215
	SecuriteInfo.com.Win64.DropperX-gen.29614.25587.exe	Get hash	malicious	Meduza Stealer	Browse	119.8.87.215
	GoTo Webinar Opener (2).exe	Get hash	malicious	Unknown	Browse	119.8.87.215
	GoTo Webinar Opener (2).exe	Get hash	malicious	Unknown	Browse	119.8.87.215
	5567890333.wsf	Get hash	malicious	XWorm	Browse	119.8.87.215
	file.exe	Get hash	malicious	Vidar	Browse	119.8.87.215
	SecuriteInfo.com.Win32.TrojanX-gen.18566.17153.exe	Get hash	malicious	Unknown	Browse	119.8.87.215
	SecuriteInfo.com.Win32.TrojanX-gen.18566.17153.exe	Get hash	malicious	Unknown	Browse	119.8.87.215

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63392
Entropy (8bit):	5.920182486485395
Encrypted:	false
SSDEEP:	1536:W83/92mO0vGedF40OWdHtJADliavnYQ+8iAe:Wq/4YGE40dtJ4Uavn3De
MD5:	04CCE3412D3E4703E23B714C17A2977A
SHA1:	9205397142100E977FE5F46809585C953D3B93C6
SHA-256:	8CCACAC9A0659D3E46567661D11A2D71607D9101B1B9B523F16D10B13F5A8D26
SHA-512:	5C94D72CA517D896225121052DB05C20774E32356AFFDC83821BF9720113E27CEB1386AAC5BF53A7554C59A6169160A1A50428AC63AC561DC02FB19BBCD551AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:f.V[..V[..V[.._#..P[..B0..P[.../..U[.../.._[.../..O[.../..P[.../..Q[..V[...[.../..S[.../..W[.../..W[..V[..W[.../..W[..RichV[..........PE..d....(rb.........." .....\...x.......V....................................................`.............................................................................)...... ...p...p.......................(.......8............p..X............................text....Z.......\.................. ..`.rdata...X...p...Z...`..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\Download.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	449952
Entropy (8bit):	3.7378710944497597
Encrypted:	false
SSDEEP:	1536:f1gj5jtiKwrqoNuWS8nfoNja1EFFSZMwExLDgCIk/VjaJQ+8iAU:f1AdIkt8j1EvwEFgCIk/daWDU
MD5:	1FEB0C8A967C8E5E4D055B20C2A2214E
SHA1:	0309A625460A6EFFAEEBFA98940EC9E0BD99B2F8
SHA-256:	D93C3976FE59105C33F5C38EA27A2E9A37C2E767EFBA7E2F5F0AC0DD1F6FB8E6
SHA-512:	D0BFBB748471B300D84AF787ED4C8CC6364F80350507C1EDD7FDC20DDACAD6B45833AC7CBF9EFBD1F6112E5FB23B28CFCCC05BFD514B92B6FCA7686ADED58011
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U...;...;...;......;..:...;...?...;...8...;...>...;...:...;...:...;...:..;...2...;.......;......;...9...;.Rich..;.................PE..d....(rb.........."......t...F.......i.........@.....................................N....`..........................................................@..0....0...........)..........H...p.......................(.......8...............x............................text....s.......t.................. ..`.rdata..&............x..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc...0....@......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\OCS-transform.xsl

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	XML 1.0 document text (XSL stylesheet) (XSL stylesheet), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8400
Entropy (8bit):	4.794961143638397
Encrypted:	false
SSDEEP:	96:dXRBjar+czvpxbAGzvHcBcfc/cA+cQcGcdecVcIcpPcwcUcSIcZdcbcl:dXRBWCc7bbHAcfO2RnseSr2PNVNICdwC
MD5:	AC3A736E89F5FFB5AC8DB74EB81189ED
SHA1:	280900A3DE732A9F5F9D5D196E745FCC2ACBC033
SHA-256:	C9F82CADEAAD84D31301B110F64939207B6D6AAB666C4C6589C77349013E3D77
SHA-512:	831A172AD35FE4CF564214D5A098A232D44F41402604275CAD2A7240A68D04C27543B2BC4CA5C9EDF2EDE3ADBDB4002D51251A58C643937FD6C5C67AB9FBBED0
Malicious:	false
Preview:	<?xml version='1.0' ?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> ..<xsl:template match="/REQUEST">..<html>..<head>.. <style type="text/css">.... #OCSstyle table{.. border-collapse:collapse;.. width:90%;.. }.. #OCSstyle th{... font-family:monospace;... border:thin solid #b2b7c9;... padding:0px;... background-color:#D0E3FA;... font-size: xx-small;.. }.. #OCSstyle td{... font-family:sans-serif;... border:thin solid #b2b7c9;... padding:0px;... text-align:center;... font-size: xx-small;.. }.. #OCSstyle caption{.. font-family:sans-serif;.. }.. </style>..</head>..<body>.. <div align="center">.. <H1> OCS Inventory NG Information for Computer<br />.. <xsl:value-of select="CONTENT/HARDWARE/NAME"/>.. </H1>.. <hr/>.. </div> .... <div id="OCSstyle" align="center">.... <h2>General properties</h2> .. <table>.. <tr>.. <th>NAME</th>.. <th>VALUE</th>.

C:\Program Files\OCS Inventory Agent\OCSInventory Front.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	276384
Entropy (8bit):	6.152821717410416
Encrypted:	false
SSDEEP:	3072:a04uYR7QCniNhZjrLyYgjPf5z9b1/gEbghFv5YKBbGUArG4oRa8FD+0:a04NR7QU1jPhz9R/gWgArPlgp
MD5:	43AAE6C6CC34F445C7DF342D517D009B
SHA1:	E47288EC8ADEF5B9AF97402A06F877F04E64A944
SHA-256:	05540ECDAF7A409FB5AB23E7E434DB18579FD1979355E5888780D51FB3EC5DB6
SHA-512:	D4DA3F8DD6DA6276DC1A35149D07B271379886D0C01436E7911C4FC7143A29B8D9D0E74D082AC537C57C5FB3D6F64C387F8B574B580574357B3F5A397C197A54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............f..f..f.......f...b..f.+.g...f.+.e...f.+.b...f.+.c..f...g..f.).g...f..g...f.).o..f.).f..f.)...f.....f.).d..f.Rich.f.........................PE..d....(rb.........." .........................................................P............`.............................................$W...`.......0.. ................)...@...... ...p.......................(.......8............ .. ............................text............................... ..`.rdata..h.... ......................@..@.data...............................@....pdata..............................@..@.rsrc... ....0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\OCSInventory.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	486304
Entropy (8bit):	4.015400785752245
Encrypted:	false
SSDEEP:	3072:G4wQGd+WPG0ZFlM6o7rgPyApJJPMBc4AhwEFgCIk/Sk8aDDA:1GdvZ/M6ODc4ADg03A
MD5:	38E1FC55C0339A770DD39CA6541437B9
SHA1:	1646DDD20409034640844DBF370B3ADE4210E2F0
SHA-256:	3A1B250F60AA6AEAF8F910C043A4CF6A7DB0708EEBBA149C3835429461D26BCE
SHA-512:	CAD754610DA85DEC3A76EF53C6141F6E5F6EE159368B9D1489B391633C7D5FFD9E6B09C0F693E7D0CD8E26D17319B77F488E7AB8E4C3854C0C858B5E63FD4560
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.............{......Zw......Zw......Zw......Zw......Xw.......h..........]...Xw......Xwp.............Xw......Rich....................PE..d...%(rb.........."............................@.....................................`....`..................................................Q......................B...)...p.......)..p....................+..(....)..8............................................text............................... ..`.rdata..............................@..@.data...(............~..............@....pdata..............................@..@.rsrc..............................@..@.reloc.......p.......@..............@..B........................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\OcsNotifyUser.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	440736
Entropy (8bit):	3.611205281831877
Encrypted:	false
SSDEEP:	1536:D5rBtbc62GRYM+GRYmQgFSZMwExLDgCIk/VlRjWat0Q+8iAB:D5rvbc62FM+FmQWwEFgCIk/3ga5DB
MD5:	E353C5B5CA4F346B690419570833ACA5
SHA1:	14BD1EA1256F406A9435F346B92177277FABCA1A
SHA-256:	82CF940B23A8CDB8DDBA11F837202DD220D0E1F69522C211A41C4166932D0E1E
SHA-512:	FC7205BCB96D90B6F4E2CDD237C75BF97415190A498352794834B5023363232A7F6014FD0A32D90053C43EF9A57A3EED9756D4B096E85D26B9864BA87DCD950F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$...$...$...-.f.4...0... ...0...(............... ...............".......!...$...Y.......!.......%...$.b.%.......%...Rich$...................PE..d....(rb.........."......L...H......XD.........@..........................................`....................................................T........................)......d.......p.......................(.......8............`...............................text....J.......L.................. ..`.rdata...V...`...X...P..............@..@.data...p...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\OcsService.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	803232
Entropy (8bit):	3.2256644637196716
Encrypted:	false
SSDEEP:	3072:zVDohihyyAVAxZwEFgCIk/BwEFgCIk/aayD0:B8qQAJg0gai0
MD5:	67C17EA1BF6EB610DEAC638E4078D6B4
SHA1:	2D389F89CC95BE1E1BADDAD7CE8C0C082E0ED9BC
SHA-256:	F42A0E62BD1F1AE410C33A7278973539B4BA13BEC4182D49F2C2BA2EB9BF6BAB
SHA-512:	67F5821DA16D41C83DF8DF0D2B15B711B138C438AC9A8FF1B224FDC27EA0FFE56B16E7B991A800827E5E6B7581E3CAE61B262A194B1EC5072033C2D31A5C2F25
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../>.]NP.]NP.]NP.T6..SNP.I%Q.WNP.:T.WNP.:S.^NP.:U.BNP.:Q.[NP.:Q.ZNP.]NQ.NP.:Y.YNP.:..\NP.]N..\NP.:R.\NP.Rich]NP.........PE..d...*(rb.........."......^...........`.........@.............................`......#.....`....................................................h.......PY......D........)...P......H...p.......................(.......8............p...............................text....].......^.................. ..`.rdata..lQ...p...R...b..............@..@.data...............................@....pdata..D...........................@..@.rsrc...PY.......Z..................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\OcsSystray.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	463776
Entropy (8bit):	3.7759317016458454
Encrypted:	false
SSDEEP:	1536:Ha7+dVpvzpH40bmv7yx9vhFSZMwExLDgCIk/VuK9YaJeQ+8iA8X:H3xvzpYKvTwEFgCIk/r9YaDDk
MD5:	E6142E8D019297BE55C7531A0CED498A
SHA1:	8EB9BC28F42CE3BCA8AA676FEA1B92DD2757C33F
SHA-256:	495BDCD09D4B48FBA877D95CAFC49CA323C54C5E189BED63D9056442B705ECC0
SHA-512:	F49C245F4A2A4B409121E429BFC7C7807A19F8FB24811D6ADF8B473801BF8A189C91C07025D258AD3079562CB055F7D27116F5E604366CE7164A9A5D4F806614
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A..Q................................................... ..................................q....................Rich............................PE..d....(rb.........."......f..........p\.........@.............................0......X.....`.................................................p............................)... .........p.......................(...P...8............................................text....e.......f.................. ..`.rdata...c.......d...j..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\OcsWmi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54688
Entropy (8bit):	6.244031138505555
Encrypted:	false
SSDEEP:	768:nba0g4AbusjCcdhjoV4OP0QiqJKhUh+6f0AESHVa7p9E+8iROZ:Ondh0V4Y0QhJKhUh++0AES1a7Q+8iAZ
MD5:	5EE301D79BEA2661BCA836DE2AE4312E
SHA1:	414CECD0ECC84BF395044FC1730803DF22876007
SHA-256:	1AA3BB3766C5FFFAE2E5A4429D8A53B8E1D0D4451F94E0741CA474C0413EA886
SHA-512:	9237C3FE381043589B431BCFE224FC248AA56CD2744EB9AF8CD86D173E57D6B441B6E476B9F574065DBBBEED86358A8DFA1C46570776A0CB937A8709AE5995BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w%...v...v...v..v...v..w...v...w...v...w...v...w...v...v...v...w...v..w...v...w...v...w...v...v...v..v...v...w...vRich...v........................PE..d....'rb.........." .....^...T......hW............................................../g.... .........................................p...x...............................)...........}..p.......................(... ~..8............p..X............................text...^].......^.................. ..`.rdata..J5...p...6...b..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\Plugins\Saas.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	744
Entropy (8bit):	5.252742514194034
Encrypted:	false
SSDEEP:	12:9Ycdr+0NJvTyY9vDO8VPsL3zHHFsZVH+2qEBVL2H4lPz5DSiY1:ac/vGY9DO4s3lsrH8EXyGFw1
MD5:	0A9BA55DABBF8B0A281BD90EBF457AA4
SHA1:	BCFFCEDC07AC9E89879966BE6C9309CF04631C76
SHA-256:	8B249DDC3D4F943135CEEC0E4E20A1D5058C77BFB60CFD3C9FA101FBFA5FFD9D
SHA-512:	18C61DA9A12AE2B3F144A415837963B5ABE568015A7C3F6A6F153B092F4C6A2D195C0BFACA25A01AD7B5B2B866353ED96DA4BAF43FF5688A56A14638D00BC9F1
Malicious:	false
Preview:	Function Get-DNSClientCache($pwlang){ . $hash = @{} .. Invoke-Expression "ipconfig /displaydns" \| . Select-String -Pattern $pwlang -Context 0,5 \| . %{ ....$xml += "<SAAS>`n"....$xml += "<ENTRY>" + ($_.Line -Split ":")[1].Trim().ToLower() + "</ENTRY>`n"....$xml += "<DATA>" + ($_.Context.PostContext[4] -Split ":")[1].Trim().ToLower() + "</DATA>`n"....$xml += "<TTL>" + ($_.Context.PostContext[1] -Split ":")[1].Trim() + "</TTL>`n"....$xml += "</SAAS>`n" . } ....return $xml...} ..$lang = Get-Culture..if($lang.Name -eq "fr-FR"){..$pwlang = "Nom d'enregistrement".}elseif($lang.Name -eq "it-IT"){..$pwlang = "Nome record".}else{..$pwlang = "Record Name".}.. .$dns = Get-DnsClientCache($pwlang) .echo $dns.

C:\Program Files\OCS Inventory Agent\Plugins\o36516user.vbs

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3016
Entropy (8bit):	5.30970049375371
Encrypted:	false
SSDEEP:	48:eYpK5XnJIlg45FhIEX5KeKtRnTXJdYRHQDwXbAiNJpZ3doJXQTN2NkUHm5:lpKI/5vIcKeKTwqaAiNLZoX2UW
MD5:	06E43B247299069CA58AD57CAD956A9A
SHA1:	B0000965F320EB3632A74B4764C6924F9677DDF2
SHA-256:	A6080F6A677068F42C16708F755C606B79492E62B9824D7D7B367421183B6A88
SHA-512:	DF2BB6D2D1AB43E44ACC344C908AFCF9AF595A715A7182BDE1AC1CA7F0D38CDEC31CA38BA13C5D21C266FAF6E321D25BDB4B0771CE5001C859C407678034DC9E
Malicious:	false
Preview:	'----------------------------------------------------------.' Plugin for OCS Inventory NG 2.x.' Script :..Retrieve Office 365 16.0 user info.' Version :..0.10.' Date :..24/02/2021.' Author :..Erich Strewlow.'----------------------------------------------------------.' OS checked [X] on.32b.64b.(Professionnal edition).'.Windows 10. [X].[X].' Windows 2012 [X] [X].' ---------------------------------------------------------.Option Explicit...Const HKEY_USERS = 2147483651..Dim aUsers().Dim aIdent().Dim registryObject .Dim conn.Dim r.Dim k.Dim j.Dim sid.Dim email.Dim name.Dim lastlogin.Dim expirationdate.Dim d.Dim IsoDate.Dim IsoTime.Dim ident..Set registryObject = GetObject("winmgmts:root\default:StdRegProv")..'If OCS agent is started as a service, it knows the local users configuration only.'through HKEY_USERS. We scan all the registered users in the host, listing.'everyone with an Office 16.0 setup.r=registryObject.EnumKey(HKEY_USERS,"",aUsers)..If r <> 0 Then. wscript.quit.End

C:\Program Files\OCS Inventory Agent\SysInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	632224
Entropy (8bit):	6.178525704467686
Encrypted:	false
SSDEEP:	12288:zfQoCYag5EBRGw8Awo3e0NEIiJCn5t/jAWTzgz7g36zC5Hu9lKPZ3h:T7C+z7gq+9R3h
MD5:	DF8ED7EE11621FC1F101715BA829E4B6
SHA1:	D3500C92CCEF9D575B55D8BFAFA8DB2CC3DC5006
SHA-256:	0AC8CD125C88DC14FE3C171A6426C1D44C7897C9C5E0AD21CD86E84D2E4260C2
SHA-512:	B06367C16D2782DB3A53916171FE64181624E41BE2A43860417833B7E6B2918DBFDED76BABBDB0AF289C445F1B1C56967219E40ADE07412C3BCA7415C8D8D7A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........E.ut..ut..ut......ut...u..ut.;.w..ut.;.p..ut.;.q..ut.;.u..ut.9.u..ut..uu..tt.9.}..ut.9.t..ut.9....ut..u...ut.9.v..ut.Rich.ut.................PE..d....'rb.........." .................n...............................................a....`......................................... ....D...................P..(,...\|...).......&...V..p....................Y..(...`W..8............................................text............................... ..`.rdata...p.......r..................@..@.data...h....0......................@....pdata..(,...P......................@..@.rsrc................L..............@..@.reloc...&.......(...T..............@..B................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\ZipArchive.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	523168
Entropy (8bit):	6.615608032026026
Encrypted:	false
SSDEEP:	6144:QrR8BbHiTEhj5Iorxk6RTHe0MVqAuUMTBmYvOWT9vHhwmzfP:QrR8tCo1IobRTHbMwT8YvDT9vuufP
MD5:	55C8912360A1BD660ED1C2B9D8308365
SHA1:	32439E6C08C6998E1CCCAB4FF8946BF95DB5A3EA
SHA-256:	420DEEB85A7ACC5CFF44912BFE1C048C0017109F052637272A092B006726DB1B
SHA-512:	BD4EE097F65037C6B1714BDBAB2CCF275F21CA5AE3E56388D6E799BC122D45B5C7D697276436033EF620C685667E3FB46FB4D6B1D181B46968733B65687C9161
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................1.....?....?....?......?...........e...=.....=....=.]....5...=....Rich..........PE..d....R.b.........." .........D......p.....................................................`.........................................................`....... ...3.......)...p......0q..p............................q..8...............(............................text............................... ..`.rdata..............................@..@.data....`..........................@....pdata...3... ...4..................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\libcurl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	436640
Entropy (8bit):	6.4037412947819945
Encrypted:	false
SSDEEP:	6144:1Pgo1fTzVGpEc/zSE+R8luQIQbo53JOuSmu1HzuGUzPfbou7cVI/3I3HWSdsfPDU:14gfQph7SrRWovu1H7g7cVgnD+7
MD5:	688728C7F73BCB78841F01E25E8D8CC0
SHA1:	E97D4A7DD26E3381BE52B0CB0DCFB79E16F7F392
SHA-256:	3A9BCDFC95231D12CBC31B2842F3F27E78B3E453623EFC4478EEEDBC052477D7
SHA-512:	E35ED6C6F83832B01DDC2C383BA19AFD17B56EA2AF5EB8BD09514CF4B4A7EDC8E10015B4D72E8CE1A200FAF11573FE260B0890FEBE956B13AD2E91B7105FB583
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t...............m .....!a.......zN.....!a......!a......!a.......~......#a..............#a..q...#a......#aL.....#a......Rich............................PE..d....R.b.........." ................................................................4.....`..........................................&......D/..T............`..`9.......)..............................................8............................................text............................... ..`.rdata.. 4.......6..................@..@.data........P.......:..............@....pdata..`9...`...:...<..............@..@.rsrc................v..............@..@.reloc...............\|..............@..B........................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\libeay32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1722784
Entropy (8bit):	6.543782984552167
Encrypted:	false
SSDEEP:	24576:ZE7sit6XDU2LbArX24hOhBgc0tcDabuGJhnk7lAcxP4hqDjPP5Exf:Dt42PArX24hO8cDOJhQAcxyqHPP6
MD5:	F83051511CEB0E2446B85F71DE1AD1BB
SHA1:	76312FF572848D0416536A4152C694601D1C12C7
SHA-256:	209D6C3083BE0FE7A32D5659626C3620E4661A86D6032A97546D841E58E139B0
SHA-512:	59A09890B732C5CC3F7020B476572E0975F19D74B93A3E3A38279F9B090B0B186008E00D697B51C3976CBF676641DB406B63F37B88A11BE03797D8B33DE01436
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.................................................................................I.............q.............Rich....................PE..d....Q.b.........." .....v..........\}...................................................`.........................................04..........h....0..H.......T.... ...)...@...A...W..T...........................`W..8............... ............................text....t.......v.................. ..`.rdata..Rk.......l...z..............@..@.data...............................@....pdata..T...........................@..@.rsrc...H....0......................@..@.reloc...A...@...B..................@..B........................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\mfc140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5607312
Entropy (8bit):	6.744551361376272
Encrypted:	false
SSDEEP:	49152:YWIju42P38QRul8ydnGT0CMFku/9qphaG0J4Y3HzmcgSyJj37uSwIbFLOAkGy3z9:rL3dLcsFLOAkGkzdnEVomFHKnP/
MD5:	06B1A0DFEFDC8BB48DB5A4BFF80E1AFD
SHA1:	8387C99DDBC866189E5716B73D22FE633503867A
SHA-256:	ACF5A630718AB82E499A163D8DA1638D5CD3D0D6EEEB96F70F61CD2C98D3BE95
SHA-512:	0887B817C0981C3C22F9ACC990583CE87D8DF88EC4F85D790D51359CE583556A621894AE552BE4E6C6D22DFC95FEF35DB65BCB0D014C5549EADC086F4B3D1099
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4...p\|.p\|.p\|....q\|....q\|....j\|.y._.d\|....t\|....x\|....c\|.p\|.ax....h\|....v\|.....}....q\|...3.q\|....q\|.Richp\|.................PE..d....T^`.........." ......-...(......4,...................................... V.....U.U...`A.........................................?:.d...4.;.......?.......<..6...lU..#....T.$o...l5.T............................`..8............ -......,:......................text.....-.......-................. ..`.rdata..vQ... -..R....-.............@..@.data....4....;......X;.............@....pdata...6....<..8...&<.............@..@.didat..H.....?......^>.............@....rsrc.........?......d>.............@..@.reloc..$o....T..p....S.............@..B................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\mfc140u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5640568
Entropy (8bit):	6.7289957808607515
Encrypted:	false
SSDEEP:	49152:36jqWNjLlOwKt9FIKWqI5slMjDU414Z7Rh7GbmFDfqSA7vmUD4BwdpttcE6lruSB:36d9OX6cmIlFFLOAkGkzdnEVomFHKnPK
MD5:	6D200B52081D4CA30DCF2AB088AA767B
SHA1:	022FFAE9DEE8C4CE28716A7877D3AF1FCAF574B5
SHA-256:	2F8B69BFB5CDD55A8AAB17AEC44BED2A8C7DF39AF6DEE5569AD86279E808FEAB
SHA-512:	9F9CA5F0BCA7D27AD623AA8B52B3DCF640F6285A9A12172BCD148C06DD44BA15D579B04F9B9A0F077511424BEAAD85B9D9B1AA319EE1FFFAD41A8F23ED227512
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........n..n..n.....o.....o.....t..g._.z.....j.....f.....}..n........v.....h...........o....3.o.....o..Richn..........................PE..d....T^`.........." .....&-..,).....0W,.......................................V......aV...`A..........................................:.....(.;.......?......0=..8....U.x#... U.,p....5.T...........................`...8............@-.P....:......................text...L%-......&-................. ..`.rdata.......@-......-.............@..@.data....6....;.......;.............@....pdata...8...0=..:....<.............@..@.didat..H....p?.......>.............@....rsrc.........?.......>.............@..@.reloc..,p... U..r...\|T.............@..B........................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\mfcm140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	84880
Entropy (8bit):	6.141383165715554
Encrypted:	false
SSDEEP:	1536:Sq3TGyLH5++0yWf5aZfNtSkaELru04/swGRkaMBm9/20Abvgf:XGij0yjVaELru04/syNe2k
MD5:	204F150EFF6AF9DC81160EBD1CB1EC95
SHA1:	26647AF75428CF9800AB167005CEF33F34E72D9E
SHA-256:	2CE7F83679C00FB2E6A82D1DFB7B09F6D3A28FC21E5579A635E28397D22348B8
SHA-512:	630C40B4068EC0278501CF1E88D26CD621DB9EB5ECDE9A20756DDAA1ECAEC5D4EDF695044C79766D7932B77FFA58B561FE893B7035FCEACBDE9213D123196527
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..xy.+y.+y.+...{.+g.'+{.+.....+...q.+...z.+p.'+}.+...\|.+y.+..+...\.+...x.+..K+x.+...x.+Richy.+................PE..d....T^`.........." .....F..........QO..............................................1*....`A.........................................0......@1.......p.......`.......(...#...........y..T...........................Px..8............p..p............u..H............text...\|@.......B.................. ..`.nep.........`.......F.............. ..`.rdata..(....p.......J..............@..@.data...h....@......................@....pdata.......`......................@..@.rsrc........p......."..............@..@.reloc...............&..............@..B................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\mfcm140u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	84880
Entropy (8bit):	6.133297780794333
Encrypted:	false
SSDEEP:	1536:DC3upamWV+0fYRQs4MYkafzjGi4/swGxvVOi9Qm9/20/EvU:vpt0f8/4MnafzjGi4/sHD9d1Z
MD5:	CA26AEB869F362999F98D8EE445F2FA9
SHA1:	DB0D16C8E2EA1E06785843CCD41437E528978957
SHA-256:	41B1489817B6361659224E1DF06133E906049B3E83CA6F6A629058E1637F2163
SHA-512:	09D7B5BADF4E9DA198790138017FC9B78089BC10655EB7B342FCBE337A7445E24E4588A8F310A2C7FBC55A627D1040655077385185D632D02E717DAA9ABD7AE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..xy.+y.+y.+...{.+g.'+{.+.....+...q.+...z.+p.'+}.+...\|.+y.+..+...\.+...x.+..K+x.+...x.+Richy.+................PE..d....T^`.........." .....F..........QO..............................................[0....`A.........................................0......@1.......p.......`.......(...#...........y..T...........................Px..8............p..p............u..H............text...\|@.......B.................. ..`.nep.........`.......F.............. ..`.rdata..(....p.......J..............@..@.data...h....@......................@....pdata.......`......................@..@.rsrc........p......."..............@..@.reloc...............&..............@..B................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	564112
Entropy (8bit):	6.4815093653930145
Encrypted:	false
SSDEEP:	12288:eUfve/yP6vdqumz2etG5ePx2Fl5/G3XLSNPDaQEKZm+jWodEEVf9+:ePbl9G32ZDaQEKZm+jWodEEB9+
MD5:	AAD273615E4370EEE181313CE425A738
SHA1:	2B970508D5089912CADA1F28DA05FB43AE4C37CB
SHA-256:	45AB2B54C433C6721589B1D7918F9C3F52F198A187DF4531B9A81E9DAB1385E1
SHA-512:	7E1AB0B6A9CDD7E4C2D981AF42C4A22763CA36013AA346D6499C339C58D0F7F1DC13DAC50F21479DEB9C4E2731E1FB5D2BDD9F7889E0BED0E18E2C1739836B7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................s........9.......X..N......N......N......N......N......N.U....N......Rich...................PE..d....R^`.........." .....8...Z......0$..............................................$.....`A.........................................2..h...X...,............p...9...x...#......0.......T..............................8............P...............................text...L6.......8.................. ..`.rdata.......P.......<..............@..@.data...p:...0......................@....pdata...9...p...:...0..............@..@.rsrc................j..............@..@.reloc..0............n..............@..B........................................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\msvcr120.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	971064
Entropy (8bit):	6.965132668528083
Encrypted:	false
SSDEEP:	24576:wmFyjHVMxBuwQLYucGp4iiqgNb3HoIbiIw:2My2yRgFoIbnw
MD5:	2FB20C782C237F8B23DF112326048479
SHA1:	B2D5A8B5C0FD735038267914B5080AAB57B78243
SHA-256:	E0305AA54823E6F39D847F8B651B7BD08C085F1DBBCB5C3C1CE1942C0FA1E9FA
SHA-512:	4C1A67DA2A56BC910436F9E339203D939F0BF854B589E26D3F4086277F2BEC3DFCE8B1F60193418C2544EF0C55713C90F6997DF2BFB43F1429F3D00BA46B39B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0iP.^:P.^:P.^:..:S.^:P._:..^:]L.:..^:]L.:1.^:]L.:f.^:]L.:..^:]L.:Q.^:]L.:Q.^:]L.:Q.^:RichP.^:........PE..L.....~W.........."!.....................................................................@.........................`........R..(....p..................8?......D]......8...............................@............P...............................text...y........................... ..`.data...<e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..D].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\ssleay32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	373152
Entropy (8bit):	6.18826988009013
Encrypted:	false
SSDEEP:	6144:3k6a2HMG1O3NI6GMEydEZN/ynK6IMBVwxrhjEqU36sCE1fj7bnvF131I1k4cq/Fi:U6a2HMG1sNI6GMEydEv6KrMBVwxrhjED
MD5:	9E38C4E6116F32B1D3F9A7FE9A853676
SHA1:	7658720F300180B22538B29DAEA7511027CC65FB
SHA-256:	73A5A3AC966167983F35B13C8D8ACD337617307899B1F114072068AD4C7FFA7F
SHA-512:	1773AF66F1DC920B31E5A1BC98E1796E211ED2F074431CCFC82E41EDCC95ECEBDE1509A3A2669FF05AD308A6763E33B978FE678BF737E21FCAE54DB21ABF2753
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........& ..Hs..Hs..Hs...s..HsX.Ir..Hs..Ir..HsX.Mr..HsX.Lr..HsX.Kr..HsZ.Ir..Hs..Is(.HsZ.Lr..HsZ.Hr..HsZ..s..HsZ.Jr..HsRich..Hs........PE..d....Q.b.........." ......................................................................`..........................................6...)..P`..........H.......,%.......)..........`...T...............................8...............@............................text...(........................... ..`.rdata..............................@..@.data...p............\..............@....pdata..,%.......&...N..............@..@.rsrc...H............t..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1128496
Entropy (8bit):	6.806056436078238
Encrypted:	false
SSDEEP:	24576:hsh8IBDlcakOq8x8XISuTJQuR0J7mcvIZPoy4UW:hg8Oh7GuTJQuCJwW
MD5:	4CD086A05C35D5E53CB5682B3A015BA2
SHA1:	1721F82F06E6ADC8D6284DF30F45D570D764AB85
SHA-256:	9704512EECD0B666F54A0B5E14932A5C3EFFB3762026CDBE0D2E7CC9D41E41CE
SHA-512:	40C70A6F098FD6F6F996781CF73DC3A0DE4AD088734B46EE70D1486AFF2B7DA11F42810EC893D9714EB8C4AE0FE9E11EE6DECFA6FD0D68E633EB20891C415428
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.@yu..u..u..\|.F..u./...>..t..>.+c..>..+t..>.-+...>.+++..>. +...>..t..>.,+t..Richu..*........PE..L..................!.....,..........`........@............................... ............@A.........................^......xb..........................0L.........\...T............................"..@............`..p............................text...P+.......,.................. ..`.data...4....@.......0..............@....idata..2....`.......@..............@..@.rsrc................V..............@..@.reloc..............\..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\uninst.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	436548
Entropy (8bit):	3.8009488650090337
Encrypted:	false
SSDEEP:	3072:zEre7GjyCaFvc4gCIk/7wEpvtUj95YSQt:zPX5g2FUfYSc
MD5:	A7D9E0DFF0A9C0FD0327EC9C140DF053
SHA1:	6A558D18B967AA32322153878035CDEBBE1B7FC2
SHA-256:	FC9B378C7679F171CA04FB9BB42423AFD48B0B7F62D4468A6A17689121DE5119
SHA-512:	3991E5D89FD89DAC48265A41CE5152CB4BFDC123973AEE942F0630D27C7E4164E4F2069AC60E5C1977971806EAAABE12995549BC9613484F12FCC164E261124F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....$_.................d..........a4............@...................................Z...@.................................8.........................Y..)...........................................................................................text...<b.......d.................. ..`.rdata..t............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\vcamp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	394640
Entropy (8bit):	6.339925813861082
Encrypted:	false
SSDEEP:	6144:PxanGaVFSxLukLxUrcYntAPTbRLbcCoK61AyDG2KJMNLraYIvUBrB+vr:HEFqsr1nKPTbRLbcwEAyLO6LWqBI
MD5:	BA3FF067C8C20EB5D6B587C3CD93C7A9
SHA1:	AAE5A0F304B22A4D732DC6CC013C80F480165CD2
SHA-256:	E0EB5DFD4E56C3208B96A75A1F714DA33140064F77B1B50F95E52AE58A65BFE6
SHA-512:	4B730C417F4C4F347709882455F8814F0DA9A5D75CE27EB5D82D5119A5F26CB5077D13EEF87EE12A98A3B9F920F8DEC67F1E84A5E83DE46C8EC84C67A922F647
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........e.6.6.6..n6.6...6.6>.7.6>.7...6>.7.6>.7.6..7.6.6...6>.7.6>.7.6>.l6.6..6.6>.7.6Rich.6........PE..d....T^`.........." .........:.......I....................................... ......oF....`A............................................,8..,G..T.......8$......x6.......#......<....(..T....................*..(...`(..8...............(............................text...l........................... ..`.rdata..n...........................@..@.data....3...`...,...P..............@....pdata..x6.......8...\|..............@..@.rsrc...8$.......&..................@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\vcomp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177552
Entropy (8bit):	6.3300341814058285
Encrypted:	false
SSDEEP:	3072:uawAPnMhspAuNoREJFpyiYsLZD1YY7hmUDOJaR96Om/6:bpfYoAufptYsLZRpOJ26Z/6
MD5:	C9C027D49E59E4E8FAA38B64D6B301B6
SHA1:	FB98FA62D0579A341369C169FBD8312D806AE226
SHA-256:	E5065D53BE0A991607C396278F51C720E083AB1D0740364A0E537A31DCF61513
SHA-512:	8F817ADE11BD48C2153352B74D048D4B957A1BFF72A4E98992B4AFF755094B9A287229D8B27F5E299772161F744096FC80451CC4CA832813D21D35F7283BD5B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Jm.$>.$>.$>..'?..$>..!?..$>.. ?..$>+.!?.$>+. ?..$>..%?.$>.%>..$>+.'?..$>+.-?..$>+.$?.$>+..>.$>+.&?.$>Rich.$>........................PE..d....T^`.........." .................g..............................................Z.....`A.........................................W......Xe..(........................#...... ...8A..T............................A..8............................................text.............................. ..`.rdata..............................@..@.data...4....p.......V..............@....pdata...............b..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc.. ...........................@..B........................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	96120
Entropy (8bit):	6.440691568981583
Encrypted:	false
SSDEEP:	1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
MD5:	4A365FFDBDE27954E768358F4A4CE82E
SHA1:	A1B31102EEE1D2A4ED1290DA2038B7B9F6A104A3
SHA-256:	6A0850419432735A98E56857D5CFCE97E9D58A947A9863CA6AFADD1C7BCAB27C
SHA-512:	54E4B6287C4D5A165509047262873085F50953AF63CA0DCB7649C22ABA5B439AB117A7E0D6E7F0A3E51A23E28A255FFD1CA1DDCE4B2EA7F87BCA1C9B0DBE2722
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.[...[...[.......Y...R...P...[...w.......V.......K.......D.......Z......Z.......Z...Rich[...................PE..d....R^`.........." .........^......`.....................................................`A.........................................A..4....I...............`..L....T..x#..........H,..T............................,..8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....P.......<..............@....pdata..L....`.......@..............@..@_RDATA.......p.......L..............@..@.rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\vcruntime140_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36728
Entropy (8bit):	6.340048377061949
Encrypted:	false
SSDEEP:	384:nNn62MCmWEPhUcSLt5a9Y6v4HOE5fY/ntz5BBW0O3+XfeuncS79+pWrQKWhD/HRj:YdCm5PhUcxgHY/ntXBzxvV7KtDvCTO
MD5:	9CFF894542DC399E0A46DEE017331EDF
SHA1:	D1E889D22A5311BD518517537CA98B3520FC99FF
SHA-256:	B1D3B6B3CDEB5B7B8187767CD86100B76233E7BBB9ACF56C64F8288F34B269CA
SHA-512:	CA254231F12BDFC300712A37D31777FF9D3AA990CCC129129FA724B034F3B59C88ED5006A5F057348FA09A7DE4A0C2E0FB479CE06556E2059F919DDD037F239E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8@..9...8}..9...8.._8...8...8...8}..9...8}..9...8}..9...8}..9...8}.38...8}..9...8Rich...8........PE..d....R^`.........." .....:...4......`A....................................................`A.........................................k......<l..x....................l..x#......<...(b..T............................b..8............P..X............................text...u9.......:.................. ..`.rdata..P!...P..."...>..............@..@.data... ............`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..<............j..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\OCS Inventory Agent\zlib1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94112
Entropy (8bit):	6.679423998554188
Encrypted:	false
SSDEEP:	1536:532sok7R2s01PuWi4hWFpB7J0gd3InToIf8IOQIOn59vyb+4DakRkQ+8iAH:Ushd2a540FpZdsTBfyGnLvj4DakR7DH
MD5:	50D3BE82608F4C17EBB0F80CCA4534D4
SHA1:	B213D9702DDAD0EDF20664447078063E6103E224
SHA-256:	438333DCA2EF87ABB4667411A6AF26F6DAECADAB3BE892354558E18F24E8094C
SHA-512:	A6B334625E0192159077AC8C91D79238A383185C3F715A72CC63A51C7207478B240CB294DD9788D5A53D6A486A1880327221452137B79EE1D899DD4F2634CCE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8...8...8...@G..8..0L...8...S...8...8...8..W)..8..0L...8..0L...8..0L...8..2L...8..2L...8..2L...8..2L+..8..2L...8..Rich.8..........................PE..d...^m.`.........." .........\|......p.........LZ.....................................+....`..........................................4.......;.......p.......`.......F...)......t....#..T...........................P$..8...............p............................text............................... ..`.rdata..6a.......b..................@..@.data........P.......2..............@....pdata.......`.......4..............@..@.rsrc........p.......@..............@..@.reloc..t............D..............@..B........................................................................................................................................................................................................................

C:\ProgramData\OCS Inventory NG\Agent\Download\ocsinventory.ini

Download File

Process:	C:\Program Files\OCS Inventory Agent\OCSInventory.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.77548397862178
Encrypted:	false
SSDEEP:	3:1ouRbwX9EqXOpEtCyFpZ13X1p+MyYAmfxJAlboysVy:CuRbwX9CsCUhFoqHs+Vy
MD5:	1ECB0A2D364B048956E89D53D37E032A
SHA1:	56D892BED17A176CD09E64118D18C23B27FDEA9A
SHA-256:	FF239E21A9623C9584E14ABC6B16EF2A4801C2C420FF59FE6899CA260A4B4FCD
SHA-512:	6E0373ECD9C1CC8235C0A05F5B8A2AAABBE9ABE4431A4B66D5BB4D3EF7B28D26A8B3C2C5A6057D1E1FF114504E91CA3519256AE452319A7EBCF71D2CD63F1439
Malicious:	false
Preview:	[OCS Inventory Agent]..FragLatency=10..CycleLatency=60..PeriodLatency=1..PeriodLength=10..Timeout=30..CommandTimeout=120..On=0..

C:\ProgramData\OCS Inventory NG\Agent\Saas.ps1.xml

Download File

Process:	C:\Program Files\OCS Inventory Agent\OCSInventory.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1686
Entropy (8bit):	4.982442517822286
Encrypted:	false
SSDEEP:	48:QG1HjMVsD+F3+CasFIswFrtbNsXlgk26H521623:lh+h+CasysfgAU
MD5:	97487EB34B583A7399BE27164F950215
SHA1:	8F84A399E6C361F4FD8D59E6AA7F6A0DEAC9D465
SHA-256:	4CFD3A0A6C87BD510FAAB702B14595E11479EF9678EB99DF95408F5C247FE9C2
SHA-512:	BDD9658ECDB073471AD64949A0B5260C5C86F7E48259EF4ECE5C1E373EBA44DA53D419B5FE8235FE3A4CB2F2AA0CD572B78DE4D9495E0C6653CB431CD2A3F94D
Malicious:	false
Preview:	<SAAS>.<ENTRY>portal.fm2c.com.br</ENTRY>.<DATA>119.8.87.215</DATA>.<TTL>3535</TTL>.</SAAS>.<SAAS>.<ENTRY>ti.fm2c.com.br</ENTRY>.<DATA>119.8.228.120</DATA>.<TTL>3578</TTL>.</SAAS>.<SAAS>.<ENTRY>ctldl.windowsupdate.com</ENTRY>.<DATA>wu-bg-shim.trafficmanager.net</DATA>.<TTL>205</TTL>.</SAAS>.<SAAS>.<ENTRY>wu-bg-shim.trafficmanager.net</ENTRY>.<DATA>wu.azureedge.net</DATA>.<TTL>205</TTL>.</SAAS>.<SAAS>.<ENTRY>wu.azureedge.net</ENTRY>.<DATA>wu.ec.azureedge.net</DATA>.<TTL>205</TTL>.</SAAS>.<SAAS>.<ENTRY>wu.ec.azureedge.net</ENTRY>.<DATA>bg.apr-52dd2-0503.edgecastdns.net</DATA>.<TTL>205</TTL>.</SAAS>.<SAAS>.<ENTRY>bg.apr-52dd2-0503.edgecastdns.net</ENTRY>.<DATA>hlb.apr-52dd2-0.edgecastdns.net</DATA>.<TTL>205</TTL>.</SAAS>.<SAAS>.<ENTRY>hlb.apr-52dd2-0.edgecastdns.net</ENTRY>.<DATA>cs11.wpc.v0cdn.net</DATA>.<TTL>205</TTL>.</SAAS>.<SAAS>.<ENTRY>cs11.wpc.v0cdn.net</ENTRY>.<DATA>72.21.81.240</DATA>.<TTL>205</TTL>.</SAAS>.<SAAS>.<ENTRY>ocsp.digicert.com</ENTRY>.<DATA>ocsp.edge.digicert.com</DATA

C:\ProgramData\OCS Inventory NG\Agent\admininfo.conf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	133
Entropy (8bit):	5.07125068656256
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgC4vtdw2aMf2duN1gQ1F2pgukH5pgWKvmSaMv:TMVBdYrw2dBDgAgk5KvmSN
MD5:	47C2933791A68A2AD12398F8BD7D703F
SHA1:	B9130D8DFE7B3E3DC00E59FFDCF05C99B53ED5B5
SHA-256:	4E381A46F8DCB656DDF23F9EF19B726403AB9576CEBD9E72325730F20C22A800
SHA-512:	221E2A803B456310C873E984860F8ACC749AF1D2B773BEB44487409426D98072EDEC713E5FDE0CE1FA8367598A2ECE87F872005B9A9A75F7BA006CC049B6F546
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<ACCOUNTINFO>.. <KEYNAME>TAG</KEYNAME>.. <KEYVALUE>office</KEYVALUE>..</ACCOUNTINFO>..

C:\ProgramData\OCS Inventory NG\Agent\last_state

Download File

Process:	C:\Program Files\OCS Inventory Agent\OCSInventory.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1527
Entropy (8bit):	5.01780329284287
Encrypted:	false
SSDEEP:	24:2dPvtYLJqfsnNbDbUCFM9M2uhgbzxqUhi/VHE3VH0A61dwWwSYM5+aNv:cPVYL3pDwCFM9M/gbzxvhi/hc61Twwzv
MD5:	83EE660E3BD7B85B633620DCE898AFD9
SHA1:	343B319CB303366989E848F2D2155EA6F62D9F03
SHA-256:	B97C66617C26DC164D28421FC25C1C8DA1BC1D5700AA4F5B5D620D2BCB87FC9F
SHA-512:	0C325E2C462E2914002C42FE8FEB03FE17C3C8D60D4D9D2230780F53054DF695267D74DA2D926FE11231FE72C3BC5D00E08D18B8BFC9E70D49AAFED1ED6B7A35
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<LAST_STATE>.. <HARDWARE>E210B71BB35F9B4BA5FD87D65D7A1D9488B72A5B</HARDWARE>.. <BIOS>DE724F3CD7B297A3C86EF168AA009CBD7AC5A4B9</BIOS>.. <MEMORIES>5512A3E622FFE91C9650118DA6D5C4AF797DAAA4</MEMORIES>.. <SLOTS>D2F5186B9E8E79A87439AA7A3A4EB4F6FC98532F</SLOTS>.. <REGISTRY />.. <CONTROLLERS>CC9CA58F1FECF52402CE6EE3D007AEDDD4107D29</CONTROLLERS>.. <MONITORS>26BEFF9A9133551FF794D3396B45364A0BDB6A01</MONITORS>.. <PORTS>D773E8DA55D67700B45D90E4070CC756E6D1BC59</PORTS>.. <STORAGES>140AB975169109D2BD71DE22A9DD551519689807</STORAGES>.. <DRIVES>AF2FB26F81125C83D6B04EC6DE8574A527FC5427</DRIVES>.. <INPUTS>F41CF5200451925F8096B69B620EB82D5924E89D</INPUTS>.. <MODEMS />.. <NETWORKS>5742CCA9AEC5023574CBC451CEC6CEC70DF09FCA</NETWORKS>.. <PRINTERS>E633AE7D05D8AB6F640FDBB2A0B95C97DCCEEC18</PRINTERS>.. <SOUNDS>63020CAD866BA09A2111EA173A388AD821DF0284</SOUNDS>.. <VIDEOS>C5BBC1F4103C006A8F3B70742ABBD18829A0DA4E</VIDEOS>..

C:\ProgramData\OCS Inventory NG\Agent\ocsinventory.dat

Download File

Process:	C:\Program Files\OCS Inventory Agent\OCSInventory.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.581467880199449
Encrypted:	false
SSDEEP:	3:WRCQtgU2S7x4OuuKa:WRTtpfN
MD5:	689EA33056B228944B1B16AF8FCC14A6
SHA1:	DF299D8D202FE5BE7F47844910970B692009A4C4
SHA-256:	0741628E26538A6D438AB15D7B9DA2ACF8E755CBBE801D8FC18967D5C135AA94
SHA-512:	A276160CF7A679EBDF2BDCB9330AA9867751CBD24BA7EDDC8267609CFB4F024D80CC6D948827F6FCD38E7B9334DB282157C9A2E4703FE1FCCFE4696EA923A794
Malicious:	false
Preview:	x.241470.5202.50.50.!#c]c..Wg+7.+''+WG+CS+........

C:\ProgramData\OCS Inventory NG\Agent\ocsinventory.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	Generic INItialization configuration [HTTP]
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.436232770962316
Encrypted:	false
SSDEEP:	6:CuRbHQIY5XjKVWVuLyP4TcfihqsZpnX3DgvREvO/KeYyZbleiQeuJuR6jMUo3xzX:uL5XjC+QSiIsZpnDgmvOEg79U6Wq
MD5:	3EAD26B2DFDB703694FD376E7D367910
SHA1:	84DA6C814064C57CC72B591D1109D74C21C85432
SHA-256:	127BA55E416DEA91F57CF874FB793E6A9BE86B0F9273069F2FC76D9BD37ACB5D
SHA-512:	554880BB67EF280D75DBF51DE292C2DCE70DE993175768D18C62BFC69621F5872D1F70A8D878AD169954FBEADC628B06F7496DDCB4270751CF081DC4DDFE8B14
Malicious:	false
Preview:	[OCS Inventory Agent]..ComProvider=ComHTTP.dll..Debug=0..Local=..NoSoftware=0..HKCU=0..NoTAG=0..IpDisc=..WMI_FLAG_MODE=COMPLETE..DEFAULT_USER_DOMAIN=..[HTTP]..Server=http://ti.fm2c.com.br/ocsinventory..SSL=1..CaBundle=cacert.pem..AuthRequired=0..User=..Pwd=..ProxyType=0..Proxy=..ProxyPort=0..ProxyAuthRequired=0..ProxyUser=..ProxyPwd=..[OCS Inventory Service]..PROLOG_FREQ=24..INVENTORY_ON_STARTUP=1..OLD_PROLOG_FREQ=24..TTO_WAIT=27000..

C:\ProgramData\OCS Inventory NG\Agent\ocsinventory.log

Download File

Process:	C:\Program Files\OCS Inventory Agent\OCSInventory.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	875
Entropy (8bit):	5.056224993741618
Encrypted:	false
SSDEEP:	12:tNztG1cZI6fZ16ESpMlvxXGmcrmX3ExOCrmKG7aSxdQLWFWSKvLjcSgLeOG7vE1i:1ys1AuGLrmVZLeWFWSmXgYE1Nv0Tf
MD5:	68182A0E9C7891597A77B6273F94278F
SHA1:	CECA354ECCE656EA17AD7B97FEDE7B11005E8079
SHA-256:	DF784EB713418821B87073388C0ADC5992A442238BEA514E75E3B3A36C5F413D
SHA-512:	6AD0E50F5E82477930FE7DF16688AA8C3062D4C7001D33C82210D17C270ABA8D7A2A931CD6DB3D8D82F4F26AC22CD0574572DB91FC4E073BC598D42C08F1B275
Malicious:	false
Preview:	==============================================================================..Starting OCS Inventory Agent on Saturday, March 02, 2024 02:23:53...AGENT => Running OCS Inventory Agent Version 2.9.2.0..AGENT => Using OCS Inventory FrameWork Version 2.9.2.0..AGENT => Loading plug-in(s)..AGENT => Using network connection with Communication Server..AGENT => Using Communication Provider <OCS Inventory cURL Communication Provider> Version <2.9.2.0>..AGENT => Sending Prolog..AGENT => Prolog successfully sent..AGENT => Inventory required..AGENT => Launching hardware and software checks..AGENT => Sending Inventory..INVENTORY => Inventory changed since last run..AGENT => Inventory successfully sent..AGENT => Communication Server asked for Package Download..AGENT => Unloading communication provider..AGENT => Unloading plug-in(s)..AGENT => Execution duration: 00:00:16.....

C:\ProgramData\OCS Inventory NG\Agent\ocsinventory.log.bak

Download File

Process:	C:\Program Files\OCS Inventory Agent\OcsService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	5.173516233416579
Encrypted:	false
SSDEEP:	24:1ms1AuGLrmnxvUU7s1AuGLrm1FOFuiZLeWFWS0yVPXgYE1Nv0w:1ms1VaC+U7s1VaC1FOFuItvVPe
MD5:	47BA7C8132A052F531ADC03BAE1D9205
SHA1:	919DA7EDCC2A4D4068B78E08A4730BDE7FCE3D06
SHA-256:	5BDF41F9C6FD3BAEBF3CE3D6E82596224172E10B7E51761CA4737F26C261B752
SHA-512:	7B61503C84858FA902D621699DBAD843C512234D48D90A26B25A0DF3BEF563ADE5B486AD43A9FE04EB09E5BD38240D5E14E1F9A96518BD0CB369F874C44271C8
Malicious:	false
Preview:	==============================================================================..Starting OCS Inventory Agent on Saturday, March 02, 2024 02:23:31...AGENT => Running OCS Inventory Agent Version 2.9.2.0..AGENT => Using OCS Inventory FrameWork Version 2.9.2.0..AGENT => Loading plug-in(s)..AGENT => Using network connection with Communication Server..AGENT => Using Communication Provider <OCS Inventory cURL Communication Provider> Version <2.9.2.0>..AGENT => Writing configuration to file <C:\ProgramData\OCS Inventory NG\Agent\ocsinventory.ini>..AGENT => Unloading communication provider..AGENT => Unloading plug-in(s)..AGENT => Execution duration: 00:00:00.....==============================================================================..Starting OCS Inventory Agent on Saturday, March 02, 2024 02:23:34...AGENT => Running OCS Inventory Agent Version 2.9.2.0..AGENT => Using OCS Inventory FrameWork Version 2.9.2.0..AGENT => Loading plug-in(s)..AGENT => Using network connection with Communicatio

C:\ProgramData\OCS Inventory NG\Agent\rand

Download File

Process:	C:\Program Files\OCS Inventory Agent\OcsService.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.824981762236599
Encrypted:	false
SSDEEP:	24:F6+fZwOz0l9GSZPaOEqpYBOLtmJuT5DfqJIdrO19MFQo2Lw+VMYQAzH:FvFzcJZPaOTpQYtmJuTFyIdrO19M6tG+
MD5:	44B89EA39408BD1FF7989D7BE4A43A5E
SHA1:	46C9E1A7D2C66EEFAD6458EBBC780F3C1D37B044
SHA-256:	8A55FEDB9822A6D2EF06DBBDC63EC90E07C024F9EEED9EA58987A041A6F0541C
SHA-512:	50F53B80F2B13EE4706B59D904DAD33E5E2677767F6E80FAB6B463D810E81B2C1934D18B80B6B3D5743681D05C2D0E60F27CEFBB2E4E89A865E0848F9C45F8C2
Malicious:	false
Preview:	..:.0W.A..YF\|...y.........2...#c^._#....)/.........A-.j. .E....n.&&0..n.x6..Zw.....#~...7......f,.D.g...........`..sG(KP.1M\|.)..... .G,...4...E].v..f.i..~..]..v.S.....~.ZWih~.`..R...^...a+%4\|j.n`....d..t...w...s.RE....-..o.'}.....4.......TC.......X.(..U..d.....Wl..($.s.u..U(.f.].Q.Q]....R@v..;..1..4)..B.g..jz..a...3./..F.d..Y......".t..7..(h.?.).u....5.%+]J.0....w..s..Fk.9.c.;o...H.......v+FY$.{6.u.uX.z7...t...\|........u....ff.i......ek..a@?..D.L.Jg....ch[...3.......PB...8...C.....j[h.o....G....d..$....Q..-c,.A.qi..n.....4.n....h.. ..._...9..EF......+...X7DLT.Z..s..2].....s.pb.S.....i.ZW+.....\|..3N..>..r.c...\........Y...9~t....Kt.).4.*6.~k]..'.).V.j...aE.@...9...2.....X. .5.a!.j.....g...?.N..\.......:.@...."..-G$..P....{..7..........V.qf..A.:\|b..L3.8.IA.L.D..k..Y.>\|...'....)....{2H.'.....<..@..i...."...k...YE....c>xflL....[.ze.M...QM.....J`V.<$O.7..6..}`u`Y....a......V........{..."..=ve7C.Z.~.N.b.k"...p.. .W_..dB.=..a..:.7.3...)...H'..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ocsoffice[1].exe

Download File

Process:	C:\Users\user\Desktop\ocs-office.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	6225663
Entropy (8bit):	7.925666116447602
Encrypted:	false
SSDEEP:	98304:hk8ZyHrQeSVQxYqYqwD9VjNodewaJ2K1zHPzOYJjBKLOwelpGCy:hk8ZyH1jYqcideH1YOweCCy
MD5:	BCD0D1EA9750CA6F018DA33DD41552B1
SHA1:	D5AE2A1432CD5397AB0E13C673364B5E153354C0
SHA-256:	6E0CEFC100A0C17B46F593078F116053E41CF46A2E272C8694A2CFFA29B640E0
SHA-512:	26D303E0D66FFDFDC118BAB0B0E1436C24F6D45B96C6526F515F4F85150342407C37BE0426B2305B2E60A0AEF85A0976E7196AFC9182DCDE6490DD731B0A125E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.....F..G.w.F.....F..v..F...@..F.Rich.F.........PE..L......].................d...\|......k2............@..........................`............@.................................<...........h............................................................................................................text....b.......d.................. ..`.rdata..J............h..............@..@.data....U...........\|..............@....ndata...................................rsrc...h...........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_imct11v2.4ft.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sl2l4aub.xb2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OCS-Windows-Agent-Setup-x64.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	5.165821133417603
Encrypted:	false
SSDEEP:	48:wcJ4GJ3I//qGfdEOMFcZxmAw+apFqSmf4WZiJ3W514yoA9S6XxTOKG4Lz:wcaGJ3IHEOMFcZ4lcNZiY/4HA86XxTOo
MD5:	D6530B0E0EC8FA2DD80F034A2D84FB05
SHA1:	09709AD2D0B68AFCE2F13E931BB3CA6B9A2998CA
SHA-256:	9B0C72F8A8DDA39DF4A73290F3E66648891E9E3E5A504E9CDE1B6361055876A1
SHA-512:	4ECAC12A5EEB3CD8B7C62E928264C426A57849A976A92B191697D363F07ACA66E660634114656B148F041DE201E454D0083D54F8EBBA32258AD1E0B6523B677C
Malicious:	false
Preview:	********************************************************..Starting OCS Inventory NG Agent 2.9.2.0 setup on 02/03/2024 at 2:23:01..Checking if setup not already running...OK...Checking Operating System...OK, Windows 2000 or higher...Command line is: "C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe" /S /NP /NOSPLASH /NO_SYSTRAY /NOW /TAG="office" /SERVER=http://ti.fm2c.com.br/ocsinventory..Parsing command line arguments...OK...Checking for silent mode...Enabled...Checking for splash screen...Disabled...Checking if logged in user has Administrator privileges...OK...Creating directory <C:\ProgramData\OCS Inventory NG\Agent>.....SetACL allowing Users / Power users read/write permissions on <C:\ProgramData\OCS Inventory NG\Agent>...Result: error..SetACL propagating inherited permissions on <C:\ProgramData\OCS Inventory NG\Agent\Download>...Result: error..Trying to determine if service was previously installed...No...Trying to stop service and kill processes.....Trying to find pro

C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsPlugins\o36516user.vbs

Download File

Process:	C:\Users\user\Downloads\ocsoffice.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3016
Entropy (8bit):	5.30970049375371
Encrypted:	false
SSDEEP:	48:eYpK5XnJIlg45FhIEX5KeKtRnTXJdYRHQDwXbAiNJpZ3doJXQTN2NkUHm5:lpKI/5vIcKeKTwqaAiNLZoX2UW
MD5:	06E43B247299069CA58AD57CAD956A9A
SHA1:	B0000965F320EB3632A74B4764C6924F9677DDF2
SHA-256:	A6080F6A677068F42C16708F755C606B79492E62B9824D7D7B367421183B6A88
SHA-512:	DF2BB6D2D1AB43E44ACC344C908AFCF9AF595A715A7182BDE1AC1CA7F0D38CDEC31CA38BA13C5D21C266FAF6E321D25BDB4B0771CE5001C859C407678034DC9E
Malicious:	false
Preview:	'----------------------------------------------------------.' Plugin for OCS Inventory NG 2.x.' Script :..Retrieve Office 365 16.0 user info.' Version :..0.10.' Date :..24/02/2021.' Author :..Erich Strewlow.'----------------------------------------------------------.' OS checked [X] on.32b.64b.(Professionnal edition).'.Windows 10. [X].[X].' Windows 2012 [X] [X].' ---------------------------------------------------------.Option Explicit...Const HKEY_USERS = 2147483651..Dim aUsers().Dim aIdent().Dim registryObject .Dim conn.Dim r.Dim k.Dim j.Dim sid.Dim email.Dim name.Dim lastlogin.Dim expirationdate.Dim d.Dim IsoDate.Dim IsoTime.Dim ident..Set registryObject = GetObject("winmgmts:root\default:StdRegProv")..'If OCS agent is started as a service, it knows the local users configuration only.'through HKEY_USERS. We scan all the registered users in the host, listing.'everyone with an Office 16.0 setup.r=registryObject.EnumKey(HKEY_USERS,"",aUsers)..If r <> 0 Then. wscript.quit.End

C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe

Download File

Process:	C:\Users\user\Downloads\ocsoffice.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	5907776
Entropy (8bit):	7.918957013591
Encrypted:	false
SSDEEP:	98304:9ljyhT2i2FwZ6Y2qoDzPP3KNmM0nucx1HZV24FbBe/2Q+7:9ljyhRx2q6SNmxvC2Q+7
MD5:	B2216E895278C44D8168F78188AB4FE9
SHA1:	1713934F28B6D254DBE81CA9CE1BC8E0F12B5A21
SHA-256:	8849DD8D74071A9120C461D9F6B6AD965165392B0681EAA22EB97CB423B7105A
SHA-512:	B7470E3FF93B2A66493B1D0A358D04E09D4DCE27B3DCBDA9B5FADBDF85329A049C7E029A9527A21471EA867600875D79A9D386F3110AE8806A3B448E8429D603
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....$_.................d..........a4............@...................................Z...@.................................8.........................Y..)...........................................................................................text...<b.......d.................. ..`.rdata..t............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\System.dll

Download File

Process:	C:\Users\user\Downloads\ocsoffice.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.854901984552606
Encrypted:	false
SSDEEP:	192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5:	0063D48AFE5A0CDC02833145667B6641
SHA1:	E7EB614805D183ECB1127C62DECB1A6BE1B4F7A8
SHA-256:	AC9DFE3B35EA4B8932536ED7406C29A432976B685CC5322F94EF93DF920FEDE7
SHA-512:	71CBBCAEB345E09306E368717EA0503FE8DF485BE2E95200FEBC61BCD8BA74FB4211CD263C232F148C0123F6C6F2E3FD4EA20BDECC4070F5208C35C6920240F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L......]...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\UserInfo.dll

Download File

Process:	C:\Users\user\Downloads\ocsoffice.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.3137381198157176
Encrypted:	false
SSDEEP:	48:qKDco4hlWl4WXXqQr1wHslNzrToTod/J/AMVyjlZSg7/R5gYpY7:5AZWRKQruHsLoodhNVyPgY
MD5:	E167F9A565781A30C03FF10370033319
SHA1:	1858758B076946073DE375C6EB1BEC9867AA3689
SHA-256:	A912514823DF595BA3A048099D3B89E925A4D41742AFC67E772060952892F312
SHA-512:	96D8F5AC8E2C0961BA71075DE52D12515E7A058CDDF3FA1EC14E77545B0B5F4E29324A13E2EB287A447F1D24DC9F09E0A70B0A25401B0EF8D90E6E4A96CE6C61
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..................[.........Rich..........................PE..L......]...........!................q........ ...............................P............@.........................@"......l ..<............................@..p.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data...X....0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe

Download File

Process:	C:\Users\user\Downloads\ocsoffice.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	417337
Entropy (8bit):	3.5034809290466633
Encrypted:	false
SSDEEP:	1536:rXoKlnzpMyqDQ+IJDDctJUX0DKR+colLDgCIk/V1wErZNF6H53Ro:bomnzVincQDKgc0gCIk/7wEaNRo
MD5:	3F4CD95A8DF390E36298093C74B3BF7E
SHA1:	AEC24EED92E075A02374E5C0735A0255BFA807A5
SHA-256:	235E273AAB3681F966A22EE1238E3E5D1E4865502D97ECA4D0C4ECAAA2E2AE06
SHA-512:	0E14C6B48F8EE22490615C4D28984481003A3CAEBF1EAFD2E5A9D08D0E3848AF3377158F2B8921B1CA125F1A7EBDD66928128DA588CB8B210D2FF2B2E84500C5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.....F..G.w.F.....F..v..F...@..F.Rich.F.........PE..L......].................d...\|......k2............@..........................P............@.................................<...........P............................................................................................................text....b.......d.................. ..`.rdata..J............h..............@..@.data....U...........\|..............@....ndata...................................rsrc...P...........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\ocsdat.ini

Download File

Process:	C:\Users\user\Downloads\ocsoffice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.32024493343668
Encrypted:	false
SSDEEP:	6:pDW6XVouRLaRAXWZouRmuRojwWDwkn23fwAruEhIvd2uDgvn:I6XUAXWUTwJfo1Pdjgv
MD5:	5348BB6D7130E3BE3BA54031F91DBDDF
SHA1:	859AA661563E76AEBFD55A0EAA45F0851F219ECE
SHA-256:	E0E7E69219FB7C6842048CC58527805BA4D8E588FEEE6BEFF61BA2A1C3FD88F0
SHA-512:	A223D7B7D56CEF7FA5A3102F87F2083A5AFEF726EB45CC5A18BE606A53092017503866ED6078AB9AC5D4A5973E3FDCB45F4ED448DA1BBE6C1CBBF30C58779BA9
Malicious:	false
Preview:	[Config]..InstallFolder=C:\Program Files\OCS Inventory Agent..DataFolder=C:\ProgramData\OCS Inventory NG\Agent..LogFile=C:\Users\user\AppData\Local\Temp\ocspackage.log..CmdLine= /S /NP /NOSPLASH /NO_SYSTRAY /NOW /TAG="office" /SERVER=http://ti.fm2c.com.br/ocsinventory..

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\KillProcDLL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.083312243715674
Encrypted:	false
SSDEEP:	384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
MD5:	83142EAC84475F4CA889C73F10D9C179
SHA1:	DBE43C0DE8EF881466BD74861B2E5B17598B5CE8
SHA-256:	AE2F1658656E554F37E6EAC896475A3862841A18FFC6FAD2754E2D3525770729
SHA-512:	1C66EAB21F0C9E0B99ECC3844516A6978F52E0C7F489405A427532ECBE78947C37DAC5B4C8B722CC8BC1EDFB74BA4824519D56099E587E754E5C668701E83BD1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..^&..&..&..]..'...........5..D..%..&..c.....%.....'..Rich&..........................PE..L......>...........!.....@...@...............P...................................................................... Z..K....U..(....................................................................................P...............................text....?.......@.................. ..`.rdata..k....P.......P..............@..@.data...h....`.......`..............@....reloc...............p..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\SetACL.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	559528
Entropy (8bit):	6.0903310211485335
Encrypted:	false
SSDEEP:	12288:ZM9AwIce16TCkcgxjouFmQGzt/B6QziZUt2qaV7se:ZM9Sce16TCkcgxMuFmQGztZZiSAqA7R
MD5:	3E350EB5DF15C06DEC400A39DD1C6F29
SHA1:	F1434CFEF2C05FDA919922B721EC1A17ADB3194E
SHA-256:	427FF43693CB3CA2812C4754F607F107A6B2D3F5A8B313ADDEE57D89982DF419
SHA-512:	B6B6CDFE2B08AA49254E48302385A3A2A8385E2228BDCFFD3032757ACF1A1D4ABFF1270F5488083CFA4480439FF161A9D0EA5F193CABC1EB1E7B1255CE262AB6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X..0..c..c..c...c..cs.>c..c.o.c..c.o>c'.c.o?c..c...c..c..c..c.o:c..c.o.c..c...c..c.o.c..cRich..c........................PE..d...QLNP..........".................8..........@.....................................'....@.................................................t...........`....`..\|>...r...............................................................................................text............................... ..`.rdata..............................@..@.data....T.......,..................@....pdata..\|>...`...@..................@..@.rsrc...`............L..............@..@.reloc..0............`..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.855045165595541
Encrypted:	false
SSDEEP:	192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5:	FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA1:	30E2A9E137C1223A78A0F7B0BF96A1C361976D91
SHA-256:	6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
SHA-512:	F4335E84E6F8D70E462A22F1C93D2998673A7616C868177CAC3E8784A3BE1D7D0BB96F2583FA0ED82F4F2B6B8F5D9B33521C279A42E055D80A94B4F3F1791E0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L.....$_...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\UserInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.3299050324162005
Encrypted:	false
SSDEEP:	48:qKiRbhg7V46Br1wHsl9rECxZShMmj3tPRYBA:52OVZruHs1xH6t+i
MD5:	ACBDA33DD5700C122E2FE48E3D4351FD
SHA1:	2C154BAF7C64052EE712B7CDF9C36B7697DD3FC8
SHA-256:	943B33829F9013E4D361482A5C8981BA20A7155C78691DBE02A8F8CD2A02EFA0
SHA-512:	D090ADF65A74AC5B910B18BB67E989714335E7B4778CD771CFF154D7186351A1BEBBC7103CCA849BDFA2709C991947FFFF6C1D8FDF16A74F4DFB614BCE3FF6FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..................[.........Rich..........................PE..L.....$_...........!................\|........ ...............................P............@.........................@"......l ..<............................@..p.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data...X....0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\agent.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	Generic INItialization configuration [Field 1]
Category:	dropped
Size (bytes):	1181
Entropy (8bit):	5.185937957037153
Encrypted:	false
SSDEEP:	24:ZYOwK01VZJRmoIp8NXRRoTlcx3/V1Bx77ouFjrpcSyFZJ1:SsAVFLRwuj77copDK
MD5:	B3443D34166CF60740E1900EB9F31DE1
SHA1:	D37381B5493D326191E77F1860B20B937F6EB1D5
SHA-256:	18CC4ECE01A1EF091F9283FB58E26D13896FD33DCFC95F5C4DFD072444F91484
SHA-512:	A35A034ADE5C0B7F0564CFF77B93F680A649FE4412A0ABFC109D5BFAEDE9E09BA24D972709DD8AFCB8BD263A399D5241508E331CBA44D091865716FCF9ABDC24
Malicious:	false
Preview:	; Ini file generated by the HM NIS Edit IO designer...[Settings]..NumFields=10....[Field 1]..Type=Groupbox..Text=General options.....Left=0..Right=300..Top=0..Bottom=70....[Field 2]..Type=Groupbox..Text=Setup options.....Left=0..Right=300..Top=75..Bottom=136....[Field 3]..Type=Label..Text=Specify TAG value :..Left=15..Right=78..Top=54..Bottom=62....[Field 4]..Type=Checkbox..Text=Enable verbose log..Left=15..Right=290..Top=12..Bottom=22..State=0....[Field 5]..Type=Checkbox..Text=Never ask for TAG..State=0..Left=15..Right=290..Top=38..Bottom=48....[Field 6]..Type=Text..Left=80..Right=290..Top=52..Bottom=64..State=office....[Field 7]..Type=Checkbox..Text=Do not register service - agent must be launched manually (= /NO_SERVICE) ..Left=15..Right=290..Top=89..Bottom=100..State=0....[Field 8]..Type=Checkbox..Text=Do not register Systray applet to automatically start (= /NO_SYSTRAY)..Left=15..Right=290..Top=105..Bottom=115..State=1....[Field 9]..Type=Checkbox..Text=Immediately launch inventory

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\agent2.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	Generic INItialization configuration [Field 1]
Category:	dropped
Size (bytes):	971
Entropy (8bit):	5.178089567295516
Encrypted:	false
SSDEEP:	12:ZYrltNkSeVpdJup7Lacl7r7v2NVWpyiZK7BpVoL4pCtXuplhsG5611pJhh5qFgE7:ZYOSI4FaEyVW/KBUZ+mG5611jh2Ft
MD5:	EDD5C98CA00BE1B4517A4D1B28C152FC
SHA1:	C1686F1DD9F6B35C1D83CEF9CD75FC115C0BD840
SHA-256:	ED8BA600B5DAF2F9DEADF00862CEC84DC9BF6DCAB8995EFC0DB7A75FEA1C40C6
SHA-512:	10AAF9A669674142233FCF7649ECB2EF6E1431541A324D83CE33E5F455819C703A8DA3ABB876B0D0B8D4E06C8DF7755D4F8457FC3F57B1BD64B93244622707D7
Malicious:	false
Preview:	; Ini file generated by the HM NIS Edit IO designer...[Settings]..NumFields=9....[Field 1]..Type=Groupbox..Text=WMI options.....Left=0..Right=300..Top=3..Bottom=102....[Field 2]..Type=Label..Text=Behavior of WMI calls :..Left=9..Right=85..Top=17..Bottom=27....[Field 3]..Type=Label..Text=Default user domain :..Left=9..Right=78..Top=81..Bottom=96....[Field 4]..Type=Text..Left=80..Right=290..Top=80..Bottom=92..State=....[Field 5]..Type=Label..Text=COMPLETE: Allow WMI to retrieve current domain user..Left=9..Right=285..Top=32..Bottom=40....[Field 6]..Type=Label..Text=If the WMI does not allow the recovery of the current user..Left=9..Right=292..Top=54..Bottom=64....[Field 7]..Type=Label..Text=READ: Not allow..Left=9..Right=62..Top=41..Bottom=49....[Field 8]..Type=Label..Text=which default user should OCS return ?..Left=9..Right=132..Top=65..Bottom=73....[Field 9]..Type=Droplist..State=COMPLETE..ListItems=COMPLETE\|READ..Left=88..Right=290..Top=14..Bottom=107....

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\local.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	Generic INItialization configuration [Field 1]
Category:	dropped
Size (bytes):	619
Entropy (8bit):	5.119705333270295
Encrypted:	false
SSDEEP:	12:ZYrltNMMc2j9MxLiVkjapLgDM2vgA8Nyr9itXCRh:ZYJcmwLskja18jgA8NmitXCRh
MD5:	06F67F6875C9F578509F1C65457875DF
SHA1:	D680727C9F4A126D1BE130B32B8A9DA553AFD6F0
SHA-256:	4EB25F2DF800FAAF060AFAC330B19EDE713D7218F79148428FB825652652604A
SHA-512:	84F766F0E62704EBFC9563A6E84EDC39F68D30EB31BF878B05E856D6CBC759D15E7D67A4EB034277CE6C4BDE931E4C1B2CBA2ABFCD6A6573D169B3C1A8F910DA
Malicious:	false
Preview:	; Ini file generated by the HM NIS Edit IO designer...[Settings]..NumFields=6....[Field 1]..Type=Groupbox..Text=General options.....Left=1..Right=300..Top=1..Bottom=70....[Field 2]..Type=Groupbox..Text=Save inventory result file to folder.....Left=0..Right=300..Top=76..Bottom=134....[Field 3]..Type=Label..Text=Specify TAG value :..Left=15..Right=78..Top=51..Bottom=59....[Field 4]..Type=Checkbox..Text=Enable verbose log..State=0..Left=15..Right=289..Top=25..Bottom=33....[Field 5]..Type=Text..Left=80..Right=290..Top=49..Bottom=60....[Field 6]..Type=DirRequest..State=C:\..Left=12..Right=288..Top=112..Bottom=124....

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsExec.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.151298966041169
Encrypted:	false
SSDEEP:	96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
MD5:	09C2E27C626D6F33018B8A34D3D98CB6
SHA1:	8D6BF50218C8F201F06ECF98CA73B74752A2E453
SHA-256:	114C6941A8B489416C84563E94FD266EA5CAD2B518DB45CD977F1F9761E00CB1
SHA-512:	883454BEF7B6DE86D53AF790755AE624F756B48B23970F865558BA03A5AECFA8D15F14700E92B3C51546E738C93E53DC50B8A45F79EF3F00AA84382853440954
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........PE..L.....$_...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\nsProcess.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.666004851298707
Encrypted:	false
SSDEEP:	48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
MD5:	FAA7F034B38E729A983965C04CC70FC1
SHA1:	DF8BDA55B498976EA47D25D8A77539B049DAB55E
SHA-256:	579A034FF5AB9B732A318B1636C2902840F604E8E664F5B93C07A99253B3C9CF
SHA-512:	7868F9B437FCF829AD993FF57995F58836AD578458994361C72AE1BF1DFB74022F9F9E948B48AFD3361ED3426C4F85B4BB0D595E38EE278FEE5C4425C4491DBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.I...I...I...n\|f.L...I...Q...@..K...@..H...@..H...RichI...........PE..L...`..N...........!......................... ...............................`.......................................#....... ..<....@.......................P..\|.................................................... ..`............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\proxy.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	Generic INItialization configuration [Field 1]
Category:	dropped
Size (bytes):	999
Entropy (8bit):	5.034814430563346
Encrypted:	false
SSDEEP:	24:ZYjtKtWWvp8sI4WRPHPgp1CVQVneyAVmsRDVn:Sj3shWNKmymb
MD5:	B98FBEDAF51931F5CF86D4074BF8ABC3
SHA1:	92DCCB682430766CC99A3E9107B04F62644FA935
SHA-256:	9E12DDB4AA9F97B4DC36950D4DFA47B4ED45843DBA54CE03920D5C683B45C1DC
SHA-512:	50A25139C07DD7DBB2562BA196FD38E911A3C762FCF91F214CA62AA4FBDEAC8DD6D3BAFF41D692E79FFFD8E366237978D79304803421813B661E6A4E504055BC
Malicious:	false
Preview:	; Ini file generated by the HM NIS Edit IO designer...[Settings]..NumFields=11....[Field 1]..Type=Groupbox..Text=Proxy credentials (optional).....Left=0..Right=300..Top=75..Bottom=136....[Field 2]..Type=Label..Text=Proxy type :..Left=0..Right=60..Top=0..Bottom=8....[Field 3]..Type=Label..Text=Address :..Left=0..Right=60..Top=25..Bottom=33....[Field 4]..Type=Label..Text=Port :..Left=0..Right=60..Top=49..Bottom=57....[Field 5]..Type=Label..Text=User :..Left=30..Right=60..Top=94..Bottom=105....[Field 6]..Type=Label..Text=Password :..Left=30..Right=60..Top=112..Bottom=120....[Field 7]..Type=DropList..Text=DropList..State=None..ListItems=None\|HTTP\|Socks 4\|Socks 5..Left=70..Right=300..Top=0..Bottom=14....[Field 8]..Type=Text..Left=70..Right=300..Top=25..Bottom=38..State=....[Field 9]..Type=Text..Left=70..Right=300..Top=49..Bottom=62..State=....[Field 10]..Type=Text..Left=80..Right=280..Top=94..Bottom=107..State=....[Field 11]..Type=Password..Left=80..Right=280..Top=112..Bottom=124..State=..

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\server.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	Generic INItialization configuration [Field 1]
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	5.22612925152494
Encrypted:	false
SSDEEP:	24:ZYsVJPVnu3ug+uVRMkup8KgouU4K2zJSo8b1KgVVVVOw4tTbhNB+r:Skdu3FBFpZHN9SRm5Va
MD5:	E78E5E31987538F7ECD33B27ABFBFF9A
SHA1:	989683D4D072E2AADE6FEEF2152C6041FF9827AA
SHA-256:	40631602F68588699B51DF5461E915DF9760A5A472901BDDE35D236B45C4D021
SHA-512:	E9C0D69FB0B0BAFE487C7CDF95C936CFF663C3D40B1FD4224BD87AE90125FD6417DE93834A53BC4C2C99C6CB2813E6FC9B5DEE71685482350BFCCF8D37E19FB5
Malicious:	false
Preview:	; Ini file generated by the HM NIS Edit IO designer...[Settings]..NumFields=11....[Field 1]..Type=Groupbox..Text=Server credentials (optional).....Left=0..Right=300..Top=35..Bottom=81....[Field 2]..Type=Groupbox..Text=Server security (DISABLING THIS IS NOT RECOMMENDED).....Left=0..Right=300..Top=89..Bottom=137....[Field 3]..Type=Label..Text=Server URL ( http[s]://your_ocs_server[:ocs_server_port]:/ocsinventory )..Left=0..Right=300..Top=0..Bottom=9....[Field 4]..Type=Label..Text=User :..Left=30..Right=66..Top=52..Bottom=62....[Field 5]..Type=Label..Text=Password :..Left=30..Right=66..Top=65..Bottom=73....[Field 6]..Type=Label..Text=CA Certificate path :..Left=31..Right=93..Top=121..Bottom=129....[Field 7]..Type=Text..Left=0..Right=300..Top=14..Bottom=25..State=http://ti.fm2c.com.br/ocsinventory....[Field 8]..Type=Text..Left=80..Right=280..Top=49..Bottom=59..State=....[Field 9]..Type=Password..Left=80..Right=280..Top=65..Bottom=76..State=....[Field 10]..Type=Checkbox..Text=Validate certi

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\services.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	5.131018530714358
Encrypted:	false
SSDEEP:	96:XrXHYWyrDznMnpuQQQjGVw1DVjjQrFUsuL579yAwEN3sKPqg3k+9tyz:XzbcUpuQQcCSDVjjQrFDkZ9Fw+3fiYH
MD5:	89408795F143525890BBDA9281C42F45
SHA1:	BD9F08641CBE86D18C985CEA5325DC2AD8525AA6
SHA-256:	065564C3D7E19E7DEA083FB9A426DFDFEABBA6CA3A7587BEE938F75DB5753114
SHA-512:	BA11A243B97326F6CD12F7F6F8B81E67F7E8F55B5DCF63A7E705813F85C9AF1866891770077514051CE153527B074DCBA2881B94BDB1925DEDC81354E9A84CD6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................0..................0............L......Rich............................PE..L.....[?...........!......................... ...............................P...................................... %..2.... ..P............................@..4.................................................... ...............................text............................... ..`.rdata..R.... ......................@..@.data...d....0......................@....reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsi60BC.tmp\splash.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	PC bitmap, Windows 3.x format, 586 x 265 x 24, image size 466400, resolution 2835 x 2835 px/m, cbSize 466454, bits offset 54
Category:	dropped
Size (bytes):	466454
Entropy (8bit):	2.507425489748098
Encrypted:	false
SSDEEP:	384:wMbhZgu9gey6+Y6VgOo85W7yMphwD5GJUfBgfHu1rMcExEVEozmH2H1/n9gWr4OP:gz2EKe9RfkBw86/EmH
MD5:	DA0E7BCC28506AA8C754F228BCC37C24
SHA1:	C47F912301BE4D0EC4B1DA7905794AA57B57CACC
SHA-256:	308FF588C323A37A657C114A46B37844CF65D61D075CFB89DDD95E4A348688DD
SHA-512:	8C782E355756C3E8CA8BAF91BBEC6566EF91C75161B5B61F81870538C8AF763D93DA04B499885D33BFFD70DB6132B243FA321C70F96D3F3979DD55BC248D5778
Malicious:	false
Preview:	BM........6...(...J.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsm5E69.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.854901984552606
Encrypted:	false
SSDEEP:	192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5:	0063D48AFE5A0CDC02833145667B6641
SHA1:	E7EB614805D183ECB1127C62DECB1A6BE1B4F7A8
SHA-256:	AC9DFE3B35EA4B8932536ED7406C29A432976B685CC5322F94EF93DF920FEDE7
SHA-512:	71CBBCAEB345E09306E368717EA0503FE8DF485BE2E95200FEBC61BCD8BA74FB4211CD263C232F148C0123F6C6F2E3FD4EA20BDECC4070F5208C35C6920240F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L......]...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst60AC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	23487376
Entropy (8bit):	6.598032666398724
Encrypted:	false
SSDEEP:	196608:9yKuVc8qHI5UqPbWodL35FLOyomFHKnP1d9OzmIjFLOyomFHKnPP8kaAHEnnLV/S:9yKIcdHI5rbtFsTYF3FAHEnnLV/S
MD5:	F7AB04DBAF19089143E3F1A8EC5237B0
SHA1:	3B3437968B534EA904D6EC8340B55B005D4E5050
SHA-256:	32B8A6BEA730A699CA1AAA46248F42028748EF05C914B0967B2073310310237F
SHA-512:	8B79A610E87801B96F47A25006E4083376160E73BBF7AEDAB63AA320A8248CE5FC36FCF2230AAF826157989157ABFB627F2AB637362611906B5D7F2C2082AA3B
Malicious:	false
Preview:	........,.......,...............`K...........................................I..........................^.......j...........2...........w...............^I..pI...............................................................................................................................I...I..............................C...............................................f.......D...I...M.......3.......................-...............h.......N...S...^.......3...............................................o.......\|.......................................................}.......................................................................................................................................................................................................................................................g......._...d...e.......3.......................................j.......f...k...l.......3...............................................................................................

C:\Users\user\AppData\Local\Temp\ocspackage.log

Download File

Process:	C:\Users\user\Downloads\ocsoffice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3097
Entropy (8bit):	4.983587260656619
Encrypted:	false
SSDEEP:	48:2S5s4oredjm5xxD5Ila6rs2aM31R7Y5IU4omIX5LPL0tcDpxoxIs41Zs4T:ZovzMl9ZoLJLRpqg1T
MD5:	4F40E0F74B0054E4FFB8BAB236E7CFE9
SHA1:	25B1DCC2A2A0DF8C91D351F16E9BB224418BC359
SHA-256:	9FC03E61E467D8D068DD96EE29D71EAAD500EA97F0E495E9F9CB288A9213D829
SHA-512:	34BF474746291F6426C46C530686A02767FD02410E38BCA5467271993CA18CE2E19C1C51A6FB81167A6A52CF2CC2DB13E1F2DF752C4E4E573B3EAEE20176683C
Malicious:	false
Preview:	OCS Inventory NG Packager (All-In-One Agent Installer) : ********************************************************..OCS Inventory NG Packager (All-In-One Agent Installer) : Starting OCS Inventory NG Packager (All-In-One Agent Installer) on 02/03/2024 at 2:23:00..OCS Inventory NG Packager (All-In-One Agent Installer) : Installing <OCS-Windows-Agent-Setup-x64.exe> version <2.9.2.0>..OCS Inventory NG Packager (All-In-One Agent Installer) : Installing from <C:\Users\user\AppData\Local\Temp\nsg5C75.tmp>\..OCS Inventory NG Packager (All-In-One Agent Installer) : Extracting privilegied installer..OCS Inventory NG Packager (All-In-One Agent Installer) : Extracting Agent setup file..OCS Inventory NG Packager (All-In-One Agent Installer) : Extracting Agent configuration files..OCS Inventory NG Packager (All-In-One Agent Installer) : Extracting Agent plugin files..OCS Inventory NG Packager (All-In-One Agent Installer) : Installing Agent to folder <C:\Program Files\OCS Inventory Agent>..OCS Invent

C:\Users\user\Downloads\ocsoffice.exe

Download File

Process:	C:\Users\user\Desktop\ocs-office.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	6225663
Entropy (8bit):	7.925666116447602
Encrypted:	false
SSDEEP:	98304:hk8ZyHrQeSVQxYqYqwD9VjNodewaJ2K1zHPzOYJjBKLOwelpGCy:hk8ZyH1jYqcideH1YOweCCy
MD5:	BCD0D1EA9750CA6F018DA33DD41552B1
SHA1:	D5AE2A1432CD5397AB0E13C673364B5E153354C0
SHA-256:	6E0CEFC100A0C17B46F593078F116053E41CF46A2E272C8694A2CFFA29B640E0
SHA-512:	26D303E0D66FFDFDC118BAB0B0E1436C24F6D45B96C6526F515F4F85150342407C37BE0426B2305B2E60A0AEF85A0976E7196AFC9182DCDE6490DD731B0A125E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.....F..G.w.F.....F..v..F...@..F.Rich.F.........PE..L......].................d...\|......k2............@..........................`............@.................................<...........h............................................................................................................text....b.......d.................. ..`.rdata..J............h..............@..@.data....U...........\|..............@....ndata...................................rsrc...h...........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul5:NllU
MD5:	01CA458C9AEC24C26DF28176496D33B9
SHA1:	E41CCB28F9F732BB67B40ECC67E2050C4D3D59B7
SHA-256:	A8535BB2871004BE1159B84779D898BF3FC765C30E96C2669E81315B71FD0CEA
SHA-512:	A7E16B0CB841A79D6F4E851273D58B7AA16B0FAF63E55C0CE4FE29620CA479F5DA75A75B6FD5DCDF824A99CA3792122ED34AB7AFEEC74D3796AC3940A48C8484
Malicious:	false
Preview:	@...e.................................l..............@..........

C:\Windows\Temp\__PSScriptPolicyTest_v1l4ozou.vrd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_yde5xl00.tis.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.485082971590613
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ocs-office.exe
File size:	1'166'336 bytes
MD5:	9ca1a4c10e82450b64100ad0723bc23f
SHA1:	2250f749cedc73924c998c8e38448cd739c4095b
SHA256:	2cb1be6c34d9992150169d9abe3236b700f946c6ff9f8f76507d46331d4bb431
SHA512:	5521f9867e52bdaa6a188ff8ee5dd6c62594ba7c23776486163ca4efee3045b64ba3931ca2033e38530855f4eb51a8fe2f9234c644673ebc1dc7a60938877502
SSDEEP:	24576:0rORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaiYzN:02EYTb8atv1orq+pEiSDTj1VyvBaiU
TLSH:	21455C0D63A441AEFEE7D176DD12C90ADAB17C47027E862F05A65FB12E336F1A61E310
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG.....>PG......PG......PG.....PG.y8B..PG.y8C.:PG.y8D.#PG."(..#PG."(..PG."(...PG.+PF..RG..9I.{PG..9D.PG..9..PG

File Icon


Icon Hash:	749a5c97d5582058

Static PE Info

General

Entrypoint:	0x14002549c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64AD5843 [Tue Jul 11 13:25:23 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	fadc5a257419d2541a6b13dfb5e311e2

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FDF8CF159B0h
dec eax
add esp, 28h
jmp 00007FDF8CF152BFh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009466Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007FDF8CF16EC9h
dec eax
lea eax, dword ptr [0009467Dh]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00094674h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00094659h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009460Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007FDF8CF16E69h
dec eax
lea eax, dword ptr [00094645h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0009463Ch]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00000021h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5c10	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfb000	0x28204	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf4000	0x6f48	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0xa74	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc7050	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd9aa0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc7070	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb5000	0x1138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb3328	0xb3400	507a8505198e35cc9675301d53e3b1c4	False	0.5503358721234309	data	6.5212967575920215	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb5000	0x34204	0x34400	9eda36be0cf076085a2f9772c1ee5803	False	0.30884139503588515	data	5.360588077813426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xea000	0x9120	0x5000	ec6b77d6ef8898b0d3b7d48c042d66a0	False	0.040673828125	DOS executable (block device driver)	0.5749243362866429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf4000	0x6f48	0x7000	4416e27f8be9f9271c439d2fd34d1b2d	False	0.49612862723214285	data	5.911479421450324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xfb000	0x28204	0x28400	1782d923936543118cc639be9072c3e0	False	0.5198527270962733	data	6.290951218939824	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0xa74	0xc00	5ddb0e422ace102fe530e589a0cbec6f	False	0.4850260416666667	data	5.139847116863034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xfb458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xfb580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xfb6a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xfb7d0	0x13b00	Device independent bitmap graphic, 150 x 260 x 32, image size 78000, resolution 3779 x 3779 px/m	English	Great Britain	0.12134176587301587
RT_MENU	0x10f2d0	0x50	data	English	Great Britain	0.9
RT_STRING	0x10f320	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0x10f8b4	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0x10ff40	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0x1103d0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0x1109cc	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0x111028	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0x111490	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0x1115e8	0x11700	data			1.0004340277777777
RT_GROUP_ICON	0x122ce8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x122cfc	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x122d10	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x122d24	0x14	data	English	Great Britain	1.25
RT_VERSION	0x122d38	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x122e14	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, GetFullPathNameW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, EnterCriticalSection, DuplicateHandle, GetStdHandle, CreatePipe, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, CreateThread, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, TlsAlloc, ResetEvent, WaitForSingleObjectEx, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, CloseHandle, WriteConsoleW, MoveFileW, RtlCaptureContext
USER32.dll	GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetWindowLongW, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongPtrW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, SetWindowLongPtrW, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, IsCharUpperW, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, GetClipboardData, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, IsCharLowerW, IsCharAlphaNumericW, IsCharAlphaW, GetKeyboardLayoutNameW, ClientToScreen, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, SetMenuDefaultItem, CloseClipboard, GetWindowRect, SetUserObjectSecurity, IsClipboardFormatAvailable, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, OpenClipboard, GetWindowLongPtrW
GDI32.dll	EndPath, DeleteObject, GetDeviceCaps, ExtCreatePen, StrokePath, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, GetTextExtentPoint32W, CreateCompatibleBitmap, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StretchBlt, SelectObject, CreateCompatibleDC, StrokeAndFillPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegSetValueExW, GetSecurityDescriptorDacl, GetAclInformation, RegCreateKeyExW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW, GetUserNameW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	VariantChangeType, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, VariantTimeToSystemTime, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, VariantInit, VariantClear, VariantCopy, SysAllocString, SafeArrayCreateVector, VarR8FromDec, SafeArrayAllocDescriptorEx, SafeArrayAllocData, SysStringLen, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, SysReAllocString, SafeArrayAccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 2, 2024 02:22:53.760170937 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:53.760255098 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:53.760376930 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:53.770282030 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:53.770318985 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:54.430536032 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:54.430704117 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:54.611444950 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:54.611499071 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:54.611819983 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:54.612013102 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:54.614670038 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:54.657928944 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.048764944 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.048810005 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.048824072 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.048881054 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.048943996 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.048968077 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.049031019 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.049591064 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.049607038 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.049666882 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.049684048 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.049752951 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.052361012 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.052402020 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.052407026 CET	443	49729	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.052472115 CET	49729	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.055083036 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.055176973 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.055289030 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.055687904 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.055720091 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.487821102 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.487926960 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.495111942 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.495131969 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.495376110 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:55.495433092 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.495837927 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:55.537918091 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.175209045 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.175270081 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.175288916 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.175446987 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.175487995 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.175517082 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.175538063 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.175642014 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.175642014 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.175642967 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.175662994 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.175717115 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.389626026 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.389647961 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.389828920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.389853001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.389921904 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.390104055 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.390130997 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.390175104 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.390187979 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.390214920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.390233040 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.390463114 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.390479088 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.390535116 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.390547037 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.390589952 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.604916096 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.604945898 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.605137110 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.605160952 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.605211020 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.605628967 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.605657101 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.605707884 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.605725050 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.605753899 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.605775118 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.606506109 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.606520891 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.606587887 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.606601000 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.606650114 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.607445955 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.607465982 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.607515097 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.607526064 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.607553959 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.607573986 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.608413935 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.608433008 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.608494997 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.608506918 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.608552933 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.649003983 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.649019957 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.649085999 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.649100065 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.649158955 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.821304083 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.821326971 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.821506023 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.821532965 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.821594954 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.822468996 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.822488070 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.822552919 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.822566032 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.822609901 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.824107885 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.824122906 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.824260950 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.824274063 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.824321985 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.826517105 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.826533079 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.826622009 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.826634884 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.826678991 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.827605963 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.827621937 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.827689886 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.827702045 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.827763081 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.830063105 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.830079079 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.830180883 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.830193996 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.830245972 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.831176996 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.831192017 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.831275940 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.831290007 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.831340075 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.832726955 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.832741976 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.832819939 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.832832098 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.832885981 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.834199905 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.834214926 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.834294081 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.834305048 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.834356070 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.835583925 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.835602999 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.835696936 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.835721970 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.835784912 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.863398075 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.863416910 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.863497019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:56.863512993 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:56.863564968 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.037343979 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.037368059 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.037550926 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.037571907 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.037627935 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.038541079 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.038562059 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.038625002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.038638115 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.038686037 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.039498091 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.039511919 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.039578915 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.039591074 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.039637089 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.041208029 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.041232109 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.041287899 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.041305065 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.041332960 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.041352987 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.041920900 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.041935921 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.042001009 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.042012930 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.042056084 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.042481899 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.042495966 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.042553902 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.042565107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.042610884 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.042946100 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.042959929 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.043020010 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.043030977 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.043087959 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.044342995 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.044363976 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.044425011 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.044435978 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.044481039 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.045021057 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.045036077 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.045099974 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.045110941 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.045165062 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.045537949 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.045553923 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.045614958 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.045627117 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.045695066 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.045922995 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.045963049 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.046019077 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.046030045 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.046082020 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.046899080 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.046914101 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.046978951 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.046989918 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.047034025 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.047617912 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.047632933 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.047703981 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.047714949 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.047759056 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.048235893 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.048249006 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.048317909 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.048327923 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.048369884 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.048896074 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.048923016 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.048983097 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.048995972 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.049036026 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.049323082 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.049336910 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.049396992 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.049407959 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.049472094 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.049789906 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.049810886 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.049856901 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.049868107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.049913883 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.049913883 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.050359011 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.050379038 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.050440073 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.050451040 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.050497055 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.050873995 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.050893068 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.050945044 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.050956011 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.051018000 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.051457882 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.051471949 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.051532984 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.051543951 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.051588058 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.052172899 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.052194118 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.052257061 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.052272081 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.052297115 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.052315950 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.077299118 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.077312946 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.077490091 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.077502012 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.077554941 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.250585079 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.250614882 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.250787973 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.250808954 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.250860929 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.251180887 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.251203060 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.251262903 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.251275063 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.251324892 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.251775026 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.251795053 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.251842976 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.251853943 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.251879930 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.251904011 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.252343893 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.252367973 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.252424002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.252439022 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.252465010 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.252485991 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.252811909 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.252831936 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.252871990 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.252882957 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.252912998 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.252928019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.253237963 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.253252029 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.253312111 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.253324032 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.253375053 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.253740072 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.253755093 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.253815889 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.253827095 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.253880024 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.255383015 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.255400896 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.255474091 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.255486012 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.255534887 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.256211996 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.256238937 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.256283045 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.256293058 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.256316900 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.256336927 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.256541014 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.256555080 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.256614923 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.256625891 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.256678104 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.256975889 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.256990910 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.257046938 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.257059097 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.257110119 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.257761955 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.257788897 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.257832050 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.257843018 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.257865906 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.257884026 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.258419037 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.258443117 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.258488894 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.258500099 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.258524895 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.258543968 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.258882999 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.258905888 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.258955956 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.258965969 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.259013891 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.259015083 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.259221077 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.259234905 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.259294987 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.259305954 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.259361982 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.259720087 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.259747028 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.259783983 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.259794950 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.259820938 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.259843111 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.260262012 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.260276079 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.260338068 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.260349035 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.260395050 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.260662079 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.260677099 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.260735035 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.260746002 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.260797024 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.261023045 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.261043072 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.261082888 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.261092901 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.261116982 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.261138916 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.261471987 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.261492968 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.261535883 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.261547089 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.261586905 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.261607885 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.262310028 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.262325048 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.262379885 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.262391090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.262437105 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.262727022 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.262742996 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.262789011 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.262799978 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.262852907 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.263334036 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.263354063 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.263406992 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.263417959 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.263463020 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.264076948 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.264096975 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.264142990 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.264153957 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.264177084 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.264197111 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.264902115 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.264915943 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.264971972 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.264986992 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.265008926 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.265033007 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.266774893 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.266797066 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.266836882 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.266848087 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.266871929 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.266890049 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.267354012 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.267368078 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.267426968 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.267438889 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.267488003 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.268248081 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.268261909 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.268321991 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.268333912 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.268381119 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.269181967 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.269208908 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.269248009 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.269258976 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.269283056 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.269301891 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.270153999 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.270167112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.270226002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.270236969 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.270278931 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.270951986 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.270971060 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.271028996 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.271040916 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.271089077 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.271895885 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.271909952 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.271976948 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.271989107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.272036076 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.272670031 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.272696972 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.272731066 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.272742033 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.272766113 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.272783995 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.273418903 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.273436069 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.273489952 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.273500919 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.273540974 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.274138927 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.274172068 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.274207115 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.274216890 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.274240971 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.274260044 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.274935007 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.274954081 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.275002003 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.275013924 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.275062084 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.275332928 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.275352955 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.275384903 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.275394917 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.275418997 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.275437117 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.275768042 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.275789022 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.275830030 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.275840998 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.275893927 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.276174068 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.276199102 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.276227951 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.276237965 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.276261091 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.276278019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.276496887 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.276511908 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.276554108 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.276563883 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.276590109 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.276607990 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.276889086 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.276911020 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.276946068 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.276957035 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.276981115 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.276999950 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.277340889 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.277354956 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.277400970 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.277411938 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.277455091 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.277956009 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.277970076 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.278012037 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.278023005 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.278047085 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.278067112 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.290951014 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.290966034 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.291029930 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.291040897 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.291083097 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.291083097 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.463330030 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.463351011 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.463428974 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.463449001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.463499069 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.464097023 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.464111090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.464169979 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.464181900 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.464234114 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.464498997 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.464513063 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.464567900 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.464579105 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.464641094 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.465013027 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.465027094 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.465085983 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.465096951 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.465146065 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.465414047 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.465429068 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.465485096 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.465497017 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.465548038 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.465816975 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.465831041 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.465883017 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.465908051 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.465960026 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.466363907 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.466378927 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.466443062 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.466454983 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.466506958 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.467263937 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.467278957 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.467335939 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.467346907 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.467396021 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.468022108 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.468054056 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.468096018 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.468106985 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.468132973 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.468153000 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.468383074 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.468398094 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.468453884 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.468465090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.468514919 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.468754053 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.468775034 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.468825102 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.468837023 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.468884945 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.469182968 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.469197989 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.469254017 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.469280005 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.469326019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.469913960 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.469928980 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.469988108 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.469999075 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.470043898 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.470371008 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.470393896 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.470428944 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.470438957 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.470482111 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.470482111 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.470758915 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.470773935 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.470820904 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.470832109 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.470881939 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.471133947 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.471148014 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.471205950 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.471215963 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.471265078 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.471479893 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.471493006 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.471544981 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.471555948 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.471604109 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.472340107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.472352982 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.472404957 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.472418070 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.472466946 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.472739935 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.472754002 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.472805977 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.472815990 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.472863913 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.473157883 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.473171949 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.473237038 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.473248005 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.473299980 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.473510027 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.473551035 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.473576069 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.473586082 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.473612070 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.473648071 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.474821091 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.474843025 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.474891901 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.474904060 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.474931002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.474947929 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.475642920 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.475657940 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.475722075 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.475733995 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.475783110 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.476475954 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.476511955 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.476553917 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.476571083 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.476594925 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.476617098 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.476898909 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.476913929 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.476982117 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.476993084 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.477054119 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.477488041 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.477502108 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.477564096 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.477575064 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.477621078 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.478262901 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.478282928 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.478317976 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.478327990 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.478373051 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.478373051 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.479655981 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.479679108 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.479716063 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.479727030 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.479752064 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.479770899 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.481235981 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.481251001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.481293917 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.481304884 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.481328964 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.481344938 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.481826067 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.481839895 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.481877089 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.481904030 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.481930971 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.481950998 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.482382059 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.482419968 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.482435942 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.482445002 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.482471943 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.482487917 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.482945919 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.482969999 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.483002901 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.483014107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.483036995 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.483052969 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.483592033 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.483606100 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.483649015 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.483659983 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.483709097 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.484105110 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.484126091 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.484158039 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.484169006 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.484193087 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.484211922 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.484385014 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.484400034 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.484432936 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.484442949 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.484483004 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.484483004 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.484848022 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.484874010 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.484919071 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.484934092 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.484958887 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.484976053 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.485394955 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.485409021 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.485450029 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.485460997 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.485506058 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.485907078 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.485923052 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.485960007 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.485970020 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.485994101 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.486012936 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.486462116 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.486489058 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.486521959 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.486532927 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.486557007 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.486574888 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.486928940 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.486943960 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.486979008 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.486989975 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.487015009 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.487032890 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.487433910 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.487457991 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.487485886 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.487495899 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.487519979 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.487536907 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.488125086 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.488164902 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.488183022 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.488193035 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.488240004 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.488240004 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.488240004 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.488655090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.488677025 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.488708973 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.488719940 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.488744974 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.488764048 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.489151001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.489165068 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.489202023 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.489212036 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.489238024 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.489257097 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.489748955 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.489764929 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.489825964 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.489836931 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.489883900 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.490782022 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.490796089 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.490828991 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.490840912 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.490865946 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.490881920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.491175890 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.491189957 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.491233110 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.491242886 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.491292953 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.491619110 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.491642952 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.491676092 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.491686106 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.491709948 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.491729021 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.492125988 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.492141962 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.492192030 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.492202997 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.492247105 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.492742062 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.492758036 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.492801905 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.492813110 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.492857933 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.493119001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.493155003 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.493191957 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.493201971 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.493242979 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.493259907 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.493664026 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.493678093 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.493721962 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.493736982 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.493762016 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.493779898 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.494286060 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.494314909 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.494358063 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.494373083 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.494398117 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.494414091 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.495065928 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.495094061 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.495129108 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.495141029 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.495167017 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.495186090 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.495676041 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.495693922 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.495728970 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.495738983 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.495763063 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.495779991 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.496603012 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.496618032 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.496666908 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.496679068 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.496725082 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.498012066 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.498027086 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.498064041 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.498075008 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.498099089 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.498131990 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.498579025 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.498598099 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.498631954 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.498642921 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.498667002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.498683929 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.499418020 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.499433041 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.499475002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.499486923 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.499511003 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.499528885 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.908488035 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.908500910 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.908577919 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.908710003 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.908746958 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.908775091 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.908931971 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.908931971 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.908946991 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.908967018 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.908997059 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909001112 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909018993 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909049034 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909049034 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909054995 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909071922 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909075022 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909086943 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909111977 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909116030 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909130096 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909136057 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909147024 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909169912 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909193993 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909199953 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909210920 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909241915 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909254074 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909274101 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909282923 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909301043 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909307003 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909321070 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909324884 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909333944 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909360886 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909365892 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909382105 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909415960 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909423113 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909431934 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909440041 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909449100 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909485102 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909514904 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909532070 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909540892 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909552097 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909585953 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909585953 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909599066 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909610987 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909635067 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909648895 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909662962 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909676075 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909696102 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909703016 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909715891 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909743071 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909756899 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909774065 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909782887 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909782887 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909787893 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909806013 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909815073 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909842014 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909843922 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909867048 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909868002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909877062 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909907103 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909920931 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909935951 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909955978 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.909967899 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909986973 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.909991980 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910007000 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910015106 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910023928 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910049915 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910059929 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910074949 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910084963 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910094976 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910121918 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910131931 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910139084 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910152912 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910167933 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910177946 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910202980 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910214901 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910218954 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910231113 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910254002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910263062 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910279989 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910288095 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910309076 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910312891 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910324097 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910346031 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910368919 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910372972 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910382986 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910423994 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910433054 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910449028 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910459995 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910487890 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910490036 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910512924 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910536051 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910553932 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910583019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910583019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910594940 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910619020 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910621881 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910633087 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910650969 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910674095 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910687923 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910691977 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910702944 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910734892 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910742998 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910763979 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910769939 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910769939 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910779953 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910804987 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910819054 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910824060 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910835028 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910846949 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910856009 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910875082 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910880089 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910898924 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910900116 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910928965 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910953999 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910976887 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.910981894 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.910999060 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911004066 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911011934 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911031961 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911048889 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911062956 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911063910 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911073923 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911109924 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911115885 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911130905 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911138058 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911149025 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911175013 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911180019 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911191940 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911200047 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911207914 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911216974 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911264896 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911268950 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911284924 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911290884 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911299944 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911324978 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911329031 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911344051 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911355019 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911358118 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911365986 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911391973 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911410093 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911423922 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911437035 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911477089 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911484957 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911497116 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911530018 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911535978 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911551952 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911561012 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911571980 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911596060 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911598921 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911619902 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911624908 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911634922 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911668062 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911669970 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911669970 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911684990 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911695004 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911782026 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911799908 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911804914 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911819935 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911847115 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911861897 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911879063 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911890984 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911890984 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911892891 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911911011 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911921978 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911941051 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911943913 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.911959887 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.911990881 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912004948 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912023067 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912034988 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912039042 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912039042 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912062883 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912077904 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912095070 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912107944 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912141085 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912148952 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912168026 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912190914 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912198067 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912216902 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912228107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912252903 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912265062 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912276030 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912281036 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912290096 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912314892 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912339926 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912349939 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912355900 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912364960 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912390947 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912405968 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912409067 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912420034 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912451029 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912466049 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912466049 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912481070 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912499905 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912503004 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912523031 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912533045 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912560940 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912565947 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912599087 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912609100 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912626982 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912632942 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912642956 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912652969 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912662029 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912682056 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912686110 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912704945 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912705898 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912739038 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912749052 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912769079 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912774086 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912784100 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912791967 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912805080 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912827969 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912831068 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912844896 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912851095 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912879944 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912889957 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912909031 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912913084 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912923098 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912935019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912945032 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912967920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.912969112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912985086 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.912986994 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913007975 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913017988 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913033962 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913042068 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913048029 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913068056 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913081884 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913104057 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913109064 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913120985 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913130045 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913139105 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913163900 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913163900 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913183928 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913212061 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913212061 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913224936 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913240910 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913248062 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913259029 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913268089 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913275957 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913300037 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913305998 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913315058 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913325071 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913353920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913362980 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913381100 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913386106 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913398981 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913404942 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913414001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913436890 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913443089 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913451910 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913460970 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913477898 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913487911 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913515091 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913532972 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913541079 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913548946 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913558006 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913583040 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913594961 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913606882 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913609028 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913619041 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913638115 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913661003 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913674116 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913676977 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913691044 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913713932 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913732052 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913733006 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913742065 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913774014 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913784027 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913796902 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913808107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913836956 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913841963 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913863897 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913868904 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913880110 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913924932 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913924932 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913934946 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913957119 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913964033 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.913973093 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913991928 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.913994074 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914026022 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914041042 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914057970 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914062977 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914079905 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914089918 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914114952 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914118052 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914134026 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914148092 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914161921 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914180040 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914191008 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914191008 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914194107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914222002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914232016 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914248943 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914257050 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914273977 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914278030 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914287090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914309978 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914326906 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914331913 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914343119 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914377928 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914381981 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914402962 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914407969 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914414883 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914439917 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914441109 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914470911 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914475918 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914484978 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914506912 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914511919 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914539099 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914539099 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914551020 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914572954 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914573908 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914606094 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914617062 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914625883 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914628029 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914668083 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914673090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914688110 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914707899 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914724112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914741993 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914752960 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914752960 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914758921 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914789915 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914799929 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914819002 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914824009 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914834023 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914841890 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914850950 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914874077 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914879084 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914899111 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914901018 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914908886 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914915085 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914933920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914947033 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914961100 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.914967060 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.914978027 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915003061 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915013075 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915015936 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915041924 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915045023 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915055990 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915076017 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915095091 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915105104 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915118933 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915118933 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915127039 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915155888 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915170908 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915184975 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915186882 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915196896 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915205002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915239096 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915249109 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915257931 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915290117 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915302038 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915311098 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915321112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915338039 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915355921 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915381908 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915390968 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915404081 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915421963 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915431976 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915466070 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915467024 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915478945 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915498972 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915498972 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915512085 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915534973 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915540934 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915551901 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915570021 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915575981 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915596008 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915616989 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915623903 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915633917 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915652037 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915663958 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915688992 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915697098 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915720940 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915726900 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915750980 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915764093 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915777922 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915800095 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915806055 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915806055 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915819883 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915843010 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915852070 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915868044 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915873051 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915888071 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915893078 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915916920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915927887 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915947914 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915952921 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915966034 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.915968895 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.915977001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916002035 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916018963 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916022062 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916043997 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916060925 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916069984 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916095972 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916100979 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916110039 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916117907 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916129112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916157961 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916162968 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916177034 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916183949 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916193962 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916202068 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916224003 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916233063 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916250944 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916255951 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916268110 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916275024 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916284084 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916306019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916317940 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916332006 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916337967 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916353941 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916371107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916382074 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916382074 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916388988 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916419983 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916429996 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916445971 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916455030 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916474104 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916482925 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916512012 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916522980 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916543961 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916548967 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916564941 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916585922 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916593075 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916626930 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916626930 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916640997 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916660070 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916672945 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916696072 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916701078 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916711092 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916738987 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916740894 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916775942 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916786909 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916807890 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916812897 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916836023 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916846037 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916870117 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916874886 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916889906 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916898012 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916908026 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916938066 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916940928 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916940928 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916964054 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.916966915 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.916977882 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917005062 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917020082 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917021990 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917031050 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917076111 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917078972 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917098045 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917109966 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917134047 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917138100 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917160988 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917167902 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917177916 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917200089 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917205095 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917223930 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917248011 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917252064 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917260885 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917300940 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917309999 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917321920 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917331934 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917350054 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917362928 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917396069 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917397022 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917411089 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917426109 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917437077 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917459965 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917464972 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917475939 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917498112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917500019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917521954 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917531967 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917551994 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917557955 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917592049 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917592049 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917617083 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917619944 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917656898 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917661905 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917694092 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917699099 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917711973 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917732000 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917736053 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917763948 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917766094 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917774916 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917798042 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917804003 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917817116 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917828083 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917850018 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917855978 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917872906 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917882919 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917929888 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917932034 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917967081 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.917978048 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.917998075 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918004036 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918011904 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918020964 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918030024 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918056965 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918059111 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918073893 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918077946 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918088913 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918097019 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918121099 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918131113 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918145895 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918159962 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918190956 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918206930 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918216944 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918216944 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918222904 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918237925 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918246031 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918268919 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918278933 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918278933 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918283939 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918312073 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918323040 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918344975 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918349981 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918363094 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918373108 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918381929 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918405056 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918411970 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918421984 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918431044 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918437958 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918447018 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918481112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918486118 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918486118 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918499947 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918504000 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918514967 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918534994 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918555975 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918556929 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918566942 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918600082 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918613911 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918621063 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918629885 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918647051 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918663979 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918684959 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918701887 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918719053 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918745995 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918745995 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918749094 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918766975 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918786049 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918795109 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918813944 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918819904 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918829918 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918838978 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918847084 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918873072 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918888092 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918889999 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918908119 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918914080 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918924093 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918950081 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918956995 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918966055 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918976068 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.918987989 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.918998003 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919019938 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919023991 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919037104 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919047117 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919055939 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919081926 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919086933 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919107914 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919114113 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919123888 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919147968 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919152021 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919164896 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919172049 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919188023 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919197083 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919223070 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919225931 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919239998 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919245958 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919255018 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919279099 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919281006 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919298887 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919301987 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919308901 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919333935 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919352055 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919373035 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919387102 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919425011 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919435978 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919445038 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919481039 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919491053 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919504881 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919513941 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919524908 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919544935 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919549942 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919570923 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919594049 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919594049 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919609070 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.919631958 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.919663906 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.935025930 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.935041904 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.935113907 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.935122013 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.935164928 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.938417912 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.949767113 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.949783087 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.949848890 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.949862003 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:57.949994087 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:57.969959021 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.122474909 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.122502089 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.122601986 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.122663975 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.122714043 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.139086008 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.139113903 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.139183998 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.139199972 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.139254093 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.139491081 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.139514923 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.139559031 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.139575958 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.139605045 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.139625072 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.139904976 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.139919996 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.139974117 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.139986992 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.140033007 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.141047955 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.141062975 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.141125917 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.141139030 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.141200066 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.141625881 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.141639948 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.141679049 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.141690016 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.141715050 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.141735077 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.142107010 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.142132998 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.142168999 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.142179012 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.142204046 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.142222881 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.142501116 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.142517090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.142554045 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.142564058 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.142590046 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.142608881 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.142942905 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.142956972 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.143009901 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.143022060 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.143074989 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.143450022 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.143464088 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.143501997 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.143512964 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.143537998 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.143553972 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.144157887 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.144171953 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.144212961 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.144223928 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.144248009 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.144267082 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.144566059 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.144582033 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.144617081 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.144628048 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.144656897 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.144675970 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.144968033 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.144983053 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.145029068 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.145054102 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.145096064 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.145308018 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.145323038 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.145361900 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.145373106 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.145396948 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.145412922 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.145901918 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.145916939 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.145970106 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.145981073 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.146033049 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.146168947 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.146188974 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.146236897 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.146250010 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.146297932 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.146552086 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.146576881 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.146627903 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.146639109 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.146678925 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.146953106 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.146976948 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.147012949 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.147022963 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.147053003 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.147082090 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.147361994 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.147382021 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.147419930 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.147429943 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.147454023 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.147473097 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.147810936 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.147835016 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.147866964 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.147877932 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.147902966 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.147923946 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.148307085 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.148320913 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.148363113 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.148372889 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.148396015 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.148411989 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.148870945 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.148885012 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.148929119 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.148941040 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.148988962 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.149247885 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.149261951 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.149303913 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.149315119 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.149363041 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.149810076 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.149848938 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.149863005 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.149872065 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.149919033 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.149919033 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.150352001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.150367022 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.150418043 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.150429964 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.150480032 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.150870085 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.150891066 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.150918961 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.150928974 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.150957108 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.150975943 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.151348114 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.151364088 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.151396036 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.151406050 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.151429892 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.151448965 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.151824951 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.151859999 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.151885033 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.151896000 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.151921034 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.151938915 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.152470112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.152484894 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.152523994 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.152534008 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.152559042 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.152575016 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.152992964 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.153016090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.153047085 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.153058052 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.153088093 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.153106928 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.153548956 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.153572083 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.153609991 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.153620005 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.153644085 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.153661013 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.153985023 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.154026031 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.154042006 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.154052019 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.154076099 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.154094934 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.154584885 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.154602051 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.154639959 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.154649973 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.154678106 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.154695034 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.155033112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.155046940 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.155088902 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.155100107 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.155124903 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.155143976 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.155361891 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.155375957 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.155417919 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.155428886 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.155473948 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.155656099 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.155688047 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.155710936 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.155720949 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.155745029 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.155761003 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.156078100 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.156099081 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.156137943 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.156155109 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.156177044 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.156196117 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.156577110 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.156604052 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.156635046 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.156651974 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.156677008 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.156697035 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.156850100 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.156873941 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.156899929 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.156909943 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.156934023 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.156949997 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.157156944 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.157171965 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.157208920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.157218933 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.157243967 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.157259941 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.157579899 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.157603979 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.157624960 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.157635927 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.157659054 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.157677889 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.157922029 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.157936096 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.157978058 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.157989025 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.158013105 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.158029079 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.158358097 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.158373117 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.158411980 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.158422947 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.158453941 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.158453941 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.158905983 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.158926010 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.158960104 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.158970118 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.159013033 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.159013033 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.159367085 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.159385920 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.159416914 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.159426928 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.159468889 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.159487963 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.374823093 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.374860048 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.374921083 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.374942064 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.374975920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.374996901 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375405073 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375422001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375475883 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375488043 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375515938 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375535965 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375536919 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375555992 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375564098 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375597000 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375614882 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375631094 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375652075 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375689983 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375684023 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375715971 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375747919 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375747919 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375775099 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375791073 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.375965118 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.375983953 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.376018047 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.376034021 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.376055956 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.376090050 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.376358986 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.376373053 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.376410961 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.376420975 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.376445055 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.376463890 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.376723051 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.376744032 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.376787901 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.376797915 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.376822948 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.376838923 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377049923 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377063990 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377116919 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377127886 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377145052 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377170086 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377186060 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377202034 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377234936 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377235889 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377254009 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377516985 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377531052 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377576113 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377588034 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377635956 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377808094 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377820969 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377857924 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377873898 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.377912998 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.377913952 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.378416061 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.378431082 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.378482103 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.378494024 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.378540993 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379242897 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379268885 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379296064 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379306078 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379329920 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379349947 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379461050 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379475117 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379514933 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379527092 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379560947 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379574060 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379585028 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379606009 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379611015 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379631996 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379641056 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379667044 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379684925 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379878998 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379894972 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379940033 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.379950047 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.379992008 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380009890 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380085945 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380100965 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380143881 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380152941 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380161047 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380204916 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380206108 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380224943 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380254984 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380265951 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380289078 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380294085 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380309105 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380316973 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380326033 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380354881 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380357981 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380378008 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380388975 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380409002 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380414963 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380434036 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380443096 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380465031 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380470991 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380484104 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380489111 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380517006 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380537033 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380549908 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380552053 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380552053 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380582094 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380593061 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380623102 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380629063 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380645990 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380646944 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380660057 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380675077 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380702972 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380706072 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380713940 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380752087 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380757093 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380769968 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380778074 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380788088 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380810022 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380829096 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380844116 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380848885 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380860090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380880117 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380886078 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380899906 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380904913 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380914927 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.380939960 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.380960941 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.381752968 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.383811951 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.383826017 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.383883953 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.383896112 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.383944988 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.383976936 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.384005070 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.384037018 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.384052992 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.384076118 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.384093046 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.384207010 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.384222984 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.384260893 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.384274006 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.384298086 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.384318113 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.384584904 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.384598970 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.384634972 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.384644985 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.384670019 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.384689093 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.385093927 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.385107994 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.385149002 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.385159016 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.385185957 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.385195971 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.385210037 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.385214090 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.385222912 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:58.385243893 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:58.385278940 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:59.381165028 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:59.381179094 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:59.381280899 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:59.381417036 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:59.381465912 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:59.381625891 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:59.809762001 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:59.809778929 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:59.809847116 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:59.809858084 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:59.809910059 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:22:59.809942007 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:22:59.809961081 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:23:00.022923946 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:23:00.022937059 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:23:00.023005009 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:23:00.023029089 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:23:00.023056030 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:23:00.023089886 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:23:00.023121119 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:23:00.023130894 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:23:00.023166895 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:23:00.023722887 CET	49730	443	192.168.2.4	119.8.87.215
Mar 2, 2024 02:23:00.023752928 CET	443	49730	119.8.87.215	192.168.2.4
Mar 2, 2024 02:23:36.099915028 CET	49737	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:36.313322067 CET	80	49737	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:36.313412905 CET	49737	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:36.314280033 CET	49737	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:36.527775049 CET	80	49737	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:36.531534910 CET	80	49737	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:36.531913042 CET	49737	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:36.744920015 CET	80	49737	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:36.745240927 CET	49737	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:47.800517082 CET	49738	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:48.014477968 CET	80	49738	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:48.014590025 CET	49738	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:48.014831066 CET	49738	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:48.228214979 CET	80	49738	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:48.231133938 CET	80	49738	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:48.231519938 CET	49738	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:48.445764065 CET	80	49738	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:48.445805073 CET	80	49738	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:48.445837021 CET	80	49738	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:48.445943117 CET	80	49738	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:48.608431101 CET	80	49738	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:48.608692884 CET	49738	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:48.822426081 CET	80	49738	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:48.822484016 CET	49738	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:54.865155935 CET	49740	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:55.079158068 CET	80	49740	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:55.079257011 CET	49740	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:55.080013037 CET	49740	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:55.293392897 CET	80	49740	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:55.298631907 CET	80	49740	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:55.298949957 CET	49740	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:23:55.512777090 CET	80	49740	119.8.228.120	192.168.2.4
Mar 2, 2024 02:23:55.512871027 CET	49740	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:24:09.713870049 CET	49741	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:24:09.928236008 CET	80	49741	119.8.228.120	192.168.2.4
Mar 2, 2024 02:24:09.928344011 CET	49741	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:24:09.928865910 CET	49741	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:24:10.149447918 CET	80	49741	119.8.228.120	192.168.2.4
Mar 2, 2024 02:24:10.149837017 CET	49741	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:24:10.364444017 CET	80	49741	119.8.228.120	192.168.2.4
Mar 2, 2024 02:24:10.364485025 CET	80	49741	119.8.228.120	192.168.2.4
Mar 2, 2024 02:24:10.364518881 CET	80	49741	119.8.228.120	192.168.2.4
Mar 2, 2024 02:24:10.364604950 CET	80	49741	119.8.228.120	192.168.2.4
Mar 2, 2024 02:24:10.499927044 CET	80	49741	119.8.228.120	192.168.2.4
Mar 2, 2024 02:24:10.501602888 CET	49741	80	192.168.2.4	119.8.228.120
Mar 2, 2024 02:24:10.715354919 CET	80	49741	119.8.228.120	192.168.2.4
Mar 2, 2024 02:24:10.715440989 CET	49741	80	192.168.2.4	119.8.228.120

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 2, 2024 02:22:53.210650921 CET	59673	53	192.168.2.4	1.1.1.1
Mar 2, 2024 02:22:53.737226963 CET	53	59673	1.1.1.1	192.168.2.4
Mar 2, 2024 02:23:35.621685028 CET	49900	53	192.168.2.4	1.1.1.1
Mar 2, 2024 02:23:36.029583931 CET	53	49900	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 2, 2024 02:22:53.210650921 CET	192.168.2.4	1.1.1.1	0xf1a5	Standard query (0)	portal.fm2c.com.br	A (IP address)	IN (0x0001)	false
Mar 2, 2024 02:23:35.621685028 CET	192.168.2.4	1.1.1.1	0xb770	Standard query (0)	ti.fm2c.com.br	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 2, 2024 02:22:53.737226963 CET	1.1.1.1	192.168.2.4	0xf1a5	No error (0)	portal.fm2c.com.br		119.8.87.215	A (IP address)	IN (0x0001)	false
Mar 2, 2024 02:23:11.793181896 CET	1.1.1.1	192.168.2.4	0xe12d	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 2, 2024 02:23:11.793181896 CET	1.1.1.1	192.168.2.4	0xe12d	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 2, 2024 02:23:24.735702038 CET	1.1.1.1	192.168.2.4	0xec6a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 2, 2024 02:23:24.735702038 CET	1.1.1.1	192.168.2.4	0xec6a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Mar 2, 2024 02:23:36.029583931 CET	1.1.1.1	192.168.2.4	0xb770	No error (0)	ti.fm2c.com.br		119.8.228.120	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

portal.fm2c.com.br

ti.fm2c.com.br

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	119.8.228.120	80	6540	C:\Program Files\OCS Inventory Agent\OCSInventory.exe

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 02:23:36.314280033 CET	301	OUT	POST /ocsinventory HTTP/1.1 Host: ti.fm2c.com.br User-Agent: OCS-NG_WINDOWS_AGENT_v2.9.2.0 Accept: / Content-Type: application/x-compressed Content-Length: 131 Data Raw: 78 9c b2 b1 af c8 cd 51 28 4b 2d 2a ce cc cf b3 55 32 d4 33 50 52 48 cd 4b ce 4f c9 cc 4b b7 55 0a 0d 71 d3 b5 50 52 b0 b7 e3 b2 09 72 0d 0c 75 0d 0e b1 e3 52 00 02 1b 17 d7 30 4f 67 57 4f 17 3b 43 13 43 73 03 03 5d 23 03 23 13 5d 03 63 5d 03 23 10 32 32 d6 35 36 b1 d1 87 2b 82 e8 71 f6 f7 0b 71 f5 0b 51 d0 87 f2 81 e6 05 45 da 05 04 f9 fb f8 bb db e8 43 78 5c 36 fa 70 8b 00 00 00 00 ff ff Data Ascii: xQ(K-*U23PRHKOKUqPRruR0OgWO;CCs]##]c]#2256+qqQECx\6p
Mar 2, 2024 02:23:36.531534910 CET	410	IN	HTTP/1.1 200 OK Date: Sat, 02 Mar 2024 01:23:36 GMT Server: Apache/2.4.41 (Ubuntu) content-length: 236 Cache-control: no-cache Content-Type: application/x-compressed Data Raw: 78 9c 6d 90 31 4f c3 30 10 85 f7 fc 0a cb 4b 26 48 53 10 62 b0 5d 59 ce 25 44 72 ee 5c c7 81 66 ca 50 2a 54 09 52 09 24 c4 cf c7 ae 50 9b 81 ed de f7 de 9d 9e 4e 6c 7e 3e de d9 f7 e1 f3 eb 78 9a 65 5e de ae 72 76 98 f7 a7 d7 e3 fc 26 f3 21 d4 37 8f f9 46 65 c2 83 b3 a3 ca 18 13 ce 93 a5 66 aa 3d 6c d5 fa 5e 14 4b 9d fc 16 9f 01 03 f9 71 22 9c fa a0 7d 18 9c 2a 45 f1 2f 4f 0b e4 42 4b 98 c6 74 5d 7b dd 31 d8 81 19 12 9d 42 db 01 0d 41 f2 72 bd e2 cc 81 6f a9 9a ac 0e 80 66 8c 90 b3 4b e0 2e fa 84 92 2f 62 80 4d 78 8a a9 88 cc 68 2c 5c 17 1f 22 0a a3 03 c9 0d 61 cd 59 ed 75 b3 38 1b dd e2 af 10 ea 0e 54 45 2f 68 49 57 a2 38 cb d4 ba b8 d6 8e cf e9 1d 61 0f aa 07 8c 99 8b cc d2 7c fe db 2f be 83 5e 6c Data Ascii: xm1O0K&HSb]Y%Dr\fPTR$PNl~>xe^rv&!7Fef=l^Kq"}E/OBKt]{1BArofK./bMxh,\"aYu8TE/hIW8a\|/^l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	119.8.228.120	80	6540	C:\Program Files\OCS Inventory Agent\OCSInventory.exe

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 02:23:48.014831066 CET	193	OUT	POST /ocsinventory HTTP/1.1 Host: ti.fm2c.com.br User-Agent: OCS-NG_WINDOWS_AGENT_v2.9.2.0 Accept: / Content-Type: application/x-compressed Content-Length: 4352 Expect: 100-continue
Mar 2, 2024 02:23:48.231133938 CET	25	IN	HTTP/1.1 100 Continue
Mar 2, 2024 02:23:48.231519938 CET	4352	OUT	Data Raw: 78 9c ec 9d 5b 73 a3 36 14 c7 df fb 29 34 db 97 64 a6 0e 37 9b d8 1d 96 16 83 12 d3 18 43 01 6f ba 7d c9 b0 36 49 98 3a 90 c1 24 dd f4 d3 57 c8 97 70 33 66 b7 dd 6a a7 7b 32 c9 0c 48 47 e2 9c df 91 25 fe f2 4c a4 fc f4 f1 61 85 9e c3 74 1d 25 f1 Data Ascii: x[s6)4d7Co}6I:$Wp3fj{2HG%Lat%7"YF7s7\|~RS\{"?:6U<y/7g6ExbzG\cM=K/4UkDxBVrum[rcZPfE{L01"
Mar 2, 2024 02:23:48.608431101 CET	264	IN	HTTP/1.1 200 OK Date: Sat, 02 Mar 2024 01:23:48 GMT Server: Apache/2.4.41 (Ubuntu) content-length: 91 Cache-control: no-cache Content-Type: application/x-compressed Data Raw: 78 9c b3 b1 af c8 cd 51 28 4b 2d 2a ce cc cf b3 55 37 d4 33 50 57 48 cd 4b ce 4f c9 cc 4b b7 55 0f 0d 71 d3 b5 50 b7 b7 e3 b2 09 72 0d f0 89 b4 e3 52 50 00 b2 82 03 fc fd 82 5d ed fc fc e3 1d 9d 9d fd 43 fd 42 e2 43 03 5c 1c 43 5c 6d f4 e1 72 5c 20 36 58 07 00 84 71 1b 9f Data Ascii: xQ(K-*U73PWHKOKUqPrRP]CBC\C\mr\ 6Xq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	119.8.228.120	80	1464	C:\Program Files\OCS Inventory Agent\OCSInventory.exe

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 02:23:55.080013037 CET	301	OUT	POST /ocsinventory HTTP/1.1 Host: ti.fm2c.com.br User-Agent: OCS-NG_WINDOWS_AGENT_v2.9.2.0 Accept: / Content-Type: application/x-compressed Content-Length: 131 Data Raw: 78 9c b2 b1 af c8 cd 51 28 4b 2d 2a ce cc cf b3 55 32 d4 33 50 52 48 cd 4b ce 4f c9 cc 4b b7 55 0a 0d 71 d3 b5 50 52 b0 b7 e3 b2 09 72 0d 0c 75 0d 0e b1 e3 52 00 02 1b 17 d7 30 4f 67 57 4f 17 3b 43 13 43 73 03 03 5d 23 03 23 13 5d 03 63 5d 03 23 10 32 32 d6 35 36 b1 d1 87 2b 82 e8 71 f6 f7 0b 71 f5 0b 51 d0 87 f2 81 e6 05 45 da 05 04 f9 fb f8 bb db e8 43 78 5c 36 fa 70 8b 00 00 00 00 ff ff Data Ascii: xQ(K-*U23PRHKOKUqPRruR0OgWO;CCs]##]c]#2256+qqQECx\6p
Mar 2, 2024 02:23:55.298631907 CET	411	IN	HTTP/1.1 200 OK Date: Sat, 02 Mar 2024 01:23:55 GMT Server: Apache/2.4.41 (Ubuntu) content-length: 237 Cache-control: no-cache Content-Type: application/x-compressed Data Raw: 78 9c 6d 90 41 4f c3 30 0c 85 ef fd 15 51 2e 3d 41 d6 81 10 87 34 53 d4 ba a5 52 6a 87 34 85 e5 d4 c3 98 d0 24 e8 24 90 10 3f 9f a4 88 6d 07 4e f6 f7 9e 6d 3d 59 6e be df df d8 d7 fe e3 f3 70 9c cb bc b8 5e e5 6c 3f ef 8e 2f 87 f9 b5 cc 47 df 5c dd e7 1b 95 49 07 d6 04 95 31 16 bb c1 12 0e a0 06 c0 5a 8a 13 26 8f ac ef 08 53 1b 01 75 0f aa a6 67 34 a4 e3 e0 82 bf 8e d5 4e f7 cc 82 eb a8 9e 8c f6 80 55 28 79 c1 19 6c a1 1a d3 89 c9 77 3d d0 e8 a3 ba 5e 71 76 a2 9b 08 7f 7b 80 ad 7f 88 03 51 22 2c 79 2c 8d d3 ed c5 bd b4 18 2c 94 bc 22 6c 38 ab 42 65 e0 6c df 45 5b 2c a9 c5 39 b6 ec f0 09 d0 93 0b 53 0c 31 78 ed fc 68 55 21 c5 bf 7a 5a b0 8e 0c b5 53 e3 e0 51 ad 6f a5 b8 e4 2c bd 67 f9 db 0f d7 db 5e 6c Data Ascii: xmAO0Q.=A4SRj4$$?mNm=Ynp^l?/G\I1Z&Sug4NU(ylw=^qv{Q",y,,"l8BelE[,9S1xhU!zZSQo,g^l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	119.8.228.120	80	1464	C:\Program Files\OCS Inventory Agent\OCSInventory.exe

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 02:24:09.928865910 CET	193	OUT	POST /ocsinventory HTTP/1.1 Host: ti.fm2c.com.br User-Agent: OCS-NG_WINDOWS_AGENT_v2.9.2.0 Accept: / Content-Type: application/x-compressed Content-Length: 4656 Expect: 100-continue
Mar 2, 2024 02:24:10.149447918 CET	25	IN	HTTP/1.1 100 Continue
Mar 2, 2024 02:24:10.149837017 CET	4656	OUT	Data Raw: 78 9c ec 9d 5b 6f a3 38 18 86 ef e7 57 58 dd 9b 56 da 10 0e 39 55 ca 30 4b 88 a7 41 0d 81 05 32 dd ee 4d 45 80 a6 68 09 44 40 da e9 fc fa 35 e4 d0 00 81 d0 66 5b 8f 76 5c b5 23 b0 3f db af 9f cf d8 bc 73 43 ff cb f7 85 07 1e 9d 30 72 03 ff f3 19 Data Ascii: x[o8WXV9U0KA2MEhD@5f[v\#?sC0rCgv;_O}9?$JCi1]n4j\f_kp~sn#N6={Qn&cE#I74B.z)_Au`-,75`<\R=XIQ16=I
Mar 2, 2024 02:24:10.499927044 CET	264	IN	HTTP/1.1 200 OK Date: Sat, 02 Mar 2024 01:24:10 GMT Server: Apache/2.4.41 (Ubuntu) content-length: 91 Cache-control: no-cache Content-Type: application/x-compressed Data Raw: 78 9c b3 b1 af c8 cd 51 28 4b 2d 2a ce cc cf b3 55 37 d4 33 50 57 48 cd 4b ce 4f c9 cc 4b b7 55 0f 0d 71 d3 b5 50 b7 b7 e3 b2 09 72 0d f0 89 b4 e3 52 50 00 b2 82 03 fc fd 82 5d ed fc fc e3 1d 9d 9d fd 43 fd 42 e2 43 03 5c 1c 43 5c 6d f4 e1 72 5c 20 36 58 07 00 84 71 1b 9f Data Ascii: xQ(K-*U73PWHKOKUqPrRP]CBC\C\mr\ 6Xq

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	119.8.87.215	443	6556	C:\Users\user\Desktop\ocs-office.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-02 01:22:54 UTC	97	OUT	GET /paginas/publicFiles/ocsoffice.exe HTTP/1.1 User-Agent: AutoIt Host: portal.fm2c.com.br
2024-03-02 01:22:55 UTC	262	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 11 Jul 2023 13:27:24 GMT Accept-Ranges: bytes ETag: "e57a46efbb3d91:0" Server: Microsoft-IIS/10.0 Date: Sat, 02 Mar 2024 01:22:54 GMT Connection: close Content-Length: 6225663
2024-03-02 01:22:55 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad f1 28 81 e9 90 46 d2 e9 90 46 d2 e9 90 46 d2 2a 9f 19 d2 eb 90 46 d2 e9 90 47 d2 77 90 46 d2 2a 9f 1b d2 e6 90 46 d2 bd b3 76 d2 e3 90 46 d2 2e 96 40 d2 e8 90 46 d2 52 69 63 68 e9 90 46 d2 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f0 d4 f6 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 64 00 00 00 7c 02 00 00 04 00 00 6b 32 00 00 00 10 00 00 00 80 00 00 00 00 40 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(FFFFGwFFvF.@FRichFPEL]d\|k2@
2024-03-02 01:22:55 UTC	16384	IN	Data Raw: 45 08 89 5d e0 a3 80 f4 42 00 a1 4c f4 42 00 c1 e0 02 50 6a 40 c7 45 f0 02 00 00 00 ff 15 58 81 40 00 53 53 53 53 6a 6e a3 68 a8 42 00 ff 35 00 f4 42 00 ff 15 34 82 40 00 83 0d 5c a8 42 00 ff 68 ab 50 40 00 6a fc 89 45 f4 ff 75 fc ff 15 4c 82 40 00 53 6a 06 6a 21 57 57 a3 64 a8 42 00 ff 15 38 80 40 00 68 ff 00 ff 00 a3 54 a8 42 00 ff 75 f4 50 ff 15 3c 80 40 00 ff 35 54 a8 42 00 6a 02 68 09 11 00 00 ff 75 fc ff d6 53 53 68 1c 11 00 00 ff 75 fc ff d6 3b c7 7d 0c 53 57 68 1b 11 00 00 ff 75 fc ff d6 ff 75 f4 ff 15 60 80 40 00 33 ff 8b 45 e8 8b 04 b8 3b c3 74 27 83 ff 20 74 03 89 5d f0 50 53 e8 6d 14 00 00 50 53 68 43 01 00 00 ff 75 f8 ff d6 57 50 68 51 01 00 00 ff 75 f8 ff d6 47 83 ff 21 7c c9 8b 7d 14 8b 45 f0 ff 74 87 30 6a 15 ff 75 08 e8 a7 f4 ff ff 8b 45 Data Ascii: E]BLBPj@EX@SSSSjnhB5B4@\BhP@jEuL@Sjj!WWdB8@hTBuP<@5TBjhuSShu;}SWhuu`@3E;t' t]PSmPShCuWPhQuG!\|}Et0juE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	119.8.87.215	443	6556	C:\Users\user\Desktop\ocs-office.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-02 01:22:55 UTC	122	OUT	GET /paginas/publicFiles/ocsoffice.exe HTTP/1.1 User-Agent: AutoIt Host: portal.fm2c.com.br Cache-Control: no-cache
2024-03-02 01:22:56 UTC	262	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 11 Jul 2023 13:27:24 GMT Accept-Ranges: bytes ETag: "e57a46efbb3d91:0" Server: Microsoft-IIS/10.0 Date: Sat, 02 Mar 2024 01:22:55 GMT Connection: close Content-Length: 6225663
2024-03-02 01:22:56 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad f1 28 81 e9 90 46 d2 e9 90 46 d2 e9 90 46 d2 2a 9f 19 d2 eb 90 46 d2 e9 90 47 d2 77 90 46 d2 2a 9f 1b d2 e6 90 46 d2 bd b3 76 d2 e3 90 46 d2 2e 96 40 d2 e8 90 46 d2 52 69 63 68 e9 90 46 d2 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f0 d4 f6 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 64 00 00 00 7c 02 00 00 04 00 00 6b 32 00 00 00 10 00 00 00 80 00 00 00 00 40 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$(FFFFGwFFvF.@FRichFPEL]d\|k2@
2024-03-02 01:22:56 UTC	16384	IN	Data Raw: 45 08 89 5d e0 a3 80 f4 42 00 a1 4c f4 42 00 c1 e0 02 50 6a 40 c7 45 f0 02 00 00 00 ff 15 58 81 40 00 53 53 53 53 6a 6e a3 68 a8 42 00 ff 35 00 f4 42 00 ff 15 34 82 40 00 83 0d 5c a8 42 00 ff 68 ab 50 40 00 6a fc 89 45 f4 ff 75 fc ff 15 4c 82 40 00 53 6a 06 6a 21 57 57 a3 64 a8 42 00 ff 15 38 80 40 00 68 ff 00 ff 00 a3 54 a8 42 00 ff 75 f4 50 ff 15 3c 80 40 00 ff 35 54 a8 42 00 6a 02 68 09 11 00 00 ff 75 fc ff d6 53 53 68 1c 11 00 00 ff 75 fc ff d6 3b c7 7d 0c 53 57 68 1b 11 00 00 ff 75 fc ff d6 ff 75 f4 ff 15 60 80 40 00 33 ff 8b 45 e8 8b 04 b8 3b c3 74 27 83 ff 20 74 03 89 5d f0 50 53 e8 6d 14 00 00 50 53 68 43 01 00 00 ff 75 f8 ff d6 57 50 68 51 01 00 00 ff 75 f8 ff d6 47 83 ff 21 7c c9 8b 7d 14 8b 45 f0 ff 74 87 30 6a 15 ff 75 08 e8 a7 f4 ff ff 8b 45 Data Ascii: E]BLBPj@EX@SSSSjnhB5B4@\BhP@jEuL@Sjj!WWdB8@hTBuP<@5TBjhuSShu;}SWhuu`@3E;t' t]PSmPShCuWPhQuG!\|}Et0juE
2024-03-02 01:22:56 UTC	16384	IN	Data Raw: 46 4f 4c 44 45 52 00 00 00 00 53 48 41 75 74 6f 43 6f 6d 70 6c 65 74 65 00 00 53 48 4c 57 41 50 49 00 53 48 45 4c 4c 33 32 00 49 6e 69 74 69 61 74 65 53 68 75 74 64 6f 77 6e 41 00 00 00 52 65 67 44 65 6c 65 74 65 4b 65 79 45 78 41 00 41 44 56 41 50 49 33 32 00 00 00 00 47 65 74 55 73 65 72 44 65 66 61 75 6c 74 55 49 4c 61 6e 67 75 61 67 65 00 00 00 00 47 65 74 44 69 73 6b 46 72 65 65 53 70 61 63 65 45 78 41 00 53 65 74 44 65 66 61 75 6c 74 44 6c 6c 44 69 72 65 63 74 6f 72 69 65 73 00 00 00 00 4b 45 52 4e 45 4c 33 32 00 00 00 00 5c 2a 2e 2a 00 00 00 00 6e 73 61 00 0a 5b 00 00 5b 52 65 6e 61 6d 65 5d 0d 0a 00 00 25 73 3d 25 73 0d 0a 00 2a 3f 7c 3c 3e 2f 22 3a 00 00 00 00 25 73 25 73 2e 64 6c 6c 00 00 00 00 00 00 01 00 03 00 07 00 0f 00 1f 00 3f 00 7f 00 ff Data Ascii: FOLDERSHAutoCompleteSHLWAPISHELL32InitiateShutdownARegDeleteKeyExAADVAPI32GetUserDefaultUILanguageGetDiskFreeSpaceExASetDefaultDllDirectoriesKERNEL32\.nsa[[Rename]%s=%s*?\|<>/":%s%s.dll?
2024-03-02 01:22:56 UTC	16384	IN	Data Raw: 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e Data Ascii: ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
2024-03-02 01:22:56 UTC	16384	IN	Data Raw: 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e Data Ascii: ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
2024-03-02 01:22:56 UTC	16384	IN	Data Raw: 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e Data Ascii: ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
2024-03-02 01:22:56 UTC	16384	IN	Data Raw: 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2d 95 ff af 73 b2 ff e5 dc e4 ff ec eb ec ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff be 90 c0 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e Data Ascii: ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,-s,,,,,,,,,,,,,,,,,,,,,,
2024-03-02 01:22:56 UTC	16384	IN	Data Raw: 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff bf 94 c1 ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff e9 e6 e9 ff a4 5a a9 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e Data Ascii: ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Z,,,,,,,,,,,,,,,,,,,,
2024-03-02 01:22:56 UTC	16384	IN	Data Raw: 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff c1 99 c3 ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff e9 e6 e9 ff a4 5a a9 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e Data Ascii: ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Z,,,,,,,,,,,,,,,,,,,,
2024-03-02 01:22:56 UTC	16384	IN	Data Raw: 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8e 2c 95 ff 8f 2f 96 ff ab 6a af ff df d2 df ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed ec ed ff ed Data Ascii: ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,/j

Target ID:	0
Start time:	02:22:51
Start date:	02/03/2024
Path:	C:\Users\user\Desktop\ocs-office.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\ocs-office.exe
Imagebase:	0x7ff78ea80000
File size:	1'166'336 bytes
MD5 hash:	9CA1A4C10E82450B64100AD0723BC23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:22:59
Start date:	02/03/2024
Path:	C:\Users\user\Downloads\ocsoffice.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Downloads\ocsoffice.exe
Imagebase:	0x7ff7699e0000
File size:	6'225'663 bytes
MD5 hash:	BCD0D1EA9750CA6F018DA33DD41552B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:23:00
Start date:	02/03/2024
Path:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\instOCS.exe
Wow64 process (32bit):	true
Commandline:	instocs.exe
Imagebase:	0x400000
File size:	417'337 bytes
MD5 hash:	3F4CD95A8DF390E36298093C74B3BF7E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:23:00
Start date:	02/03/2024
Path:	C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\nsg5C75.tmp\OcsSetup.exe" /S /NP /NOSPLASH /NO_SYSTRAY /NOW /TAG="office" /SERVER=http://ti.fm2c.com.br/ocsinventory
Imagebase:	0x400000
File size:	5'907'776 bytes
MD5 hash:	B2216E895278C44D8168F78188AB4FE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:23:31
Start date:	02/03/2024
Path:	C:\Program Files\OCS Inventory Agent\OCSInventory.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\OCS Inventory Agent\ocsinventory.exe" /SAVE_CONF /SERVER=http://ti.fm2c.com.br/ocsinventory /USER= /PWD= /SSL=1 /CA="cacert.pem" /PROXY_TYPE=0 /PROXY= /PROXY_PORT= /PROXY_USER= /PROXY_PWD= /DEBUG=0 /TAG="office" /WMI_FLAG_MODE="COMPLETE" /DEFAULT_USER_DOMAIN="" /NO_SYSTRAY
Imagebase:	0x7ff7b4c30000
File size:	486'304 bytes
MD5 hash:	38E1FC55C0339A770DD39CA6541437B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:23:34
Start date:	02/03/2024
Path:	C:\Program Files\OCS Inventory Agent\OCSInventory.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Imagebase:	0x7ff7b4c30000
File size:	486'304 bytes
MD5 hash:	38E1FC55C0339A770DD39CA6541437B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:23:36
Start date:	02/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs
Imagebase:	0x7ff72bec0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:23:36
Start date:	02/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:23:36
Start date:	02/03/2024
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs"
Imagebase:	0x7ff6a8fb0000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:23:37
Start date:	02/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}
Imagebase:	0x7ff7eba00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:23:37
Start date:	02/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:23:37
Start date:	02/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:23:39
Start date:	02/03/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\ipconfig.exe" /displaydns
Imagebase:	0x7ff621120000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:23:50
Start date:	02/03/2024
Path:	C:\Program Files\OCS Inventory Agent\OcsService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\OCS Inventory Agent\OcsService.exe" -install
Imagebase:	0x7ff6eed60000
File size:	803'232 bytes
MD5 hash:	67C17EA1BF6EB610DEAC638E4078D6B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:23:50
Start date:	02/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:23:52
Start date:	02/03/2024
Path:	C:\Program Files\OCS Inventory Agent\OcsService.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\OCS Inventory Agent\OcsService.exe
Imagebase:	0x7ff6eed60000
File size:	803'232 bytes
MD5 hash:	67C17EA1BF6EB610DEAC638E4078D6B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	02:23:53
Start date:	02/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe" /c "C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Imagebase:	0x7ff7eba00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:23:53
Start date:	02/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:23:53
Start date:	02/03/2024
Path:	C:\Program Files\OCS Inventory Agent\OCSInventory.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\OCS Inventory Agent\ocsinventory.exe
Imagebase:	0x7ff7b4c30000
File size:	486'304 bytes
MD5 hash:	38E1FC55C0339A770DD39CA6541437B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:23:55
Start date:	02/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe" /c cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs
Imagebase:	0x7ff7eba00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	02:23:55
Start date:	02/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:23:55
Start date:	02/03/2024
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript /nologo "C:\Program Files\OCS Inventory Agent\plugins\o36516user.vbs"
Imagebase:	0x7ff6a8fb0000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:23:56
Start date:	02/03/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe" /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}
Imagebase:	0x7ff7eba00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:23:56
Start date:	02/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:23:56
Start date:	02/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -Command "& {& 'C:\Program Files\OCS Inventory Agent\plugins\Saas.ps1'; [Environment]::Exit(1)}"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:23:57
Start date:	02/03/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\ipconfig.exe" /displaydns
Imagebase:	0x7ff621120000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13%
Total number of Nodes:	1852
Total number of Limit Nodes:	48

Executed Functions

Function 00007FF78EB132AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DestroyWindow.USER32 ref: 00007FF78EB151B9
SystemParametersInfoW.USER32 ref: 00007FF78EB15312
SetRect.USER32 ref: 00007FF78EB15358
AdjustWindowRectEx.USER32 ref: 00007FF78EB1536B
CreateWindowExW.USER32 ref: 00007FF78EB153D6
GetClientRect.USER32 ref: 00007FF78EB153EB
CreateWindowExW.USER32 ref: 00007FF78EB1546A
CreateDCW.GDI32 ref: 00007FF78EB15486
GetStockObject.GDI32 ref: 00007FF78EB15496
SelectObject.GDI32 ref: 00007FF78EB154A2
GetTextFaceW.GDI32 ref: 00007FF78EB154B3
GetDeviceCaps.GDI32 ref: 00007FF78EB154C0
DeleteDC.GDI32 ref: 00007FF78EB154CB
CreateFontW.GDI32 ref: 00007FF78EB15530
SendMessageW.USER32 ref: 00007FF78EB15546
CreateWindowExW.USER32 ref: 00007FF78EB155A8
SendMessageW.USER32 ref: 00007FF78EB155C6
SendMessageW.USER32 ref: 00007FF78EB155DE
CreateWindowExW.USER32 ref: 00007FF78EB1563B
GetStockObject.GDI32 ref: 00007FF78EB1564B
SendMessageW.USER32 ref: 00007FF78EB15661
ShowWindow.USER32 ref: 00007FF78EB15671

Strings

static, xrefs: 00007FF78EB15463, 00007FF78EB15622
A, xrefs: 00007FF78EB15629
AutoIt v3, xrefs: 00007FF78EB153C5
DISPLAY, xrefs: 00007FF78EB15473
msctls_progress32, xrefs: 00007FF78EB1558C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2439800395
Opcode ID: 62736c611084135e4bd5d9204506b1bf2fce8630a56208639ab46777f586b44a
Instruction ID: f54fa858ee0d294e9a06129cc02690204555dc67848dbede6f5abe4c2e92789f
Opcode Fuzzy Hash: 62736c611084135e4bd5d9204506b1bf2fce8630a56208639ab46777f586b44a
Instruction Fuzzy Hash: D2E1847660978187E714EFA5E840A6EBBA1F788B94FA04135DE4E53B64CF7CE444CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC2400 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 366
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF78EAC243E

Part of subcall function 00007FF78EAC1BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC1BF4

_get_daylight.LIBCMT ref: 00007FF78EAC242D

Part of subcall function 00007FF78EAC1C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC1C54

_get_daylight.LIBCMT ref: 00007FF78EAC2673
_get_daylight.LIBCMT ref: 00007FF78EAC2684
_get_daylight.LIBCMT ref: 00007FF78EAC2695
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78EAC28F5), ref: 00007FF78EAC26BC
WideCharToMultiByte.KERNEL32 ref: 00007FF78EAC2752
WideCharToMultiByte.KERNEL32 ref: 00007FF78EAC279E

Strings

:, xrefs: 00007FF78EAC255E
W. Europe Standard Time, xrefs: 00007FF78EAC2726
W. Europe Summer Time, xrefs: 00007FF78EAC277D
?, xrefs: 00007FF78EAC2791
:, xrefs: 00007FF78EAC2534
-, xrefs: 00007FF78EAC2503

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
String ID: -$:$:$?$W. Europe Standard Time$W. Europe Summer Time
API String ID: 3440502458-293611612
Opcode ID: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction ID: 0d5c68d91229d471494beb3640050a400fd81665c215b82e48b84864481fb127
Opcode Fuzzy Hash: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction Fuzzy Hash: 44E1F832A0868286F724AFB59850DBAAB90FF84B94FE45135EA4D43B95DF3CD481C731

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA837B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA837F2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA83807
GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA8388D

Part of subcall function 00007FF78EA83F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF78EA838BF,?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA83FFD

SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA83924
MessageBoxA.USER32 ref: 00007FF78EACB888
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EACB8E1
GetForegroundWindow.USER32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EACB968
ShellExecuteW.SHELL32 ref: 00007FF78EACB98F

Part of subcall function 00007FF78EA83B84: GetSysColorBrush.USER32 ref: 00007FF78EA83B9E
Part of subcall function 00007FF78EA83B84: LoadCursorW.USER32 ref: 00007FF78EA83BAE
Part of subcall function 00007FF78EA83B84: LoadIconW.USER32 ref: 00007FF78EA83BC3
Part of subcall function 00007FF78EA83B84: LoadIconW.USER32 ref: 00007FF78EA83BDC
Part of subcall function 00007FF78EA83B84: LoadIconW.USER32 ref: 00007FF78EA83BF5
Part of subcall function 00007FF78EA83B84: LoadImageW.USER32 ref: 00007FF78EA83C21
Part of subcall function 00007FF78EA83B84: RegisterClassExW.USER32 ref: 00007FF78EA83C85

Part of subcall function 00007FF78EA83CBC: CreateWindowExW.USER32 ref: 00007FF78EA83D0C
Part of subcall function 00007FF78EA83CBC: CreateWindowExW.USER32 ref: 00007FF78EA83D5F
Part of subcall function 00007FF78EA83CBC: ShowWindow.USER32 ref: 00007FF78EA83D75

Part of subcall function 00007FF78EA86258: Shell_NotifyIconW.SHELL32 ref: 00007FF78EA86350

Strings

This is a third-party compiled AutoIt script., xrefs: 00007FF78EACB87F
runas, xrefs: 00007FF78EACB973

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 1593035822-3287110873
Opcode ID: 14502464df88b26587198eb55456a84b4b8cf595b5aa313ecbe0d8dbfcbc0cc2
Instruction ID: 7f8390da730490c778504165d003e01f0fc604eba2bb4e2d1cbaa100ec3db0db
Opcode Fuzzy Hash: 14502464df88b26587198eb55456a84b4b8cf595b5aa313ecbe0d8dbfcbc0cc2
Instruction Fuzzy Hash: 1771906191C58396EA20BBE4E840DF9EB60BF45B54FE00132D54D46AA6DF7CEA49C331

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC2650 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF78EAC2673

Part of subcall function 00007FF78EAC1C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC1C54

_get_daylight.LIBCMT ref: 00007FF78EAC2684

Part of subcall function 00007FF78EAC1BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC1BF4

_get_daylight.LIBCMT ref: 00007FF78EAC2695

Part of subcall function 00007FF78EAC1C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC1C24

Part of subcall function 00007FF78EABB3C0: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF78EABB3D6
Part of subcall function 00007FF78EABB3C0: GetLastError.KERNEL32 ref: 00007FF78EABB3E8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78EAC28F5), ref: 00007FF78EAC26BC
WideCharToMultiByte.KERNEL32 ref: 00007FF78EAC2752
WideCharToMultiByte.KERNEL32 ref: 00007FF78EAC279E

Strings

W. Europe Standard Time, xrefs: 00007FF78EAC2726
W. Europe Summer Time, xrefs: 00007FF78EAC277D
?, xrefs: 00007FF78EAC2791

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: ?$W. Europe Standard Time$W. Europe Summer Time
API String ID: 2482340769-2360834014
Opcode ID: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction ID: 597cce4ca0a231c6d613e14a65acc668bd46146c48dbd8926c9fca790046a83a
Opcode Fuzzy Hash: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction Fuzzy Hash: 92617232A0CA4286E750EFA1D8809B9B7A4FF44BA4FE41135EA4D467A4DF3CE481C771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA86580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32 ref: 00007FF78EA8674B
FindResourceExW.KERNEL32 ref: 00007FF78EA8676B
LoadResource.KERNEL32 ref: 00007FF78EACC985
SizeofResource.KERNEL32 ref: 00007FF78EACC99E
LockResource.KERNEL32 ref: 00007FF78EACC9B1

Strings

SCRIPT, xrefs: 00007FF78EA8675D
EA06, xrefs: 00007FF78EACCA59
AU3!, xrefs: 00007FF78EA865D8

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: AU3!$EA06$SCRIPT
API String ID: 3051347437-2925976212
Opcode ID: 8165953c8bb736b98abf10147c833f44bebc3c15c283c8a92a542f8889041f48
Instruction ID: 6d51bbce247435b3bd17e8da56140a2d3e11b12a9d86d63121c9086657a69b61
Opcode Fuzzy Hash: 8165953c8bb736b98abf10147c833f44bebc3c15c283c8a92a542f8889041f48
Instruction Fuzzy Hash: 4F91F6B2B0969185F710EBA1D444E7CABA9BB85F84FA14135DE6D47785DF3CE404C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA1D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF78EAA1DC8
GetCurrentProcess.KERNEL32 ref: 00007FF78EAA1F42
IsWow64Process.KERNEL32 ref: 00007FF78EAA1F52
GetSystemInfo.KERNEL32 ref: 00007FF78EAA1F8B

Strings

|O, xrefs: 00007FF78EAE954C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID: |O
API String ID: 1568231622-607156228
Opcode ID: ce19e78e8b613063c291fba3ed7269d4c53d8962987fa44a2d43366d5ba53db5
Instruction ID: 2a3562ca024e6f9f91f36f4fd71b66481c4c2ebc1c78570c0bcfac70709d2170
Opcode Fuzzy Hash: ce19e78e8b613063c291fba3ed7269d4c53d8962987fa44a2d43366d5ba53db5
Instruction Fuzzy Hash: 27D17161A1D3C286E620ABD9AC10975FFA0BF52B84FE00077D54E42A75DF7CA984C772

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1F630 Relevance: 12.4, APIs: 8, Instructions: 350
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF78EB1F80A
GetSystemDirectoryW.KERNEL32 ref: 00007FF78EB1F838
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB1F881
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB1F8AF

Part of subcall function 00007FF78EAFFAFC: GetStdHandle.KERNEL32 ref: 00007FF78EAFFB23

CreateProcessW.KERNEL32 ref: 00007FF78EB1FA43
GetLastError.KERNEL32 ref: 00007FF78EB1FA88
CloseHandle.KERNEL32 ref: 00007FF78EB1FAC2

Part of subcall function 00007FF78EAFF7DC: ~SyncLockT.VCCORLIB ref: 00007FF78EAFF7E9
Part of subcall function 00007FF78EAFF7DC: ~SyncLockT.VCCORLIB ref: 00007FF78EAFF7F2

CloseHandle.KERNEL32 ref: 00007FF78EB1FB35

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
String ID:
API String ID: 1787492119-0
Opcode ID: 1ce3422013303b7ac0e33f6d912a76cffe4fe9a0a4393aa5d1c63ebf26532612
Instruction ID: 1ec0807c5478a01359f9af06540e54cb2fa13fc73d23de7d845254fbc5de113c
Opcode Fuzzy Hash: 1ce3422013303b7ac0e33f6d912a76cffe4fe9a0a4393aa5d1c63ebf26532612
Instruction Fuzzy Hash: 8DE18D36A08B4186EB10EFA6D450ABDA7A1FF84F94FA04536EE5D477A9CF38E401C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFBC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA856D4: GetFullPathNameW.KERNEL32(?,00007FF78EA856C1,?,00007FF78EA87A0C,?,?,?,00007FF78EA8109E), ref: 00007FF78EA856FF

Part of subcall function 00007FF78EAFCED4: GetFileAttributesW.KERNEL32 ref: 00007FF78EAFCED8

FindFirstFileW.KERNEL32 ref: 00007FF78EAFBD09
DeleteFileW.KERNEL32 ref: 00007FF78EAFBD5B
FindNextFileW.KERNELBASE ref: 00007FF78EAFBD6D
FindClose.KERNEL32 ref: 00007FF78EAFBD7F
FindClose.KERNEL32 ref: 00007FF78EAFBD8A

Strings

\*.*, xrefs: 00007FF78EAFBCD3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 65b22f8f6f40401823f604efd864ff88ac9ae8d29210313d1744c135a26120fc
Instruction ID: a1808dfb62a5aa106d0d5d23f04d7471ac7c5b4cb7ecfacb60e7ea0a805f9f75
Opcode Fuzzy Hash: 65b22f8f6f40401823f604efd864ff88ac9ae8d29210313d1744c135a26120fc
Instruction Fuzzy Hash: 76418331A28A5292EB50EB90E8419FDE760FF84F90FE01132EA5E43695DF7CD505C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA92E30 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1264COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF78EADE641

Strings

Variable must be of type 'Object'., xrefs: 00007FF78EADE92D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Init_thread_footer
String ID: Variable must be of type 'Object'.
API String ID: 1385522511-109567571
Opcode ID: b22152d1cd641690e5c71f1f8f88b83bffb6f65988bdb427d038ce28bb34abe3
Instruction ID: ae2655a5ae2cd34dc7eb49a66cf65cbf0cdd31f9be4347a3b05b5c0027e6b6ae
Opcode Fuzzy Hash: b22152d1cd641690e5c71f1f8f88b83bffb6f65988bdb427d038ce28bb34abe3
Instruction Fuzzy Hash: 4BC29236B0864286EB60BFA5D884AB9B7B1FB44F84FA44031DA5E477A4DF3CE845C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFBE00 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF78EAFBE3B
Process32FirstW.KERNEL32 ref: 00007FF78EAFBE4B
CloseHandle.KERNEL32 ref: 00007FF78EAFBF55

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 2e6c0ba0aef56f721f48a3edffe834369a8de41df8fcd4dd852d566d586f9da8
Instruction ID: b29cea4ae162bfe4df83c1823bc7a57854b8f9fcc76502578d23dd1e0a21de69
Opcode Fuzzy Hash: 2e6c0ba0aef56f721f48a3edffe834369a8de41df8fcd4dd852d566d586f9da8
Instruction Fuzzy Hash: 0C417F32A18A9295E710FFA1E4409BEE7B0FB84B84FA44032EE4E03695DF7CD545C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0E87C Relevance: 1.6, APIs: 1, Instructions: 62filenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAB48E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB4835

InternetReadFile.WININET ref: 00007FF78EB0E8D8

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FileInternetRead_invalid_parameter_noinfo
String ID:
API String ID: 101623796-0
Opcode ID: 4898aa4117a3bcd4a2f49389d4353a76d5c79d7e1af12f6b7b0d6724009e8fee
Instruction ID: cb0cfd2c9a0b0592140b94be523acb217f74a934536cf44a9b12972d6acbcd4d
Opcode Fuzzy Hash: 4898aa4117a3bcd4a2f49389d4353a76d5c79d7e1af12f6b7b0d6724009e8fee
Instruction Fuzzy Hash: 3721A432B0868246FB74EA51A010FB9A790FB85B84FE45135DA8C47B85DF3CF502CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA87920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78EA85680: GetModuleFileNameW.KERNEL32(?,00007FF78EA87A0C,?,?,?,00007FF78EA8109E), ref: 00007FF78EA8569F

Part of subcall function 00007FF78EAA3A38: GetFullPathNameW.KERNEL32(?,00007FF78EA87A1B,?,?,?,00007FF78EA8109E), ref: 00007FF78EAA3A5F

RegOpenKeyExW.KERNEL32(?,?,?,00007FF78EA8109E), ref: 00007FF78EA87A75
RegQueryValueExW.ADVAPI32(?,?,?,00007FF78EA8109E), ref: 00007FF78EACD081
RegQueryValueExW.ADVAPI32(?,?,?,00007FF78EA8109E), ref: 00007FF78EACD0E9
RegCloseKey.ADVAPI32(?,?,?,00007FF78EA8109E), ref: 00007FF78EACD138
wcscat.LIBCMT ref: 00007FF78EACD19E
wcscat.LIBCMT ref: 00007FF78EACD1CF

Strings

Software\AutoIt v3\AutoIt, xrefs: 00007FF78EA87A64
\Include\, xrefs: 00007FF78EA87A1B
Include, xrefs: 00007FF78EACD06F, 00007FF78EACD0D2

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: 4d5fca5580ffbc517e33814b88da922e5904d1bccaefb304550cd9c135ac3897
Instruction ID: f403b98be597ee5070db7f499685a1762b5646c3b21e53a0fd03c4b5a93b6fef
Opcode Fuzzy Hash: 4d5fca5580ffbc517e33814b88da922e5904d1bccaefb304550cd9c135ac3897
Instruction Fuzzy Hash: A1917F62A18A5385EB20FFA4EC408B9E7A4FF84B54FE00136E94D43AA5DF7CD145C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA85DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF78EA85E76
KillTimer.USER32 ref: 00007FF78EA85EB1
SetTimer.USER32 ref: 00007FF78EA85ED9
RegisterWindowMessageW.USER32 ref: 00007FF78EA85EE6
CreatePopupMenu.USER32 ref: 00007FF78EA85EFC
PostQuitMessage.USER32 ref: 00007FF78EA85F23

Strings

TaskbarCreated, xrefs: 00007FF78EA85EDF

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction ID: 129b76a190be24e7448cd0624d658579a07572a1b592240895bd96b7bd79e8e7
Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction Fuzzy Hash: 58513A31D1C66282F620BB98ED44979AA90BF46F80FF40536D84D82AA5DF7DE944C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA83D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF78EA83DE5
RegisterClassExW.USER32 ref: 00007FF78EA83E16
RegisterWindowMessageW.USER32 ref: 00007FF78EA83E2A
InitCommonControlsEx.COMCTL32 ref: 00007FF78EA83E48
ImageList_Create.COMCTL32 ref: 00007FF78EA83E63
LoadIconW.USER32 ref: 00007FF78EA83E7C
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF78EA83E8F

Strings

TaskbarCreated, xrefs: 00007FF78EA83E1C
AutoIt v3 GUI, xrefs: 00007FF78EA83DF8

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-2659433951
Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction ID: 6a6b798c1b3ab662940974db656954d4b28f2841cf721d3bc41eb41fd1cf32ea
Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction Fuzzy Hash: BB312932A08B018AE700DFA1E845BA97BB4FB45758FA0013ACA5D57B64DF7C9159CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA9E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM ref: 00007FF78EA9E9C3
OleUninitialize.OLE32 ref: 00007FF78EA9EABF
UnregisterHotKey.USER32(?,?,?,00007FF78EA9E939), ref: 00007FF78EA9ECD9
DestroyWindow.USER32(?,?,?,00007FF78EA9E939), ref: 00007FF78EAE27E4

Strings

close all, xrefs: 00007FF78EA9E9B7

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: DestroySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1992507300-3243417748
Opcode ID: 8ed0905b7fef2205e2fa8d5cc5defc2438150b4613d09d69a615d9a0c11cd739
Instruction ID: 25387818029aed71e3712cbe27e818992c094f4c96f5c1c4851886f1360e5aa7
Opcode Fuzzy Hash: 8ed0905b7fef2205e2fa8d5cc5defc2438150b4613d09d69a615d9a0c11cd739
Instruction Fuzzy Hash: 2CE13022B09A0281EE58FF96C550A7CB360BF84F45FA44475DB1E57292DF3CE862C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA83B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF78EA83B9E
LoadCursorW.USER32 ref: 00007FF78EA83BAE
LoadIconW.USER32 ref: 00007FF78EA83BC3
LoadIconW.USER32 ref: 00007FF78EA83BDC
LoadIconW.USER32 ref: 00007FF78EA83BF5
LoadImageW.USER32 ref: 00007FF78EA83C21
RegisterClassExW.USER32 ref: 00007FF78EA83C85

Part of subcall function 00007FF78EA83D90: GetSysColorBrush.USER32 ref: 00007FF78EA83DE5
Part of subcall function 00007FF78EA83D90: RegisterClassExW.USER32 ref: 00007FF78EA83E16
Part of subcall function 00007FF78EA83D90: RegisterWindowMessageW.USER32 ref: 00007FF78EA83E2A
Part of subcall function 00007FF78EA83D90: InitCommonControlsEx.COMCTL32 ref: 00007FF78EA83E48
Part of subcall function 00007FF78EA83D90: ImageList_Create.COMCTL32 ref: 00007FF78EA83E63
Part of subcall function 00007FF78EA83D90: LoadIconW.USER32 ref: 00007FF78EA83E7C
Part of subcall function 00007FF78EA83D90: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF78EA83E8F

Strings

AutoIt v3, xrefs: 00007FF78EA83C3F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction ID: e3e26c8b76084eb40132d2c21e8a947754f30079ebeda195ec834e996d74aa44
Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction Fuzzy Hash: A5314A36A08B028AE700EB91F844BA8BBB4FB49B44FA0043ACD4D53B64DF7CE055C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC7348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78EAC7078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC70B9
Part of subcall function 00007FF78EAC7078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC7136
Part of subcall function 00007FF78EAC7078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC7187

CreateFileW.KERNEL32 ref: 00007FF78EAC7449
CreateFileW.KERNEL32 ref: 00007FF78EAC74A5
GetLastError.KERNEL32 ref: 00007FF78EAC74D9
GetFileType.KERNEL32 ref: 00007FF78EAC74EE
GetLastError.KERNEL32 ref: 00007FF78EAC74F8
CloseHandle.KERNEL32 ref: 00007FF78EAC752B
CloseHandle.KERNEL32 ref: 00007FF78EAC7684
CreateFileW.KERNEL32 ref: 00007FF78EAC76BC
GetLastError.KERNEL32 ref: 00007FF78EAC76CB

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction ID: f8c5e7978030ddcde63ea628b98dba714e7213f5ee28f74180e358dfc0acb5ec
Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction Fuzzy Hash: 70C1CD32B18A458AEB50AFB4D441BBC77A1FB48BA8F601235DE2E5B795DF38E051C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA925BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 00007FF78EA926DA
timeGetTime.WINMM ref: 00007FF78EA928BC
PeekMessageW.USER32 ref: 00007FF78EA929E3
TranslateMessage.USER32 ref: 00007FF78EA92A23
DispatchMessageW.USER32 ref: 00007FF78EA92A2D
PeekMessageW.USER32 ref: 00007FF78EA92A47

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Message$Peek$DispatchInputStateTimeTranslatetime
String ID:
API String ID: 3249950245-0
Opcode ID: debac6e36d0bcbce5df70d5d1c7e316091b7ffbb6cc9afe421cf6e766bb887b4
Instruction ID: b1536fd6d40cb7df3058e201ea3f7655299dbf5b145d00cd532849930ad37969
Opcode Fuzzy Hash: debac6e36d0bcbce5df70d5d1c7e316091b7ffbb6cc9afe421cf6e766bb887b4
Instruction Fuzzy Hash: 0D22B232A0C68286FB64BBA4E844BB9F7A0FB45F44FA44136DA5D43695CF3CE441C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0DBF0 Relevance: 10.6, APIs: 7, Instructions: 137
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectW.WININET ref: 00007FF78EB0DC5F
HttpOpenRequestW.WININET ref: 00007FF78EB0DCA9
InternetCloseHandle.WININET ref: 00007FF78EB0DDC0

Part of subcall function 00007FF78EB0EAB8: GetLastError.KERNEL32 ref: 00007FF78EB0EAD4
Part of subcall function 00007FF78EB0EAB8: SetEvent.KERNEL32 ref: 00007FF78EB0EAE9

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
String ID:
API String ID: 3401586794-0
Opcode ID: 37be9930858cfe08900dee1a106cf1c77c63f4148adc203acd435acb12a00bc6
Instruction ID: a23eb590b2a3abb19cc57a688daf79953464d14d58af59066ac999771d5f9720
Opcode Fuzzy Hash: 37be9930858cfe08900dee1a106cf1c77c63f4148adc203acd435acb12a00bc6
Instruction Fuzzy Hash: AA51E53660878287FB14EF61A840EAEBBA0FB48B88FA44131DE0D13B44DF39E455C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA83CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF78EA83D0C
CreateWindowExW.USER32 ref: 00007FF78EA83D5F
ShowWindow.USER32 ref: 00007FF78EA83D75

Strings

AutoIt v3, xrefs: 00007FF78EA83CC8
d, xrefs: 00007FF78EA83CF4
edit, xrefs: 00007FF78EA83D18

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction ID: 1a2c5176b27c6d698586270cda43b537edf5065f31e6245ebb88dc728048e205
Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction Fuzzy Hash: 3D21AE72A2CB4187E710DB54F849B29BBF0F789799FA14239E68D46A64CF7DC044CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB1E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB1E90
CreateThread.KERNEL32 ref: 00007FF78EAB1ED4
GetLastError.KERNEL32 ref: 00007FF78EAB1EE2
CloseHandle.KERNEL32 ref: 00007FF78EAB1F01
FreeLibrary.KERNEL32 ref: 00007FF78EAB1F10
ResumeThread.KERNEL32 ref: 00007FF78EAB1F33

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction ID: 85bd58d894468bb10f8c2c69850f195c8cf1434e784536d50f3b9f8dde9dacc3
Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction Fuzzy Hash: 9B216D21A0AB4281EE14BBE0A404A79E2D1BF94FB4FB40735DAAD467D4DF3CE414C662

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABED08 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EABED4D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction ID: d961e9d5341d533b4e0b3e225517dadf204de02154bcf88a9dea9745bc5a261f
Opcode Fuzzy Hash: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
Instruction Fuzzy Hash: 4081D322A2865695F720BFA59440ABDABE1BF84F44FA08135DD8E577D1CF3CE441C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA5244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF78EAA525B
__scrt_initialize_onexit_tables.LIBCMT ref: 00007FF78EAA5274
_RTC_Initialize.LIBCMT ref: 00007FF78EAA527D

Part of subcall function 00007FF78EAA4F0C: _onexit.LIBCMT ref: 00007FF78EAA4F10

Part of subcall function 00007FF78EABA09C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EABA0C6

__scrt_fastfail.LIBCMT ref: 00007FF78EAA52F5
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF78EAA5300

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2117695475-0
Opcode ID: c5af1a2945e0b28d35ed004d247bbfb317608e89d5a488d8119e5cdd6fee6e2c
Instruction ID: 4f37197920981fc10f99e6686a66b790406613961271f8497ca1f2a06f6bebd4
Opcode Fuzzy Hash: c5af1a2945e0b28d35ed004d247bbfb317608e89d5a488d8119e5cdd6fee6e2c
Instruction Fuzzy Hash: E9115D11E0834345FA5476F26456ABC92827F85F01FF40438E55D5A2C3EF3EA859C6BB

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB1DA0 Relevance: 7.5, APIs: 5, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EABB80C: GetLastError.KERNEL32 ref: 00007FF78EABB81B
Part of subcall function 00007FF78EABB80C: SetLastError.KERNEL32 ref: 00007FF78EABB885

ExitThread.KERNEL32 ref: 00007FF78EAB1DB8
ExitThread.KERNEL32 ref: 00007FF78EAB1DCD

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction ID: 7d5477bb052b5f7c327c0ded959f44caea08d9f66b9cbd53b7a7859a23dd8c0b
Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction Fuzzy Hash: EF012C21B19642D2EA047BA09445A7CA7A1FF90B75FE01735C6BE02AD5DF3CE858C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA87EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAA2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2D8E
Part of subcall function 00007FF78EAA2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2D9C
Part of subcall function 00007FF78EAA2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2DAC
Part of subcall function 00007FF78EAA2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2DBC
Part of subcall function 00007FF78EAA2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2DCA
Part of subcall function 00007FF78EAA2D5C: MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2DD8

Part of subcall function 00007FF78EA9EEC8: RegisterWindowMessageW.USER32 ref: 00007FF78EA9EF76

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78EA8106D), ref: 00007FF78EA88209
OleInitializeWOW.OLE32 ref: 00007FF78EA8828F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78EA8106D), ref: 00007FF78EACD36A

Strings

AutoIt, xrefs: 00007FF78EA87F46

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: AutoIt
API String ID: 1986988660-2515660138
Opcode ID: 4244e21068e8c91e310eca5dc6ae699cb2811c2f9282692ac0fed3969635a3a6
Instruction ID: 194a4a9fedf10668caa6810bd4c7ae7acebfab788d8efb3c2adbd5da49f247b7
Opcode Fuzzy Hash: 4244e21068e8c91e310eca5dc6ae699cb2811c2f9282692ac0fed3969635a3a6
Instruction Fuzzy Hash: 06C1D771D19B4286E740FBA8AC91874FBA4BF96740FB0023BD55D82A61EF7CA151C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA872C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF78EA8739E
Shell_NotifyIconW.SHELL32 ref: 00007FF78EA873AC
LoadStringW.USER32 ref: 00007FF78EACCE12

Strings

Line: , xrefs: 00007FF78EACCE52

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line:
API String ID: 3135491444-1585850449
Opcode ID: 1bf3ee93fc45a1699e44ee0231c4e24a40c79c0c321c71349712c6b358204ebc
Instruction ID: 609473080301a90ff19e41d15f347eae9bc1ac450cee9adeb9d67ad170598ff2
Opcode Fuzzy Hash: 1bf3ee93fc45a1699e44ee0231c4e24a40c79c0c321c71349712c6b358204ebc
Instruction Fuzzy Hash: FB419872A0C64296E720FBA4D840AF9A771FB55748FE44032EA4C43A9ADF7CD944C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA83F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF78EACBAA2

Part of subcall function 00007FF78EA856D4: GetFullPathNameW.KERNEL32(?,00007FF78EA856C1,?,00007FF78EA87A0C,?,?,?,00007FF78EA8109E), ref: 00007FF78EA856FF

Part of subcall function 00007FF78EA83EB4: GetLongPathNameW.KERNEL32 ref: 00007FF78EA83ED8

Strings

au3, xrefs: 00007FF78EACBA80
Run Script:, xrefs: 00007FF78EACBA4D
AutoIt script files (*.au3, *.a3x), xrefs: 00007FF78EACBA74

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction ID: 813d2236c1610e38ae511ed1dc2cd3cd756bc18bd4f745818986456e8c67ed4f
Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction Fuzzy Hash: DB31AD32608B8289E710EB61E8405BDBBA8FB49B84FA84135DE8C47B55CF3CD545CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0E708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF78EB0E772
InternetSetOptionW.WININET ref: 00007FF78EB0E7A4

Strings

<local>, xrefs: 00007FF78EB0E749

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction ID: 52fdfa7d4292c4f0a3ef6767dacc8d9727bbadd38de519e84270e09feb64a037
Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction Fuzzy Hash: E0119836A1964187EB619B55E100FFDB6A1F780B48FF44035DB8D06A94DF3DE886C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA4610 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA872C8: wcscpy.LIBCMT ref: 00007FF78EA8739E
Part of subcall function 00007FF78EA872C8: Shell_NotifyIconW.SHELL32 ref: 00007FF78EA873AC

KillTimer.USER32 ref: 00007FF78EAA46A8
SetTimer.USER32 ref: 00007FF78EAA46BD
Shell_NotifyIconW.SHELL32 ref: 00007FF78EAEAAAD

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: IconNotifyShell_Timer$Killwcscpy
String ID:
API String ID: 3812282468-0
Opcode ID: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
Instruction ID: 72afb871dea341e81f48d8f576ade733c6e01a39c6479f0554b6fca170880cb2
Opcode Fuzzy Hash: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
Instruction Fuzzy Hash: A131D322A0DBC287EB219B51A1406B9BBA9F745F84FA84036DE4C07749CF3CD644C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB132C8 Relevance: 4.6, APIs: 3, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF78EB13331
SendMessageW.USER32 ref: 00007FF78EB1337E
SendMessageW.USER32 ref: 00007FF78EB133AF

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: da67b6e4ee0ccb07d4ddc733fe182bcf3cb944a282399a4954123a4e53963194
Instruction ID: 26ebb8d09c41ca527c8d38a9b709a78f4dcfb9699d6500de621ad4f70a1d74b2
Opcode Fuzzy Hash: da67b6e4ee0ccb07d4ddc733fe182bcf3cb944a282399a4954123a4e53963194
Instruction Fuzzy Hash: AD314336A08A8281D700EF96E54186DF760FB89F94BA59432DF4D57B55CF38E890C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA86F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,?,?,?,?,?,00007FF78EA86F52,?,?,?,?,?,?,00007FF78EA8782C), ref: 00007FF78EA86FA5
RegQueryValueExW.KERNEL32(?,?,?,?,?,?,?,00007FF78EA86F52,?,?,?,?,?,?,00007FF78EA8782C), ref: 00007FF78EA86FD3
RegCloseKey.KERNEL32(?,?,?,?,?,?,?,00007FF78EA86F52,?,?,?,?,?,?,00007FF78EA8782C), ref: 00007FF78EA86FFA

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction ID: f6db2eb6bf0bb360f5550b820749a31d5de785e2fa5f93b0cf793adb05512b43
Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction Fuzzy Hash: 0D219D33A28B5187D7109F65E44096EB3F4FB88B84BA51131EB9D83B14DF39E814CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA9118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF78EAA90FC), ref: 00007FF78EAA9140
TerminateProcess.KERNEL32(?,?,?,00007FF78EAA90FC), ref: 00007FF78EAA914B
ExitProcess.KERNEL32 ref: 00007FF78EAA915A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction ID: 5d7f3e81b4d492c4541371541b617aa9a364c774d9d794a94d48216bfccb4bf2
Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction Fuzzy Hash: 5CE01220B0574582FB447BE15C85A759752BF84F41FA05438C94F02392CF3DE408C261

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA966C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF78EA96C05

Strings

CALL, xrefs: 00007FF78EA96BCE

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 672e0359144240262c2c24c6d85faf9a77711ff5f87969df384104f8d95a6f95
Instruction ID: eb662a417c5e118c59ef053bf6fda2036025402abe8f53e6fb9f6d677faf9111
Opcode Fuzzy Hash: 672e0359144240262c2c24c6d85faf9a77711ff5f87969df384104f8d95a6f95
Instruction Fuzzy Hash: 56229F72B086428AEB10EFA5D440ABCB7B5FB84F88FA04136DA2D57795DF38E445C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA86460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA86D64: LoadLibraryA.KERNEL32(?,?,?,00007FF78EA86490), ref: 00007FF78EA86D7B
Part of subcall function 00007FF78EA86D64: GetProcAddress.KERNEL32(?,?,?,00007FF78EA86490), ref: 00007FF78EA86D93

FreeLibrary.KERNEL32 ref: 00007FF78EA864BA
LoadLibraryW.KERNEL32 ref: 00007FF78EA864E4

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 1a82a74e2b3ab26fd3f782dcd3763a100b44bdead9b975d120a4eadf26d1e08e
Instruction ID: df1289d901e2a0126167b2370a814b02fe8c62f3e456f67e5efb272e3e4efa66
Opcode Fuzzy Hash: 1a82a74e2b3ab26fd3f782dcd3763a100b44bdead9b975d120a4eadf26d1e08e
Instruction Fuzzy Hash: 53419132B04A1286FB10EFA5D4517FCA3A4FB84B88F944131EA5D47A9ADF3CD444C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA86258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF78EA86350

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
Instruction ID: 041c4c219579c1d568c37a282795eb108083e2df7d2b6a205d1877dab7d24394
Opcode Fuzzy Hash: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
Instruction Fuzzy Hash: F241CC32908B4582E751AF54E4407B8B7A8FB48F88FA40135DE5C07798CF7CD580C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC04B8 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32 ref: 00007FF78EAC051B
GetLastError.KERNEL32 ref: 00007FF78EAC0525

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction ID: 9106d34263aac87f47204fb5911cdb0853aa6c933b8a30cf0c9593567929e241
Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction Fuzzy Hash: 4F11B420B0C24641EEA477E4A5D4A7991C17F95F74FB44274DA2E063D2CF7CA880C223

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA83F9C Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(D000000000000000,00007FF78EA838BF,?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA83FFD
wcscat.LIBCMT ref: 00007FF78EACBACE

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FullNamePathwcscat
String ID:
API String ID: 2785955394-0
Opcode ID: 61d7f396efac4d7c8dcca00735e7da44ea5546610d5c1063c020ec5f06465761
Instruction ID: 2cd624967b838cf038568262d64a8defbd477feb40605e906440d0db73844f21
Opcode Fuzzy Hash: 61d7f396efac4d7c8dcca00735e7da44ea5546610d5c1063c020ec5f06465761
Instruction Fuzzy Hash: E021A131A0C69781E620FB94E4409BAE760FF84F84FE14132E98C43A96DF7CE645C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0E7E4 Relevance: 3.0, APIs: 2, Instructions: 46networkCOMMON

Download Yara Rule

APIs

InternetQueryOptionW.WININET ref: 00007FF78EB0E818
InternetQueryOptionW.WININET ref: 00007FF78EB0E84B

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: InternetOptionQuery
String ID:
API String ID: 2202126096-0
Opcode ID: 15af93d59ef8ffc7f975a0016be29c74e93e00474df01bcf486ce6a56acfa817
Instruction ID: cb61cc3bc82490306688793edfbb90102ae3c843bb0f750a82337f43e6f9affb
Opcode Fuzzy Hash: 15af93d59ef8ffc7f975a0016be29c74e93e00474df01bcf486ce6a56acfa817
Instruction Fuzzy Hash: 5911A932A1478183D614EF92E05587DF7A1FB88F80BA5903AEA4E03B54CF3CE440CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC3E9C Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF78EABA2E2), ref: 00007FF78EAC3EB0
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF78EABA2E2), ref: 00007FF78EAC3F15

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 7a2552942933b56ccb1f3da2e42ebda5c79027b354ecde1dfe545767dcb9d8c9
Instruction ID: 13b56cc03c625f760d39e1a917683c82974e1a7cf46174a8a4cf2ac9b5b5b146
Opcode Fuzzy Hash: 7a2552942933b56ccb1f3da2e42ebda5c79027b354ecde1dfe545767dcb9d8c9
Instruction Fuzzy Hash: AC016121A09B4185DE10BB96640147EA6A0FF88FE0BE80235DA9E077D5DF3CE485C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB1D28 Relevance: 3.0, APIs: 2, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF78EAB1D3A
ExitThread.KERNEL32 ref: 00007FF78EAB1D42

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 9fa5a87bb94733646178d1bac7777d12b76a8cc09730e0683fb8d1386efd9485
Instruction ID: b7f2e6a7d50851ae977184666b973284d1926c649727e60c0cfac93b09ba57bc
Opcode Fuzzy Hash: 9fa5a87bb94733646178d1bac7777d12b76a8cc09730e0683fb8d1386efd9485
Instruction Fuzzy Hash: 2FF04421A1974285EB087BF1A5519BD9750BF85F90FA81434EA8A17297CF3CD444C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0EDBC Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF78EB0E066), ref: 00007FF78EB0EDDE
CreateEventW.KERNEL32(?,?,?,00007FF78EB0E066), ref: 00007FF78EB0EDF8

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseCreateEventHandle
String ID:
API String ID: 3369476804-0
Opcode ID: dc2a3152bce0372cd7696dcfe9dea8a7d253f9a0843508d3f5c82eb9e32e4830
Instruction ID: 4a1c9f445241c32478d2b763fba46fabbee9dd9218e3b3e04d18e6d7ebf5a6a7
Opcode Fuzzy Hash: dc2a3152bce0372cd7696dcfe9dea8a7d253f9a0843508d3f5c82eb9e32e4830
Instruction Fuzzy Hash: A9F0C232E0924286FB65ABE1A056FF4AAA0BF48B04FA84134CB0D09590CF3C2085C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA4078 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF78EAA409C

Part of subcall function 00007FF78EA925BC: GetInputState.USER32 ref: 00007FF78EA926DA

Sleep.KERNEL32 ref: 00007FF78EAEA654

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 8bcfbedc1fce9704412f760671249398a062c7d03cdb34a5aaa933979ff729f8
Instruction ID: b6501e8067e0d29557e5f2e5c6e4d49f153fdf13766576f6dfce4c5fdfeaddea
Opcode Fuzzy Hash: 8bcfbedc1fce9704412f760671249398a062c7d03cdb34a5aaa933979ff729f8
Instruction Fuzzy Hash: 0BF0FF32A08A4685E744AFA6E84557DE2A4FB48F84FA88435DE4DC7355DF3CD884C621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA83730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00007FF78EA83756

Part of subcall function 00007FF78EAA9334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAA9348

Part of subcall function 00007FF78EA836E8: SystemParametersInfoW.USER32 ref: 00007FF78EA83705
Part of subcall function 00007FF78EA836E8: SystemParametersInfoW.USER32 ref: 00007FF78EA83725

Part of subcall function 00007FF78EA837B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA837F2
Part of subcall function 00007FF78EA837B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA83807
Part of subcall function 00007FF78EA837B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA8388D
Part of subcall function 00007FF78EA837B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF78EA83785), ref: 00007FF78EA83924

SystemParametersInfoW.USER32 ref: 00007FF78EA83797

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
String ID:
API String ID: 4207566314-0
Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction ID: 753cb4351aa7ff3d9e99ffbc63d384b5a78fd0b8b894d59c21864618180aeabc
Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction Fuzzy Hash: 87012CB0D0C2428BF700BBE9AC01D75AAA1BF09B00FE50036D44C866A2CF3CA488C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABB3C0 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF78EABB3D6
GetLastError.KERNEL32 ref: 00007FF78EABB3E8

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction ID: 55210f610148f6c033bc11dcab84523573d5c7f5f0e89c4e70f9a59a6d42a091
Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction Fuzzy Hash: CAE08650E0950382FF147BF3580587996D27F84F41FE44030C84D46651DF3CE485C621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA91475 Relevance: 2.0, APIs: 1, Instructions: 533COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF78EA91990

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: d876e59f2124bdaf53ff04f9243ff1602a2028ac0c3cc9d4efc4eadfbaa73c41
Instruction ID: 98ce01cac59996751a77a72673cc78f3ccd18a0859763df7cc08e2714860974d
Opcode Fuzzy Hash: d876e59f2124bdaf53ff04f9243ff1602a2028ac0c3cc9d4efc4eadfbaa73c41
Instruction Fuzzy Hash: ED32F222A0C68286EB60FB95D844BB9E7A1FB94F84FE54131DA1D07B95DF3CE441C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB12554 Relevance: 1.6, APIs: 1, Instructions: 134windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF78EB126E1

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 5514f33b6170b66333be5fa0d5b22f8af53f52cbb1839318c342b12bdd2b7cbf
Instruction ID: f14c2ccf088d6946f6233028472016086af0fcd26bab4dc6538c5eccf902f98f
Opcode Fuzzy Hash: 5514f33b6170b66333be5fa0d5b22f8af53f52cbb1839318c342b12bdd2b7cbf
Instruction Fuzzy Hash: F5515B32A04B55C6EB04EBA6D88086CB7B1FB48FE4BA04536DE2D47795DF38D491C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB2868 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB28AA

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: dd4133bde21de890b5bbedec510097a64f5f9819fecfb9588d4762bde154bc8e
Instruction ID: 2565a781fb4c6517ebb8bc0d536a413ecd2164eb43faef1c874f1a0f5dbfdb6a
Opcode Fuzzy Hash: dd4133bde21de890b5bbedec510097a64f5f9819fecfb9588d4762bde154bc8e
Instruction Fuzzy Hash: 9B41E721B0824146EA64ADE65504A39E281BF85FE0FE84A35EEED477C5DF3CE441C232

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAE20D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF78EAE20E2

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: e4be371c5d4381fa2aee947fc978330a46ed3a381e9b0a6def4662969b34fbf2
Instruction ID: ea011b50070a03266d58a556fb88b5264ca52dd51556240b60e32e2cd41d8b82
Opcode Fuzzy Hash: e4be371c5d4381fa2aee947fc978330a46ed3a381e9b0a6def4662969b34fbf2
Instruction Fuzzy Hash: D6416B32B08A4286EB10BFA1D480BBCA7A0FB84F88FA44535CE1D17795CF78E445C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA8FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF78EAA8FD4

Part of subcall function 00007FF78EAA9164: GetModuleHandleExW.KERNEL32 ref: 00007FF78EAA9184
Part of subcall function 00007FF78EAA9164: GetProcAddress.KERNEL32 ref: 00007FF78EAA919A
Part of subcall function 00007FF78EAA9164: FreeLibrary.KERNEL32 ref: 00007FF78EAA91BF

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction ID: 86ee9f6b1cbf7fc83bc7ddb2ec5d26c60aba18417b36f49a7dcb0aa3f4ff517c
Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction Fuzzy Hash: C6419421E0C75282EB64FB96E451974E6A1BF80B80FB65035DA0D176E5DF3DE881C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0EC38 Relevance: 1.6, APIs: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetCrackUrlW.WININET ref: 00007FF78EB0ECA6

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CrackInternet
String ID:
API String ID: 1381609488-0
Opcode ID: f4fc41b07c9f87b1cedcd1274125a479920f16397c88d8c0f661824f1724f0ca
Instruction ID: 8708580d37d20fabb4d393669e058dd2524a21e5f21d8fc9e263a050c3dd6908
Opcode Fuzzy Hash: f4fc41b07c9f87b1cedcd1274125a479920f16397c88d8c0f661824f1724f0ca
Instruction Fuzzy Hash: 16415876B046918AEB24EFA5D040AEDB765FB48BC8F905021DE0E27B49CF38E505CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABEC1C Relevance: 1.6, APIs: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b2f3784b3fac25882735789eea1302c5ad37269996976f08b02ad831047971
Instruction ID: 1cc22ac1210442974d283c80cc62278d3190209e9723f04f73aa16aab8a63394
Opcode Fuzzy Hash: f0b2f3784b3fac25882735789eea1302c5ad37269996976f08b02ad831047971
Instruction Fuzzy Hash: 3721E532A1825A81E7517F919841A39AA52BFC1F61FA58234E99E073D2CF7DF440C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC6D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC6D34

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction ID: 4229029df87c30541542f823bf520691f6eccd05e6a7485d55ef2dbd9f242ee0
Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction Fuzzy Hash: 2821F732618A4287DB66AF64E440B79B6A4FFC0F64F644234DA6D8A7D5DF3CD840CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB48E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB4835

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction ID: 166440c12bff413305c5d89998dc0654d7f1808e64658ffd106a005c2932d105
Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction Fuzzy Hash: D3218621A0C68281EA51BFD1940197EE2A1BFC5F84FA44030EACC57B86EF7DE851C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB132BC Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF78EB151B9
SystemParametersInfoW.USER32 ref: 00007FF78EB15312

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: DestroyInfoParametersSystemWindow
String ID:
API String ID: 3173480332-0
Opcode ID: 47de30f4b9d52453d668af94e40fee48ee4b52636491aca13ad0f8b260d566bb
Instruction ID: 462cb1f47b39d0e436d624330896dd6752751be840dc8dcab9d15b3e19449a14
Opcode Fuzzy Hash: 47de30f4b9d52453d668af94e40fee48ee4b52636491aca13ad0f8b260d566bb
Instruction Fuzzy Hash: 7B219D32A0578285E760AFA6D840FADBB61FB48B98FA49035CE0E47B91CF78E450C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA84744 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF78EA847AC

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 5309bfef947dbbc2485cd5b84eef9eafd5f1c09b42b757a886982e528bb26483
Instruction ID: b523fc6b1dc4453f35e2cf556042f24341361d8a6f0a2d12fc2516624f6e9aa9
Opcode Fuzzy Hash: 5309bfef947dbbc2485cd5b84eef9eafd5f1c09b42b757a886982e528bb26483
Instruction Fuzzy Hash: 53114932A1965087DB64EF62E090B29B7B0F748F84F644139DB8E47B89CF38E491CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC0414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction ID: 47b1b16ded9c20a0a2e7716a7dcfc13fd57809ae42f3aadb21f12e0ce1ece475
Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction Fuzzy Hash: C811606290C64686DA05BF90D5806BEB761BB81B61FE04232D68D063E5CF7CE440CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB48EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB4909

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 73416388f96d1fa1c933956d37c8472db6949d640467d067d8483f105d076b8d
Instruction ID: ad40cf99f360e1b85a783cc7b33e9dadb40de96ad52606885ed4d94848698bf1
Opcode Fuzzy Hash: 73416388f96d1fa1c933956d37c8472db6949d640467d067d8483f105d076b8d
Instruction Fuzzy Hash: 9F017C21A0820745FE28BAE5A851B7991507FD5F64FB40731E9AE8A2C2DF3CE841C232

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB2A04 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB2A39

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 13582692803e5bef34bcbed5350d45246e8339d83c915d4457afee6828f5fba2
Instruction ID: bb6a3d568199948e9d44e38ff6518250ecaffb85494d65202eac23071925b95d
Opcode Fuzzy Hash: 13582692803e5bef34bcbed5350d45246e8339d83c915d4457afee6828f5fba2
Instruction Fuzzy Hash: 10012172A00B1598EB11EFE0D4418EC77B8FB54B58BA4413ADA8C13754EF34D5A5C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB4970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB4999

Part of subcall function 00007FF78EAB48EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB4909

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction ID: ff69b45163f83a1beafda57ff786d2a09fb84676c1f4f827adbdf06c7b8da068
Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction Fuzzy Hash: 5FF09021A0C24342E92476E9A40197EA280BF80F54FB41530E9DE862C6DF3CE451C623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1B008 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

wcsftime.LIBCMT ref: 00007FF78EB1B04C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: wcsftime
String ID:
API String ID: 2902305603-0
Opcode ID: a22c1b3fabe6fe8149e860aeabbe93296e0200a8b389bc1be08adc04fb026441
Instruction ID: e996ee67665ee89d42b2288089d874b9df69b0917df00443fbbf25ac48c053b7
Opcode Fuzzy Hash: a22c1b3fabe6fe8149e860aeabbe93296e0200a8b389bc1be08adc04fb026441
Instruction Fuzzy Hash: 95F0A962A18B85D1DA20DB81E4447A9E769FF887D0FE48035EE5C03B59DF7CD504C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABC51C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF78EABC55A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction ID: a901b147f0c7309722539791abf66b2ec263d5e57cef49497f0fd8ffdd520e2d
Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction Fuzzy Hash: 9EF03A40A8924655FE24B6E25801E7AE1847FC4FA0FA84B30D86E852C6DF7CE440C632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA8652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAB4970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB4999

FreeLibrary.KERNEL32(?,?,?,00007FF78EACC8FE), ref: 00007FF78EA8656F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FreeLibrary_invalid_parameter_noinfo
String ID:
API String ID: 3938577545-0
Opcode ID: da6da5ce6b5fed19cebdf43eb4da99447be33f66cfe2f3ce8874e42a4e2a27a3
Instruction ID: 1cb9b997b23d3952271edabc0e4d9deb6ff8b7993206be82b40e2ca6e5cb31e0
Opcode Fuzzy Hash: da6da5ce6b5fed19cebdf43eb4da99447be33f66cfe2f3ce8874e42a4e2a27a3
Instruction Fuzzy Hash: A6F05472A0560582FF1DEFB5C0557385364BB94F08F640531C93E0A149CF3CD454C352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA4C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF78EAA4C5C

Part of subcall function 00007FF78EAA5600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF78EAA5609
Part of subcall function 00007FF78EAA5600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF78EAA561A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction ID: 14999f646549a20386e1cd8f8f00f70a5921d28860f04f6dacc0756eee3be675
Opcode Fuzzy Hash: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction Fuzzy Hash: D3E09240E1930745F96879E31545879C5402F98F71EF81B34E93E452C2FF3CA455C1B6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA83EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF78EA83ED8

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction ID: cd9e5bdf3eadddf770bc09b14adac7b0f396a86c60974ea6ca297c0568eadbe6
Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction Fuzzy Hash: 17E0D822B0874181D721A765E1457A8E3A1FB8CBC4F544031FE8C43B5ACE7CC5C4CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA85D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF78EA85DDE

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction ID: 3263869796be63ac0ff26af32bbdacac327b5b139f72fff25100c6ad96f8b37b
Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction Fuzzy Hash: DBF0823191978187E361AB99E804765BAA5F789708FE40135D58D06795CF3CD305CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA81080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA87920: RegOpenKeyExW.KERNEL32(?,?,?,00007FF78EA8109E), ref: 00007FF78EA87A75

_onexit.LIBCMT ref: 00007FF78EAA4F10

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Open_onexit
String ID:
API String ID: 3030063568-0
Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction ID: 6fd0b816358cc71bf3f694e46d3466f63bef30205925eaeb2948c6882ac47b12
Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction Fuzzy Hash: DFE08C50F2A64BC1EA04B7EAD8C587896A07F92B06FF05536D01CC2351EF3CD292C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA810E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAA1D80: GetVersionExW.KERNEL32 ref: 00007FF78EAA1DC8
Part of subcall function 00007FF78EAA1D80: GetCurrentProcess.KERNEL32 ref: 00007FF78EAA1F42
Part of subcall function 00007FF78EAA1D80: IsWow64Process.KERNEL32 ref: 00007FF78EAA1F52

_onexit.LIBCMT ref: 00007FF78EAA4F10

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Process$CurrentVersionWow64_onexit
String ID:
API String ID: 2932345936-0
Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction ID: 6a8f46e3510109709d9837556352c6b523ed0a40691c11f2ed1396800d049965
Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction Fuzzy Hash: E0C01200E6914BC0F61877F788868F841A06FE5F00FF00136D10D81282DF2C51E68773

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA81048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF78EAA4F10

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction ID: 4a8af31b438ec613e8a4e94c186adc1c0d492567c7f3b897d7409189219d1ba0
Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction Fuzzy Hash: 39C0C900E5954BC0A51873F688868B841902FA9F10FE00535E00DC1282DE2C51E68762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA81064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF78EAA4F10

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction ID: 5c24f5938efda8f9405f069e457e68a7f716f133ecaebbe1e28c1b7184cfa869
Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction Fuzzy Hash: E4C0C901E6A14BC0A51873FA88868B841902FE5F00FE00235E00D81282DE2C51E68622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFCED4 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF78EAFCED8

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bac09a3189ccebf1c98b8807f566a5e7d1195259a38ec772a626d8fd4a22b2c7
Instruction ID: 945b4048df3539f72d8ba8b57306eb2f491ec94307eeeff51de8d125d43ddf5e
Opcode Fuzzy Hash: bac09a3189ccebf1c98b8807f566a5e7d1195259a38ec772a626d8fd4a22b2c7
Instruction Fuzzy Hash: F0C01230E0950290E568779A4895474D2507F02750FF10631D02A811E0CB3C2457D63A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0636C Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAFBC70: FindFirstFileW.KERNEL32 ref: 00007FF78EAFBD09
Part of subcall function 00007FF78EAFBC70: DeleteFileW.KERNEL32 ref: 00007FF78EAFBD5B
Part of subcall function 00007FF78EAFBC70: FindNextFileW.KERNELBASE ref: 00007FF78EAFBD6D
Part of subcall function 00007FF78EAFBC70: FindClose.KERNEL32 ref: 00007FF78EAFBD7F

GetLastError.KERNEL32 ref: 00007FF78EB0639D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 5f35c2de6374da573506e97e4f75869a29f74c360ce096ae7f9d2beb91559d16
Instruction ID: 081a61db969d1eb9205aadd7b4eba8179b538f6791caba24a701536ada43d997
Opcode Fuzzy Hash: 5f35c2de6374da573506e97e4f75869a29f74c360ce096ae7f9d2beb91559d16
Instruction Fuzzy Hash: FFF08132B0868182EB00EB55E580639A760FB89FC4F649430EA5D43B46CF38D452C750

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF78EB317C0 Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 587windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82A54: GetWindowLongPtrW.USER32 ref: 00007FF78EA82A71

GetWindowLongW.USER32 ref: 00007FF78EB3189B
SendMessageW.USER32 ref: 00007FF78EB318C9
SendMessageW.USER32 ref: 00007FF78EB318F4
GetKeyState.USER32 ref: 00007FF78EB319A7
GetKeyState.USER32 ref: 00007FF78EB319BB
SendMessageW.USER32 ref: 00007FF78EB319D8
GetKeyState.USER32 ref: 00007FF78EB319E6
SendMessageW.USER32 ref: 00007FF78EB31A16
SendMessageW.USER32 ref: 00007FF78EB31A9C
SendMessageW.USER32 ref: 00007FF78EB31AC7
GetCursorPos.USER32 ref: 00007FF78EB31B66
ScreenToClient.USER32 ref: 00007FF78EB31B74
SendMessageW.USER32 ref: 00007FF78EB31BD7
SendMessageW.USER32 ref: 00007FF78EB31BFF
SendMessageW.USER32 ref: 00007FF78EB31C32
SendMessageW.USER32 ref: 00007FF78EB31C64
SendMessageW.USER32 ref: 00007FF78EB31C86
SendMessageW.USER32 ref: 00007FF78EB31C9C
GetCursorPos.USER32 ref: 00007FF78EB31CC4
ScreenToClient.USER32 ref: 00007FF78EB31CD2
GetParent.USER32 ref: 00007FF78EB31CF1
SendMessageW.USER32 ref: 00007FF78EB31D54
SendMessageW.USER32 ref: 00007FF78EB31D7E
ClientToScreen.USER32 ref: 00007FF78EB31DD1
TrackPopupMenuEx.USER32 ref: 00007FF78EB31E0E
SendMessageW.USER32 ref: 00007FF78EB31E33
SendMessageW.USER32 ref: 00007FF78EB31E5A
ClientToScreen.USER32 ref: 00007FF78EB31E9F
TrackPopupMenuEx.USER32 ref: 00007FF78EB31EDF
GetWindowLongW.USER32 ref: 00007FF78EB31F70
DefDlgProcW.USER32 ref: 00007FF78EB32197

Strings

F, xrefs: 00007FF78EB31E60
@GUI_DRAGID, xrefs: 00007FF78EB3210C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
String ID: @GUI_DRAGID$F
API String ID: 1993697042-4164748364
Opcode ID: 3ff90e006b483cd32b52f8b202347da56c14ceba00f8a4b8b2e43484e8e82e80
Instruction ID: 6bc11c258094c634d9c7d624bdb1f7baa9dfbc5e09a58c143bbd016d6583d054
Opcode Fuzzy Hash: 3ff90e006b483cd32b52f8b202347da56c14ceba00f8a4b8b2e43484e8e82e80
Instruction Fuzzy Hash: 06527332A19A4682EB50AFA5D445EB9ABA1FF84B84FA04136DB4D43FA5CF3CE450C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2CE8C Relevance: 69.5, APIs: 46, Instructions: 540windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 00007FF78EB2CF8D
LoadImageW.USER32 ref: 00007FF78EB2CFAE
SendMessageW.USER32 ref: 00007FF78EB2CFCE
DeleteObject.GDI32 ref: 00007FF78EB2CFE0
DestroyIcon.USER32 ref: 00007FF78EB2CFF2

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
String ID:
API String ID: 3481653762-0
Opcode ID: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction ID: d8fe0433a1b50564e6e5b078cee2038213c46ab41b58046f9349ae8e7a7633ec
Opcode Fuzzy Hash: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
Instruction Fuzzy Hash: 97329036A09AC186EB50EFA5D444AB9BBA1FF84B84FA04135DE4E43BA4CF7CE545C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2BA0C Relevance: 54.8, APIs: 30, Strings: 1, Instructions: 500windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF78EB2BAE3
SendMessageW.USER32 ref: 00007FF78EB2BB33
IsMenu.USER32 ref: 00007FF78EB2BB4E
GetMenuItemInfoW.USER32 ref: 00007FF78EB2BB94
SendMessageW.USER32 ref: 00007FF78EB2BC27
SendMessageW.USER32 ref: 00007FF78EB2BC4E
SendMessageW.USER32 ref: 00007FF78EB2BC67
SendMessageW.USER32 ref: 00007FF78EB2BC82
SendMessageW.USER32 ref: 00007FF78EB2BCA6
SendMessageW.USER32 ref: 00007FF78EB2BCD4
SendMessageW.USER32 ref: 00007FF78EB2BCF0
SendMessageW.USER32 ref: 00007FF78EB2BD14
GetWindowLongW.USER32 ref: 00007FF78EB2BD4F
SendMessageW.USER32 ref: 00007FF78EB2BD9C
SendMessageW.USER32 ref: 00007FF78EB2BDC0
SendMessageW.USER32 ref: 00007FF78EB2BE5A
wsprintfW.USER32 ref: 00007FF78EB2BE91
SendMessageW.USER32 ref: 00007FF78EB2BEAE
GetWindowTextW.USER32 ref: 00007FF78EB2BEE3
SendMessageW.USER32 ref: 00007FF78EB2BF05
SendMessageW.USER32 ref: 00007FF78EB2BF2E
GetWindowTextW.USER32 ref: 00007FF78EB2BF5B
GetWindowLongW.USER32 ref: 00007FF78EB2BFF2
SendMessageW.USER32 ref: 00007FF78EB2C026
SendMessageW.USER32 ref: 00007FF78EB2C067
SendMessageW.USER32 ref: 00007FF78EB2C0D0
CharNextW.USER32 ref: 00007FF78EB2C10B
SendMessageW.USER32 ref: 00007FF78EB2C152
SendMessageW.USER32 ref: 00007FF78EB2C189

Strings

%d/%02d/%02d, xrefs: 00007FF78EB2BE76

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$Window$LongMenuText$CharInfoItemNextwsprintf
String ID: %d/%02d/%02d
API String ID: 1218376639-328681919
Opcode ID: dc4bbc0974ac4667326bad8888421589749c92fab70b3f4fd50d837d0e1f6096
Instruction ID: c60b0bd9e0a8acba5fdaef53667b16776af349d73d84ea11aa6a711a9db6448c
Opcode Fuzzy Hash: dc4bbc0974ac4667326bad8888421589749c92fab70b3f4fd50d837d0e1f6096
Instruction Fuzzy Hash: 4712E432A0968282F750AFA59895EBDABA0FF85B94FA04135DE5D47BD4CF3CD441CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2DB18 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF78EB2DBEA
SendMessageW.USER32 ref: 00007FF78EB2DC8E
SendMessageW.USER32 ref: 00007FF78EB2DCAD
SendMessageW.USER32 ref: 00007FF78EB2DCE6
GetMenuItemInfoW.USER32 ref: 00007FF78EB2DD10
SetMenuItemInfoW.USER32 ref: 00007FF78EB2DD70
SetMenuDefaultItem.USER32 ref: 00007FF78EB2DD86
GetMenuItemInfoW.USER32 ref: 00007FF78EB2DD96
SetMenuDefaultItem.USER32 ref: 00007FF78EB2DDB4
DrawMenuBar.USER32 ref: 00007FF78EB2DDBE
SendMessageW.USER32 ref: 00007FF78EB2DE57
SendMessageW.USER32 ref: 00007FF78EB2DE92
GetWindowLongW.USER32 ref: 00007FF78EB2DEBD
SendMessageW.USER32 ref: 00007FF78EB2DEFC
SendMessageW.USER32 ref: 00007FF78EB2DF3F
EnableWindow.USER32 ref: 00007FF78EB2DFA7
EnableWindow.USER32 ref: 00007FF78EB2DFBD
ShowWindow.USER32 ref: 00007FF78EB2E03E
ShowWindow.USER32 ref: 00007FF78EB2E051
EnableWindow.USER32 ref: 00007FF78EB2E06B
SendMessageW.USER32 ref: 00007FF78EB2E0A0
SendMessageW.USER32 ref: 00007FF78EB2E0C4
GetFocus.USER32 ref: 00007FF78EB2E0CA
MoveWindow.USER32 ref: 00007FF78EB2E18A
SendMessageW.USER32 ref: 00007FF78EB2E19F
GetWindowRect.USER32 ref: 00007FF78EB2E1BE
MoveWindow.USER32 ref: 00007FF78EB2E1F1
MoveWindow.USER32 ref: 00007FF78EB2E21F

Strings

P, xrefs: 00007FF78EB2DCFD

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
String ID: P
API String ID: 1208186926-3110715001
Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction ID: f1a98353d89e78085cde2d5891ac084cafa38d9f93505b93a8e1e214215ce6eb
Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction Fuzzy Hash: BD123672A086C286E724ABA5D454FBDABA0FF85788FA00535DE4E47E94CF7CE441CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA4514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF78EAA452F
FindWindowW.USER32 ref: 00007FF78EAEA812
IsIconic.USER32 ref: 00007FF78EAEA81E
ShowWindow.USER32 ref: 00007FF78EAEA830
SetForegroundWindow.USER32 ref: 00007FF78EAEA839
GetWindowThreadProcessId.USER32 ref: 00007FF78EAEA84C
GetCurrentThreadId.KERNEL32 ref: 00007FF78EAEA854
GetWindowThreadProcessId.USER32 ref: 00007FF78EAEA862
AttachThreadInput.USER32 ref: 00007FF78EAEA878
AttachThreadInput.USER32 ref: 00007FF78EAEA886
AttachThreadInput.USER32 ref: 00007FF78EAEA894
SetForegroundWindow.USER32 ref: 00007FF78EAEA89D
MapVirtualKeyW.USER32 ref: 00007FF78EAEA8B2
keybd_event.USER32 ref: 00007FF78EAEA8C3
MapVirtualKeyW.USER32 ref: 00007FF78EAEA8CD
keybd_event.USER32 ref: 00007FF78EAEA8DF
MapVirtualKeyW.USER32 ref: 00007FF78EAEA8E9
keybd_event.USER32 ref: 00007FF78EAEA8FA
MapVirtualKeyW.USER32 ref: 00007FF78EAEA904
keybd_event.USER32 ref: 00007FF78EAEA916
SetForegroundWindow.USER32 ref: 00007FF78EAEA91F
AttachThreadInput.USER32 ref: 00007FF78EAEA93C
AttachThreadInput.USER32 ref: 00007FF78EAEA94A
AttachThreadInput.USER32 ref: 00007FF78EAEA958

Strings

Shell_TrayWnd, xrefs: 00007FF78EAEA80B

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction ID: 98593d3d026199046188f1c3eea5de0ffd2e76765539bfd88c19b2254f82df0c
Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction Fuzzy Hash: C4417331B0961283F7146FAAA815E3AA6D1BF88F85FE44031C90A47F54EF3DA84AC350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAECE68 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAED5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF78EAED630
Part of subcall function 00007FF78EAED5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF78EAED66F
Part of subcall function 00007FF78EAED5CC: GetLastError.KERNEL32 ref: 00007FF78EAED682

LogonUserW.ADVAPI32 ref: 00007FF78EAECF1A
DuplicateTokenEx.ADVAPI32 ref: 00007FF78EAECF4D
CloseHandle.KERNEL32 ref: 00007FF78EAECF60
OpenWindowStationW.USER32 ref: 00007FF78EAECF7F
GetProcessWindowStation.USER32 ref: 00007FF78EAECF96
SetProcessWindowStation.USER32 ref: 00007FF78EAECFA3
OpenDesktopW.USER32 ref: 00007FF78EAECFC3
wcscpy.LIBCMT ref: 00007FF78EAED0A5
LoadUserProfileW.USERENV ref: 00007FF78EAED0B8
CreateEnvironmentBlock.USERENV ref: 00007FF78EAED0D8
CreateProcessAsUserW.ADVAPI32 ref: 00007FF78EAED12F

Part of subcall function 00007FF78EAED780: GetProcessHeap.KERNEL32 ref: 00007FF78EAED7A2
Part of subcall function 00007FF78EAED780: HeapAlloc.KERNEL32 ref: 00007FF78EAED7B4
Part of subcall function 00007FF78EAED780: GetCurrentProcess.KERNEL32 ref: 00007FF78EAED7BD
Part of subcall function 00007FF78EAED780: GetCurrentProcess.KERNEL32 ref: 00007FF78EAED7C6
Part of subcall function 00007FF78EAED780: DuplicateHandle.KERNEL32 ref: 00007FF78EAED7EA
Part of subcall function 00007FF78EAED780: GetCurrentProcess.KERNEL32 ref: 00007FF78EAED7F0
Part of subcall function 00007FF78EAED780: GetCurrentProcess.KERNEL32 ref: 00007FF78EAED7F9
Part of subcall function 00007FF78EAED780: DuplicateHandle.KERNEL32 ref: 00007FF78EAED81E
Part of subcall function 00007FF78EAED780: CreateThread.KERNEL32 ref: 00007FF78EAED844

UnloadUserProfile.USERENV ref: 00007FF78EAED16C
CloseWindowStation.USER32 ref: 00007FF78EAED185
CloseDesktop.USER32 ref: 00007FF78EAED193
SetProcessWindowStation.USER32 ref: 00007FF78EAED1A5
CloseHandle.KERNEL32 ref: 00007FF78EAED1B0
DestroyEnvironmentBlock.USERENV ref: 00007FF78EAED1C7

Strings

winsta0, xrefs: 00007FF78EAECF72
default, xrefs: 00007FF78EAECFB7
winsta0\default, xrefs: 00007FF78EAED054

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
String ID: default$winsta0$winsta0\default
API String ID: 3202303201-1423368268
Opcode ID: 19fa60696548a8d0e1a2dc45f77bb3d3c3f3a9dde0f0076f85872541770c923c
Instruction ID: 63c1f52239e994a3fd3ba682f363ad12a6c12791bd1a88ed86ce407f09b8be64
Opcode Fuzzy Hash: 19fa60696548a8d0e1a2dc45f77bb3d3c3f3a9dde0f0076f85872541770c923c
Instruction Fuzzy Hash: 05A16232B09B4286E710EFA6E440AB9B7A1FB85B94F940135DE5D47B98CF3CE405C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA82AE0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00007FF78EA82BE8
GetSystemMetrics.USER32 ref: 00007FF78EA82BF3
SystemParametersInfoW.USER32 ref: 00007FF78EA82C25
GetSystemMetrics.USER32 ref: 00007FF78EA82C2F
GetSystemMetrics.USER32 ref: 00007FF78EA82C5A
SetRect.USER32 ref: 00007FF78EA82C7D
AdjustWindowRectEx.USER32 ref: 00007FF78EA82C90
CreateWindowExW.USER32 ref: 00007FF78EA82CEF
SetWindowLongPtrW.USER32 ref: 00007FF78EA82D0E
GetClientRect.USER32 ref: 00007FF78EA82D30
GetStockObject.GDI32 ref: 00007FF78EA82D4C
SendMessageW.USER32 ref: 00007FF78EA82D5F

Part of subcall function 00007FF78EA81CEC: GetCursorPos.USER32 ref: 00007FF78EA81D1B
Part of subcall function 00007FF78EA81CEC: ScreenToClient.USER32 ref: 00007FF78EA81D3A
Part of subcall function 00007FF78EA81CEC: GetAsyncKeyState.USER32 ref: 00007FF78EA81D62
Part of subcall function 00007FF78EA81CEC: GetAsyncKeyState.USER32 ref: 00007FF78EA81D82

SetTimer.USER32 ref: 00007FF78EA82D90

Strings

AutoIt v3 GUI, xrefs: 00007FF78EA82CDF

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 26d3b03eb1ec0295eb0d9995ecf287e14171f67f9b57e050428d4d20fdccdb5d
Instruction ID: 6e6faf1bf769e83a6f7746f45f669ab810f85352ad8f3e2cc6ea75f6c1773371
Opcode Fuzzy Hash: 26d3b03eb1ec0295eb0d9995ecf287e14171f67f9b57e050428d4d20fdccdb5d
Instruction Fuzzy Hash: 41D14D32A14A528BE714EFB9D854BBD7BA1FB44B58FA00135DA0E53BA4DF38E444C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB10A6C Relevance: 30.2, APIs: 20, Instructions: 169clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF78EB10AAA
IsClipboardFormatAvailable.USER32 ref: 00007FF78EB10AB7
GetClipboardData.USER32 ref: 00007FF78EB10AC9
CloseClipboard.USER32 ref: 00007FF78EB10AD7
GlobalLock.KERNEL32 ref: 00007FF78EB10B07
CloseClipboard.USER32 ref: 00007FF78EB10B12
GlobalUnlock.KERNEL32 ref: 00007FF78EB10B42
IsClipboardFormatAvailable.USER32 ref: 00007FF78EB10B52
GetClipboardData.USER32 ref: 00007FF78EB10B61
GlobalLock.KERNEL32 ref: 00007FF78EB10B76
GlobalUnlock.KERNEL32 ref: 00007FF78EB10BB5
CloseClipboard.USER32 ref: 00007FF78EB10CFC

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 5e3e1e7d7e0fd8e693f3b1b98b8cd09f95ce49b5b3e06d415371d4ee9fd0d329
Instruction ID: aab657c301fcfd575331f63857c1f9456b3b66fcc94eea09d019eab0a061092b
Opcode Fuzzy Hash: 5e3e1e7d7e0fd8e693f3b1b98b8cd09f95ce49b5b3e06d415371d4ee9fd0d329
Instruction Fuzzy Hash: D971BF31B0A65382EA10BB95D455A7CABA2FF85F84FE04035DA0E47BA1DF3CE506C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2C6D4 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF78EB2C876
SendMessageW.USER32 ref: 00007FF78EB2C88E
SendMessageW.USER32 ref: 00007FF78EB2C8B6
SendMessageW.USER32 ref: 00007FF78EB2C8CE
CharNextW.USER32 ref: 00007FF78EB2C903
SendMessageW.USER32 ref: 00007FF78EB2C91B
SendMessageW.USER32 ref: 00007FF78EB2C950
SendMessageW.USER32 ref: 00007FF78EB2C971
GetMenuItemInfoW.USER32 ref: 00007FF78EB2C9E1
SetMenuItemInfoW.USER32 ref: 00007FF78EB2CA06
DrawMenuBar.USER32 ref: 00007FF78EB2CA13
SendMessageW.USER32 ref: 00007FF78EB2CA53
InvalidateRect.USER32 ref: 00007FF78EB2CA78
SetWindowTextW.USER32 ref: 00007FF78EB2CB01
SendMessageW.USER32 ref: 00007FF78EB2CB71
SendMessageW.USER32 ref: 00007FF78EB2CBE3
SendMessageW.USER32 ref: 00007FF78EB2CC3D
SendMessageW.USER32 ref: 00007FF78EB2CCC3
SendMessageW.USER32 ref: 00007FF78EB2CD2E

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
String ID:
API String ID: 1015379403-0
Opcode ID: 48b1a1b098f20d8d6637e58e142fe5064dcb3bbb0445ab3a9841590c8a134aa7
Instruction ID: 5b7a281d00cbb35fbfc6e2bd4aa67353b81aab72f23f9f1f8913c42f2bcf24ca
Opcode Fuzzy Hash: 48b1a1b098f20d8d6637e58e142fe5064dcb3bbb0445ab3a9841590c8a134aa7
Instruction Fuzzy Hash: B002F831A096C296EB20AFA1D404AB9ABA1FF84794FA44231DA5D17BD4CF3CE945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF78EB12094
LoadCursorW.USER32 ref: 00007FF78EB120A5
LoadCursorW.USER32 ref: 00007FF78EB120B6
LoadCursorW.USER32 ref: 00007FF78EB120C7
LoadCursorW.USER32 ref: 00007FF78EB120D8
LoadCursorW.USER32 ref: 00007FF78EB120E9
LoadCursorW.USER32 ref: 00007FF78EB120FA
LoadCursorW.USER32 ref: 00007FF78EB1210B
LoadCursorW.USER32 ref: 00007FF78EB1211C
LoadCursorW.USER32 ref: 00007FF78EB1212D
LoadCursorW.USER32 ref: 00007FF78EB1213E
LoadCursorW.USER32 ref: 00007FF78EB1214F
LoadCursorW.USER32 ref: 00007FF78EB12160
LoadCursorW.USER32 ref: 00007FF78EB12171
LoadCursorW.USER32 ref: 00007FF78EB12182
LoadCursorW.USER32 ref: 00007FF78EB12193
GetCursorInfo.USER32 ref: 00007FF78EB121A8
GetLastError.KERNEL32 ref: 00007FF78EB121E9

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction ID: 9caa27d3e81fdadcc6c4281f6740a0b0f69217111e4f52034a4ca41560215906
Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction Fuzzy Hash: D8515B32A0DB128AEB44ABA4F45957D67E1FB48B44F60443ADA0E83B84DF7CE456C354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB20AEC Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 388registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32 ref: 00007FF78EB20BF8
RegCreateKeyExW.ADVAPI32 ref: 00007FF78EB20C8C
RegSetValueExW.ADVAPI32 ref: 00007FF78EB20ED2
RegSetValueExW.ADVAPI32 ref: 00007FF78EB21047
RegCloseKey.ADVAPI32 ref: 00007FF78EB2107A
RegCloseKey.ADVAPI32 ref: 00007FF78EB21089

Strings

REG_DWORD, xrefs: 00007FF78EB20F1D
REG_QWORD, xrefs: 00007FF78EB20F90
REG_BINARY, xrefs: 00007FF78EB20FE8
REG_EXPAND_SZ, xrefs: 00007FF78EB20CFB
REG_MULTI_SZ, xrefs: 00007FF78EB20DF8
REG_SZ, xrefs: 00007FF78EB20D83

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseValue$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 3314541760-966354055
Opcode ID: c2661cbcf60f50b911ca365fc450a5397cab0d2fa8d36ea4ca4b93b3b050d5a4
Instruction ID: 3a24b0f155987e47612817c5ec3b7b1437301d36b4849290e6e8189236351547
Opcode Fuzzy Hash: c2661cbcf60f50b911ca365fc450a5397cab0d2fa8d36ea4ca4b93b3b050d5a4
Instruction Fuzzy Hash: 3A027F22B08A9285EB10FFA6D491ABDB764FF89F84B955032DE0D47756DF38E441C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA85F3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF78EA85F65

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 505bc1ac260f627f388b9ce0ef0303fb06d7118b1057d91edc122da117b259b5
Instruction ID: 77593c3f9c4517c16dc8430dca3fc113449420a00082bc1ec26c45bc7b009fd6
Opcode Fuzzy Hash: 505bc1ac260f627f388b9ce0ef0303fb06d7118b1057d91edc122da117b259b5
Instruction Fuzzy Hash: EFA1C532A0864196F724EFA5E404AB9F7A0FF84B94FA08136DA5E43B94CF7CE945C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB08BF4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF78EB08CDA
SystemTimeToFileTime.KERNEL32 ref: 00007FF78EB08CEC
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF78EB08D00
wcscat.LIBCMT ref: 00007FF78EB08D84
wcscat.LIBCMT ref: 00007FF78EB08D95
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB08DA6
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB08DB3
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB08DEE
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB08E3F
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB08E4C
wcscpy.LIBCMT ref: 00007FF78EB08E5E

Strings

*.*, xrefs: 00007FF78EB08E52

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Localwcscat$Systemwcscpy
String ID: *.*
API String ID: 1111067124-438819550
Opcode ID: 44a7a2dc7d77b47c1bd132d9622fe18c2c0abd02877e1c7c981d395a4e0f69b9
Instruction ID: 89c8dfdbce269dd686075583e62d9d609c3fee3a6a709fdf5382eded64c7d04e
Opcode Fuzzy Hash: 44a7a2dc7d77b47c1bd132d9622fe18c2c0abd02877e1c7c981d395a4e0f69b9
Instruction Fuzzy Hash: C571A032618B8691DB60EF52E8409FEB7A1FB84B88FA01031DA4D47B66DF3DE645C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0A350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF78EB0A390
GetFileAttributesW.KERNEL32 ref: 00007FF78EB0A3CE
SetFileAttributesW.KERNEL32 ref: 00007FF78EB0A3E5
FindNextFileW.KERNEL32 ref: 00007FF78EB0A3FA
FindClose.KERNEL32 ref: 00007FF78EB0A407
FindClose.KERNEL32 ref: 00007FF78EB0A424
FindFirstFileW.KERNEL32 ref: 00007FF78EB0A43D
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB0A489
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB0A4B0
FindNextFileW.KERNEL32 ref: 00007FF78EB0A4BE
FindClose.KERNEL32 ref: 00007FF78EB0A4CD

Strings

*.*, xrefs: 00007FF78EB0A436

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction ID: 802ecedeb2031de9d194ebe1da3dcb7e64cb15ff59a06af562bdfcf7ff2f4d18
Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction Fuzzy Hash: BD41A135A0964244EB00EBA5E945EB9EBA0FF44BA4FE04531DD6E476E4DF3CE40AC320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0A4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF78EB0A530
FindNextFileW.KERNEL32 ref: 00007FF78EB0A588
FindClose.KERNEL32 ref: 00007FF78EB0A595
FindClose.KERNEL32 ref: 00007FF78EB0A5B3
FindFirstFileW.KERNEL32 ref: 00007FF78EB0A5CC
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB0A611
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB0A638
FindNextFileW.KERNEL32 ref: 00007FF78EB0A646
FindClose.KERNEL32 ref: 00007FF78EB0A655

Part of subcall function 00007FF78EAFC67C: CreateFileW.KERNEL32 ref: 00007FF78EAFC6B1

Strings

*.*, xrefs: 00007FF78EB0A5C5

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction ID: e2932f287ca8a9bf8121d699a3d28c6f7a98ccb6b1be3d791815d09413b21db0
Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction Fuzzy Hash: 90417231A0CA4250EA50BB95A845EBAEB90FF45BE4FE04531DD6E476E5EF3CE409C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2055C Relevance: 16.9, APIs: 11, Instructions: 371registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EB21110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF78EB1FD7B), ref: 00007FF78EB21143

RegConnectRegistryW.ADVAPI32 ref: 00007FF78EB20662
RegOpenKeyExW.ADVAPI32 ref: 00007FF78EB206CD
RegCloseKey.ADVAPI32 ref: 00007FF78EB206F4
RegQueryValueExW.ADVAPI32 ref: 00007FF78EB20746
RegQueryValueExW.ADVAPI32 ref: 00007FF78EB207FD
RegQueryValueExW.ADVAPI32 ref: 00007FF78EB20860
RegQueryValueExW.ADVAPI32 ref: 00007FF78EB20907
RegQueryValueExW.ADVAPI32 ref: 00007FF78EB20961
RegQueryValueExW.ADVAPI32 ref: 00007FF78EB20A12
RegCloseKey.ADVAPI32 ref: 00007FF78EB20A9E
RegCloseKey.ADVAPI32 ref: 00007FF78EB20AAD

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3218304859-0
Opcode ID: 8460fcd14c2d5af8b8448452fe1ceaeb79385f0ae3ec0649039ae0ff740bb763
Instruction ID: 608333cd9d052ef1b251a8d777cfd80a8125026b0f03499ee9cf35246cf543bb
Opcode Fuzzy Hash: 8460fcd14c2d5af8b8448452fe1ceaeb79385f0ae3ec0649039ae0ff740bb763
Instruction Fuzzy Hash: 6EF17032B05A9286EB10EFA5D490ABCB7B0FF85B98BA18131DE4D47B95DF38E001C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB083D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF78EB08452
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF78EB084FC
SHGetDesktopFolder.SHELL32 ref: 00007FF78EB08516
CoCreateInstance.OLE32 ref: 00007FF78EB0858F
SHCreateShellItem.SHELL32 ref: 00007FF78EB08629
CoTaskMemFree.OLE32 ref: 00007FF78EB08699
SHBrowseForFolderW.SHELL32 ref: 00007FF78EB0872A
SHGetPathFromIDListW.SHELL32 ref: 00007FF78EB0874B
CoTaskMemFree.OLE32 ref: 00007FF78EB08754
CoTaskMemFree.OLE32 ref: 00007FF78EB08799
CoUninitialize.OLE32 ref: 00007FF78EB0879F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 88abb8603447e432c7220777c94e58854007cc25b7963db554ba3f1bca1083b8
Instruction ID: dfdc9e9c5d0750d0c3a5c6a32a02cfc97ec79b98ba26c42b13fd99514a681d22
Opcode Fuzzy Hash: 88abb8603447e432c7220777c94e58854007cc25b7963db554ba3f1bca1083b8
Instruction Fuzzy Hash: 00C16D36B04B9585EB10EFA6E8849ADBBA0FB88F94F954036DE4E47B25CF38D545C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEC858 Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAECD34: GetUserObjectSecurity.USER32 ref: 00007FF78EAECD65
Part of subcall function 00007FF78EAECD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF78EAEC65A), ref: 00007FF78EAECD71
Part of subcall function 00007FF78EAECD34: GetUserObjectSecurity.USER32 ref: 00007FF78EAECD9C

Part of subcall function 00007FF78EAECE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF78EAEC66F), ref: 00007FF78EAECE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF78EAEC8E7
GetAclInformation.ADVAPI32 ref: 00007FF78EAEC921
GetLengthSid.ADVAPI32 ref: 00007FF78EAEC932
GetAce.ADVAPI32 ref: 00007FF78EAEC970
AddAce.ADVAPI32 ref: 00007FF78EAEC997
GetLengthSid.ADVAPI32 ref: 00007FF78EAEC9AF
GetLengthSid.ADVAPI32 ref: 00007FF78EAEC9D2
CopySid.ADVAPI32 ref: 00007FF78EAEC9E1
AddAce.ADVAPI32 ref: 00007FF78EAECA27
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF78EAECA4B
SetUserObjectSecurity.USER32 ref: 00007FF78EAECA60

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction ID: d321d30018169981e202a6042b1fcf8b3bbf7ece91d9908b4b6d2eec3dc66a53
Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction Fuzzy Hash: 0161D132B0469296EB00EFA1D8459BC77B5FB44F88BA44035DE1E63B94DF39D845C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB059D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF78EB059FB
GetDiskFreeSpaceW.KERNEL32 ref: 00007FF78EB05A86
GetLastError.KERNEL32 ref: 00007FF78EB05A90
SetErrorMode.KERNEL32 ref: 00007FF78EB05B17

Strings

NOTREADY, xrefs: 00007FF78EB05AB7
INVALID, xrefs: 00007FF78EB05ACD
READY, xrefs: 00007FF78EB05AD6
READONLY, xrefs: 00007FF78EB05AC4
UNKNOWN, xrefs: 00007FF78EB05AB0

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: e1a572a878ac439d4873769eb739623b4178df3d2e0a7b9e1def14c61bfa5fa1
Instruction ID: 377d4b274aa25c6b27c1e858a733d9472c5fd2731d0175cef4287e69f4ece111
Opcode Fuzzy Hash: e1a572a878ac439d4873769eb739623b4178df3d2e0a7b9e1def14c61bfa5fa1
Instruction Fuzzy Hash: 0B41A332A09A4285EB10FBA5D8809BCBB71FB88B94FA44532CA0D43B55DF38E585C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB16C34 Relevance: 15.3, APIs: 10, Instructions: 296fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF78EB16C76
CoInitialize.OLE32 ref: 00007FF78EB16CA4
CoUninitialize.OLE32 ref: 00007FF78EB16CAF
GetRunningObjectTable.OLE32 ref: 00007FF78EB16DD9
SetErrorMode.KERNEL32 ref: 00007FF78EB16EF7
CoGetInstanceFromFile.OLE32 ref: 00007FF78EB16F49
CoGetObject.OLE32 ref: 00007FF78EB16F69
SetErrorMode.KERNEL32 ref: 00007FF78EB16F81
SetErrorMode.KERNEL32 ref: 00007FF78EB1701B
VariantClear.OLEAUT32 ref: 00007FF78EB1702E

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 4e444a159b624f06c49a7fffbacf28af46fc882add65112d2ade75d2d1f27c36
Instruction ID: 1af6ddd2b93ad30ce83e191c77ffbd0e585dc116a3fd700a94642f7f401e1f72
Opcode Fuzzy Hash: 4e444a159b624f06c49a7fffbacf28af46fc882add65112d2ade75d2d1f27c36
Instruction Fuzzy Hash: 70D17F37B08B5686EB11AFA5D4409ACB7B2FB88B98BA04036CE5D57B58DF38D445C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2A59C Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(0000001B,?,?,?,?,00000000,?,00007FF78EACDB05), ref: 00007FF78EB2A650
SendMessageW.USER32(?,?,?,?,00000000,?,00007FF78EACDB05), ref: 00007FF78EB2A664
GetWindowLongW.USER32 ref: 00007FF78EB2A697
SendMessageW.USER32(?,?,?,?,00000000,?,00007FF78EACDB05), ref: 00007FF78EB2A6C1
SendMessageW.USER32 ref: 00007FF78EB2A752
SendMessageW.USER32 ref: 00007FF78EB2A7A6
SendMessageW.USER32 ref: 00007FF78EB2A7CD
SendMessageW.USER32 ref: 00007FF78EB2A7F1
SendMessageW.USER32 ref: 00007FF78EB2A80E
SendMessageW.USER32 ref: 00007FF78EB2A832

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: b613241afe3ad8578923ea3e9f1846ed3b3a73b4f0a87d0067d7f4c10d8347cf
Instruction ID: 285f586dbdb93169f05b84e265a08ce4551ca593a3624f596b622e5e9b600ec5
Opcode Fuzzy Hash: b613241afe3ad8578923ea3e9f1846ed3b3a73b4f0a87d0067d7f4c10d8347cf
Instruction Fuzzy Hash: 4371A136605A8186E720EFA5D844AED7BA0FF89B94FA04036DE4D57BA4DF3CD146C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB10D24 Relevance: 15.1, APIs: 10, Instructions: 86clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF78EB10D62
EmptyClipboard.USER32 ref: 00007FF78EB10D68
GlobalAlloc.KERNEL32 ref: 00007FF78EB10D80
CloseClipboard.USER32 ref: 00007FF78EB10E72

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction ID: 001a3ddad572cf7fac8a465ffba69a250958e5a29d799d7b5dfeba31d103b6c9
Opcode Fuzzy Hash: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
Instruction Fuzzy Hash: E7418E72A0964282EB04BB96E494B3CBBA1FF95F85F954435CA4E07762CF7CE041C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFB7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA856D4: GetFullPathNameW.KERNEL32(?,00007FF78EA856C1,?,00007FF78EA87A0C,?,?,?,00007FF78EA8109E), ref: 00007FF78EA856FF

Part of subcall function 00007FF78EAFCED4: GetFileAttributesW.KERNEL32 ref: 00007FF78EAFCED8

FindFirstFileW.KERNEL32 ref: 00007FF78EAFB8AC
DeleteFileW.KERNEL32 ref: 00007FF78EAFB987
MoveFileW.KERNEL32 ref: 00007FF78EAFB9A7
DeleteFileW.KERNEL32 ref: 00007FF78EAFB9CA
FindNextFileW.KERNEL32 ref: 00007FF78EAFB9FC
FindClose.KERNEL32 ref: 00007FF78EAFBA15

Part of subcall function 00007FF78EAFBA80: CopyFileExW.KERNEL32 ref: 00007FF78EAFBAA7

Strings

\*.*, xrefs: 00007FF78EAFB849, 00007FF78EAFB867

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4047182710-1173974218
Opcode ID: f6059cfb6574efd7025c4e587f7997dd81838d68aa52f37f227bdedddfd44906
Instruction ID: 7717f5cae77e3536c8d8bf6ddc6262b25b49dae12cb29461a74784aa3743982a
Opcode Fuzzy Hash: f6059cfb6574efd7025c4e587f7997dd81838d68aa52f37f227bdedddfd44906
Instruction Fuzzy Hash: 98814422A0864295EB50FBA1D4419FDAB70FF84B94FE41032EE4E479A9DF3CD549C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB13940 Relevance: 12.1, APIs: 8, Instructions: 116networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF78EB139DA
WSAGetLastError.WSOCK32 ref: 00007FF78EB139EC
bind.WSOCK32 ref: 00007FF78EB13A3A
WSAGetLastError.WSOCK32 ref: 00007FF78EB13A44
closesocket.WSOCK32 ref: 00007FF78EB13A70
listen.WSOCK32 ref: 00007FF78EB13A7E
WSAGetLastError.WSOCK32 ref: 00007FF78EB13A94
closesocket.WSOCK32 ref: 00007FF78EB13AC0

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction ID: beec2c0f5dfd3e64937b495b8261267623999c6c671f84aa28b570aec795a781
Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction Fuzzy Hash: 0741C072A0869282EB10FF96948167CFBA0FB84FA0FA54530DAAE47792DF3CD041C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB18360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00007FF78EB18831
Not an Object type, xrefs: 00007FF78EB183EA

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: dd79965d0ba62ff07d44b0d9f29dc193ba1526b0ffc83c6dd9deb206d130f64b
Instruction ID: b58c52723d450e52a6077a21521893f6fa32eb0f473d32d7b20ae69afc74b169
Opcode Fuzzy Hash: dd79965d0ba62ff07d44b0d9f29dc193ba1526b0ffc83c6dd9deb206d130f64b
Instruction Fuzzy Hash: 6AE1B636A08B8286EB10DFA5E4406ADBBA1FB84BA8FA04136DF4D57B94DF3CD545C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF9034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF78EAF9089
GetKeyboardState.USER32 ref: 00007FF78EAF909D
SetKeyboardState.USER32 ref: 00007FF78EAF90EC
PostMessageW.USER32 ref: 00007FF78EAF9122
PostMessageW.USER32 ref: 00007FF78EAF9147
PostMessageW.USER32 ref: 00007FF78EAF9190
PostMessageW.USER32 ref: 00007FF78EAF91B9

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction ID: 39553a8290fdb18a86d320e37d016c99c022591232b6621d8a6a2cc5cb11058e
Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction Fuzzy Hash: FF519022A0D2D155FB61ABF15100E7DAF91FB46FC4FA98076DA8927B46CF38E454C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB14C58 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF78EB14C71

Part of subcall function 00007FF78EB10374: GetWindowRect.USER32 ref: 00007FF78EB10389

GetDesktopWindow.USER32 ref: 00007FF78EB14C93
GetWindowRect.USER32 ref: 00007FF78EB14CA0
mouse_event.USER32 ref: 00007FF78EB14CE6

Part of subcall function 00007FF78EAFD7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF78EAFD811
Part of subcall function 00007FF78EAFD7F8: QueryPerformanceFrequency.KERNEL32 ref: 00007FF78EAFD820
Part of subcall function 00007FF78EAFD7F8: Sleep.KERNEL32 ref: 00007FF78EAFD828
Part of subcall function 00007FF78EAFD7F8: QueryPerformanceCounter.KERNEL32 ref: 00007FF78EAFD833

GetCursorPos.USER32(?,?), ref: 00007FF78EB14D1A
mouse_event.USER32 ref: 00007FF78EB14D87

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
String ID:
API String ID: 383626216-0
Opcode ID: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction ID: 14845fe3b69145bed6c149cae43469dbe4aad548e021d3cdd60bebdfb8676bce
Opcode Fuzzy Hash: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
Instruction Fuzzy Hash: A431B533B056528BE314DFA1D440BAC77A1FB88758FA00235EE4A57A84DF3CE949C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABAF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78EABAFD1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78EABAFE9
RtlVirtualUnwind.KERNEL32 ref: 00007FF78EABB024
IsDebuggerPresent.KERNEL32 ref: 00007FF78EABB05D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78EABB067
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78EABB072

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction ID: 555f4838bc5b373472957932bbf6ac2b21f118ab4b7f93fdae41d3473165f3c2
Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction Fuzzy Hash: CD316336608B8185DB60DF65E8406BEB7A4FB88754FA00135EA9D43B99DF3CD545CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0A874 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF78EB0A8F4
FindClose.KERNEL32 ref: 00007FF78EB0AA15

Part of subcall function 00007FF78EB03824: GetInputState.USER32 ref: 00007FF78EB03889
Part of subcall function 00007FF78EB03824: PeekMessageW.USER32 ref: 00007FF78EB03938

Sleep.KERNEL32 ref: 00007FF78EB0A939
FindNextFileW.KERNEL32 ref: 00007FF78EB0AA00

Strings

*.*, xrefs: 00007FF78EB0A8B3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
String ID: *.*
API String ID: 1927845040-438819550
Opcode ID: 4d38b2b1321f3398985d2e0ff211804d84f207fa15f0d091574ab64b32faadfc
Instruction ID: a0cf0917172b9db2d662e845f5cff98cf25432189a2fbbfa4a674e514d28b706
Opcode Fuzzy Hash: 4d38b2b1321f3398985d2e0ff211804d84f207fa15f0d091574ab64b32faadfc
Instruction Fuzzy Hash: F151A632608B8695EB10EB95E840ABDABB0FB45794FA00531DE5D437A9DF3CE545C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA8BE70 Relevance: 8.6, Strings: 6, Instructions: 1141COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FF78EACF6FD
VUUU, xrefs: 00007FF78EA8C21F
PCRE, xrefs: 00007FF78EACF4B1
VUUU, xrefs: 00007FF78EA8C210
ERCP, xrefs: 00007FF78EA8BF69
VUUU, xrefs: 00007FF78EA8C25F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2187161917
Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction ID: 37f5245cd378693b19a44a382bf0b3221af9d0d74f5a44da8f6d17905563d799
Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction Fuzzy Hash: E1B2C676E0C6918AEB649FA49400ABCB7E1FB44B58FA04035DE4D57B84DF3CE981CB12

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB14074 Relevance: 7.6, APIs: 5, Instructions: 148networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EB15E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF78EB137FB), ref: 00007FF78EB15E4D

socket.WSOCK32 ref: 00007FF78EB140FC
WSAGetLastError.WSOCK32 ref: 00007FF78EB1412D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction ID: 027e1a0f42d38abbdc5db045a6e0ff2f9467f1fcde2891883444d97e426497ea
Opcode Fuzzy Hash: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction Fuzzy Hash: 9551C131B0866281DB00FBA69845A7DAB90BB89FE0FA44531DE5E47796CF3CD500C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB06D04 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 308comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF78EB06EBC
CoCreateInstance.OLE32 ref: 00007FF78EB06EDF
CoUninitialize.OLE32 ref: 00007FF78EB071B2

Strings

.lnk, xrefs: 00007FF78EB06D42, 00007FF78EB06DBD, 00007FF78EB06E68

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: b4bdf16b1d6e250789257ed7582273ea4c4491f63d6a2b21af47a83611e6fa4b
Instruction ID: 16db4050c46b4cffee530264c9b7bb2b893dfca69d1206976e08b95d22551a22
Opcode Fuzzy Hash: b4bdf16b1d6e250789257ed7582273ea4c4491f63d6a2b21af47a83611e6fa4b
Instruction Fuzzy Hash: C9D1A172B18B5681EB40FBA5D490ABEAB60FB90B84F905031EE4E47B69DF3CE544C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB793C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF78EAB7A8E

Strings

!, xrefs: 00007FF78EAB7A7A
fmod, xrefs: 00007FF78EAB7A58
VUUU, xrefs: 00007FF78EAB7B5B

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _handle_error
String ID: !$VUUU$fmod
API String ID: 1757819995-2579133210
Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction ID: 3870992b6aaf0c72911d977652834804e1996ad938a989f0ee49b8aa533d2dae
Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction Fuzzy Hash: 00B10821A2CFC444D6A38A3494117B6F259BFEA790F60C336ED9E35AA0DF3C9582C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC2D20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC2D60

Part of subcall function 00007FF78EABB184: GetCurrentProcess.KERNEL32(00007FF78EABB21D), ref: 00007FF78EABB1B1

Strings

., xrefs: 00007FF78EAC3198
*, xrefs: 00007FF78EAC2D87
., xrefs: 00007FF78EAC31A7

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *$.$.
API String ID: 2518042432-2112782162
Opcode ID: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction ID: f0ebd66147fa7127370f499230e64a58caa54519fd10a6ca0b8f71005fc8496f
Opcode Fuzzy Hash: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
Instruction Fuzzy Hash: AB51CF62B14B5584FB10EBE698009BDA7A4BF88FD8FA44535CE4D27B85DF38D082C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB84C0 Relevance: 7.1, APIs: 4, Instructions: 1071COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB88E5
_get_daylight.LIBCMT ref: 00007FF78EAB89C3
_get_daylight.LIBCMT ref: 00007FF78EAB89DC

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 09e4e907ae870b3820667c0232f28915d6dd8b336669930dd8abe80671f645cd
Instruction ID: b4ac9024fa7db5d1c2a35e0bb821a9d53b5095d3061e8fa12672539e95641f2a
Opcode Fuzzy Hash: 09e4e907ae870b3820667c0232f28915d6dd8b336669930dd8abe80671f645cd
Instruction Fuzzy Hash: 79A2C132A0864287EB249FA8D4509BDB7A5FB84F88FA44135DB8D07B98DF3DE511C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA5BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF78EAA5C21
IsDebuggerPresent.KERNEL32 ref: 00007FF78EAA5C39
OutputDebugStringW.KERNEL32 ref: 00007FF78EAA5C4A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF78EAA5C43

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction ID: 742709397e8e71a647201a37792f3f9855c145af11f4d266c3598f2f08e5c1c7
Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction Fuzzy Hash: 5811E032A14B4297F704ABA2D6417B8B7E5FF44745FA04138C60D82A94EF3CE0B8CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1AF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF78EAE2DD1), ref: 00007FF78EB1AF37
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF78EAE2DD1), ref: 00007FF78EB1AF4F

Strings

GetSystemWow64DirectoryW, xrefs: 00007FF78EB1AF45
kernel32.dll, xrefs: 00007FF78EB1AF30

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction ID: f6265e39767cd92f989eec7ef88fe8e35890775866597e1e70be089908107daa
Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction Fuzzy Hash: 50F03071A06B0581EF08EF90E445778A7E4FB08B19FE40435C95D82364EF7CE958C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB16320 Relevance: 6.3, APIs: 4, Instructions: 255COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF78EB1635F
CoUninitialize.OLE32 ref: 00007FF78EB16369

Part of subcall function 00007FF78EAF4860: CoCreateInstance.OLE32 ref: 00007FF78EAF4931

Part of subcall function 00007FF78EB003E8: VariantInit.OLEAUT32 ref: 00007FF78EB00437
Part of subcall function 00007FF78EB003E8: VariantCopy.OLEAUT32 ref: 00007FF78EB00443
Part of subcall function 00007FF78EB003E8: VariantClear.OLEAUT32 ref: 00007FF78EB00450

VariantInit.OLEAUT32 ref: 00007FF78EB16373
VariantClear.OLEAUT32 ref: 00007FF78EB16690

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Variant$ClearInit$CopyCreateInitializeInstanceUninitialize
String ID:
API String ID: 2733932498-0
Opcode ID: 76cfe6a88e8d4c97ddc2bff8c99a0a5ec9652acf9fcd88a0bb64bf620c77a0d2
Instruction ID: 224eb4c98b05ad8943e0b1b9763d65946d265f7ed576f06b9f0fb000f572b8b4
Opcode Fuzzy Hash: 76cfe6a88e8d4c97ddc2bff8c99a0a5ec9652acf9fcd88a0bb64bf620c77a0d2
Instruction Fuzzy Hash: 46B17E26B04B5681EB10EFA6D490ABDAB65FB48FE4FA55032DE5D4779ACF38D440C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFC7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF78EAFC7CC
GetFileAttributesW.KERNEL32 ref: 00007FF78EAFC7E0
FindFirstFileW.KERNEL32 ref: 00007FF78EAFC7F3
FindClose.KERNEL32 ref: 00007FF78EAFC802

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction ID: 13a1902f6765b802d9cab497be38184909f22eb73a5cbd732e535ae28f7ee23a
Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction Fuzzy Hash: 67F05E20E0960291EA246BA5A809B38E6A0BF41B75FA44330D47F066E4DF7C9498C260

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA02C4 Relevance: 5.7, Strings: 2, Instructions: 3180COMMON

Download Yara Rule

Strings

DEFINE, xrefs: 00007FF78EAE4A98
x, xrefs: 00007FF78EAA0D61

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: DEFINE$x
API String ID: 0-4035502692
Opcode ID: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction ID: 7f7c8243673c31f6ad2012a93dbcbf2830064c0f3428dbca9fcaf9801dba9556
Opcode Fuzzy Hash: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction Fuzzy Hash: A853DF72B046528AE760EFA5C440ABC77A5FB44F88FA08036DE4D57B84EF39E941C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA93C20 Relevance: 5.3, APIs: 3, Instructions: 832COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF78EA94F51

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 22f4ddece5590f9ab5149614c05ac7f8aa226173c2915d24097b6f9bf072f8f2
Instruction ID: be866f01d7079fc16233db155a49e810ac83f2309163bc12fbc45a2d0a6d4f21
Opcode Fuzzy Hash: 22f4ddece5590f9ab5149614c05ac7f8aa226173c2915d24097b6f9bf072f8f2
Instruction Fuzzy Hash: 14829E36A18A5286EB50FF95E884A79B7A1FB44F84FB10035DA5E47794DF3CE840C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA0E90 Relevance: 4.9, Strings: 3, Instructions: 1176COMMON

Download Yara Rule

Strings

\, xrefs: 00007FF78EAA0F67
[, xrefs: 00007FF78EAA0F40
, xrefs: 00007FF78EAE6C9D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: $[$\
API String ID: 0-3681541464
Opcode ID: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction ID: ed13d08dec3f7fd76e0b696b10a4e283608ae982bc3657a66cf7cf0034755966
Opcode Fuzzy Hash: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
Instruction Fuzzy Hash: BEB28E72B047528AEB64DFA5C480ABCB7B1FB44B48FA14136DE0D57B88EB38E941C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB06428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF78EB06464
FindNextFileW.KERNEL32 ref: 00007FF78EB064B9
FindClose.KERNEL32 ref: 00007FF78EB064FB

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 68e3a9218ce893ff5da120e8ed9a0dd63e03a58202c13d19b4c87c3f6d3b5ac8
Instruction ID: 4dbe450b98d536ef6c18a814e286942d0157c6752413e3d1ce2efa2c0b4b7430
Opcode Fuzzy Hash: 68e3a9218ce893ff5da120e8ed9a0dd63e03a58202c13d19b4c87c3f6d3b5ac8
Instruction Fuzzy Hash: 83518E32608A4685DB14EFA5D480ABCBB60FB84F94FA04232CB6D43BA5CF7CE551C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFBF80 Relevance: 4.6, APIs: 3, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF78EAFBFB1
DeviceIoControl.KERNEL32 ref: 00007FF78EAFC01C
CloseHandle.KERNEL32 ref: 00007FF78EAFC027

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: ca0bd82f7ad00f84ec25768a9b54d2dc1663f901610658eb39350496b70fa362
Instruction ID: 86a37934ab95720472aba56513f955def48f08ec923d129218a375fa43bd5019
Opcode Fuzzy Hash: ca0bd82f7ad00f84ec25768a9b54d2dc1663f901610658eb39350496b70fa362
Instruction Fuzzy Hash: F9219D7361874087E3508F55E0847AAB7A0F384BA0F608236DB9D43B98DF3CC95ACB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAECDC4 Relevance: 4.5, APIs: 3, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,00007FF78EAEC6F0), ref: 00007FF78EAECDDF
HeapAlloc.KERNEL32(?,?,00000000,00007FF78EAEC6F0), ref: 00007FF78EAECDEE
InitializeAcl.ADVAPI32(?,?,00000000,00007FF78EAEC6F0), ref: 00007FF78EAECE05

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Heap$AllocInitializeProcess
String ID:
API String ID: 570334035-0
Opcode ID: c2212e710faa0aa25c6585764cd3283daba03b8e8a3efd7139333ad593dfd05c
Instruction ID: 5d0f9b1cc692ca0d24af94534d34393f5b7db28fd81eda44e9dd007d9709c251
Opcode Fuzzy Hash: c2212e710faa0aa25c6585764cd3283daba03b8e8a3efd7139333ad593dfd05c
Instruction Fuzzy Hash: D3F01D36A19B9282D724DB96B44541AB7A0FB88B90BA48534DF9943B14EF3CE954CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC2F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

., xrefs: 00007FF78EAC3198

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
Instruction ID: d500fa5c8561d3bb7c21b84e5cc1fdeb4ae557b54c7268ff56cea05695448974
Opcode Fuzzy Hash: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
Instruction Fuzzy Hash: 11314726B1869144EB20AFB29804A76E691FB94FF4FA48631EE6D07BC5DF3CD485C211

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC67F0 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF78EAC6A3D
RaiseException.KERNEL32 ref: 00007FF78EAC6A4E

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction ID: 9803800882ef7bb119c336701d7b07283ded698d26c1388563f198d60eaaadad
Opcode Fuzzy Hash: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction Fuzzy Hash: 0AB17C77604B848BEB15DF29C8457687BE0F784F58F688831DAAD837A4CB39D491C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAECCE0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32 ref: 00007FF78EAECD07
CloseHandle.KERNEL32 ref: 00007FF78EAECD1F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: f8c62455d5772da1dd4533a543d241db4b20cc33079523c2d2b39321df0bd38e
Instruction ID: e3709ae713fbc1e33e40ce347b3e2dbed8a50b92dead80989fdb04f1b817cd55
Opcode Fuzzy Hash: f8c62455d5772da1dd4533a543d241db4b20cc33079523c2d2b39321df0bd38e
Instruction Fuzzy Hash: 06F03076A18A4682EB54EBA1D4557B9A7A0FB98F98F740531CE0D07654CF3CD086C261

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAAC3FC Relevance: 2.7, Strings: 2, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0x%p, xrefs: 00007FF78EAAC40B
0, xrefs: 00007FF78EAAC5B3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0x%p
API String ID: 3215553584-2479247192
Opcode ID: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction ID: 338a5f37386bd745a45c802521cdd74954de73053081ad3fce6f4d44a32ea9a5
Opcode Fuzzy Hash: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction Fuzzy Hash: C581F621A183036AFAA4BAA78044E7DA3D0BF40F44FF41431ED0A97695DF3DE845D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA90E70 Relevance: 1.9, Strings: 1, Instructions: 680COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00007FF78EADBA13

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: c79eb93deea7b2ff9bc60bb1385e06ce3c34d4a98e53676fea2b35d62f8e7c4e
Instruction ID: c95e99f092092b56af1ce6e0177a0517c7d84e0bb205380a7f64b4ebc6cf0fe5
Opcode Fuzzy Hash: c79eb93deea7b2ff9bc60bb1385e06ce3c34d4a98e53676fea2b35d62f8e7c4e
Instruction Fuzzy Hash: 9E528E32B086429AEB50FFA0C444AFDA7A1FB15B88FA14035DE1D17B95DF38E545C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA9FA4F Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

no error, xrefs: 00007FF78EAE3953

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: no error
API String ID: 0-1106124726
Opcode ID: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction ID: d1af075fbabe8f933cd2d6399c6124ca64416787d09e1c8f53078dd1efc76280
Opcode Fuzzy Hash: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction Fuzzy Hash: 1912DE76A087528AE724EFA5D8409BDB7B0FB04B48FA08135EE4E57B94DF38E944C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB10A00 Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32 ref: 00007FF78EB10A26

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction ID: 3395f63e6ca0a8bb95a9356c1bc2876ab0affa0088da8f0a6a26c4c6b7c9853b
Opcode Fuzzy Hash: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
Instruction Fuzzy Hash: D9E0653271820286EB44ABA1E441A7EA6A0BB98F94F645034DA1D83385DF7CD890C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAE2BCF Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF78EAE2BE4

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction ID: 59230bce45f03186303110a1e499fd8e39ace4009fe7ecd65d8c701dca7cb381
Opcode Fuzzy Hash: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
Instruction Fuzzy Hash: C7C01271615A52D9E760EF60DC845EC3371F70071CFD00031E60A0E868DF789248C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAAC130 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF78EAAC2E7

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction ID: 27e1cae4e6c6c3b75a7d067d900f5ab37d3dbf0f5a1cfb8d4d83238e2fc7015a
Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction Fuzzy Hash: EC81F322A183026AFA64BAD78040D7EA391FF81F44FB41535DD0997695CF3DE84AD3E2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAABEB4 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF78EAAC04E

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction ID: 5bbbe6b572cde1767fc8ff88fdb80aaad16703c6b435dbad1d3e63f3091d2834
Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction Fuzzy Hash: 0471E621A0C3825AFA68AAA79040A7DE7D0BF41F44FB80535DD09976D5CF3DE845CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABA8A0 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 00007FF78EABA8DC

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction ID: 742370e1cf94b5822e97ec206ed2e0076a0d2e21a7c81c29309b8dd8ef74e24f
Opcode Fuzzy Hash: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction Fuzzy Hash: EF41C172714B4586EE04EFAAD4246A9B7A1BB8CFD0B99A036DE4D87754EF3CD446C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA8B9F0 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ad00f66ecbff5f633682f2b9edf12bf1647722772a5124462754c80745a45d
Instruction ID: c3dddcbb9c09887282222868747a840a1c9c7c83792d60127ea46f37cf6d0fa6
Opcode Fuzzy Hash: 79ad00f66ecbff5f633682f2b9edf12bf1647722772a5124462754c80745a45d
Instruction Fuzzy Hash: 4D42DE36B0879286EB10EBA5D480ABDBBA4FB84B98FB04131DE5D47B95DF38E441C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB30DC Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction ID: 3a80f826a373e42442e5b31eb0e41f8f48c2c742b1d97d0a4716e0ff9327d814
Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction Fuzzy Hash: A0428832D2DE4984E253AFB5A462D35AB64BF517C0FA18333D84E76A15DF7CA846C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC6DE4 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aef1645feaa1291f65bd50d9bda51e86790c3738af6c6eb1c9d6e81d2b8add60
Instruction ID: d0630ad52e9447df595217938042bbfc3d811ecfe826d8671128087e95c210a0
Opcode Fuzzy Hash: aef1645feaa1291f65bd50d9bda51e86790c3738af6c6eb1c9d6e81d2b8add60
Instruction Fuzzy Hash: DA71E922A0824246F764EAA9D440E39E2D5BFC4F70FB40635EA6D467D1DF7DE881C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB01A18 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction ID: e6fbe1171b32d838109c236c9b5a865dd8bb68df418b3fd7c0aa9916d805a1b5
Opcode Fuzzy Hash: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction Fuzzy Hash: A821CF32A2400187E70CDFB5D862EA977E5B360708F68C13AD52B83684CF3CE905C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABFD20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction ID: 8f95cf2e6b37f202f90d32761752c04a37a82dcf36487e96e8fb52bf25dde6bd
Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction Fuzzy Hash: 3FF04471B1C2559ADB949F6CA842A297F90F748384BA08039D59983E54DA3C9050DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA59C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction ID: d74df8e4da2c0f3eaf913972f7652055463b760894e44215fcf06873dccd8474
Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction Fuzzy Hash: 47A0023690FD02E4E614ABC1E851870AB71FB50710BF11433D00D45861DF3DB480C766

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2E95C Relevance: 49.7, APIs: 33, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF78EB2E9C4
SetTextColor.GDI32 ref: 00007FF78EB2E9CF
GetSysColorBrush.USER32 ref: 00007FF78EB2E9E8
GetSysColor.USER32 ref: 00007FF78EB2E9FA
SetBkColor.GDI32 ref: 00007FF78EB2EA1B
SelectObject.GDI32 ref: 00007FF78EB2EA2A
InflateRect.USER32 ref: 00007FF78EB2EA4F
GetSysColor.USER32 ref: 00007FF78EB2EA5A
CreateSolidBrush.GDI32 ref: 00007FF78EB2EA62
FrameRect.USER32 ref: 00007FF78EB2EA75
DeleteObject.GDI32 ref: 00007FF78EB2EA7E
InflateRect.USER32 ref: 00007FF78EB2EAD3
FillRect.USER32 ref: 00007FF78EB2EB03
GetWindowLongW.USER32 ref: 00007FF78EB2EB22
SendMessageW.USER32(?,?,?,?,?,00000000), ref: 00007FF78EB2EB6F

Part of subcall function 00007FF78EB2ECB4: GetSysColor.USER32 ref: 00007FF78EB2ECFB
Part of subcall function 00007FF78EB2ECB4: SetTextColor.GDI32 ref: 00007FF78EB2ED06
Part of subcall function 00007FF78EB2ECB4: GetSysColorBrush.USER32 ref: 00007FF78EB2ED21
Part of subcall function 00007FF78EB2ECB4: GetSysColor.USER32 ref: 00007FF78EB2ED34
Part of subcall function 00007FF78EB2ECB4: GetSysColor.USER32 ref: 00007FF78EB2ED5F
Part of subcall function 00007FF78EB2ECB4: CreatePen.GDI32 ref: 00007FF78EB2ED76
Part of subcall function 00007FF78EB2ECB4: SelectObject.GDI32 ref: 00007FF78EB2ED87
Part of subcall function 00007FF78EB2ECB4: SetBkColor.GDI32 ref: 00007FF78EB2ED97
Part of subcall function 00007FF78EB2ECB4: SelectObject.GDI32 ref: 00007FF78EB2EDAA
Part of subcall function 00007FF78EB2ECB4: InflateRect.USER32 ref: 00007FF78EB2EDD1
Part of subcall function 00007FF78EB2ECB4: RoundRect.GDI32 ref: 00007FF78EB2EDFD
Part of subcall function 00007FF78EB2ECB4: GetWindowLongW.USER32 ref: 00007FF78EB2EE0B

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 83951a0f5ab674c7ceda612414a489f98c53b7b77578a5fec0661329090dac0c
Instruction ID: 4879791bb1f6e12347fc8965d24b067a497b17b9e76b5e6ddff1a022d3e2d3fb
Opcode Fuzzy Hash: 83951a0f5ab674c7ceda612414a489f98c53b7b77578a5fec0661329090dac0c
Instruction Fuzzy Hash: 8CA1B772F05A4286EB14ABE2D84597C6BA1BF49B64FA04334DE2E53BD4DF3C9444C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB04F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF78EB04F61
GetDriveTypeW.KERNEL32 ref: 00007FF78EB050BE
SetErrorMode.KERNEL32 ref: 00007FF78EB052A3

Strings

USB, xrefs: 00007FF78EB051BA
PhysicalDrive, xrefs: 00007FF78EB04FF5
SATA, xrefs: 00007FF78EB0524C
\\.\, xrefs: 00007FF78EB04FAE
SSD, xrefs: 00007FF78EB0515D
Network, xrefs: 00007FF78EB05105
FileBackedVirtual, xrefs: 00007FF78EB05228
Fibre, xrefs: 00007FF78EB051C6
CDROM, xrefs: 00007FF78EB050F9
Virtual, xrefs: 00007FF78EB05231
ATAPI, xrefs: 00007FF78EB051F0
1394, xrefs: 00007FF78EB051DE
RAID, xrefs: 00007FF78EB05202
MMC, xrefs: 00007FF78EB0523A
SSA, xrefs: 00007FF78EB051D2
SAS, xrefs: 00007FF78EB05255
Unknown, xrefs: 00007FF78EB050E1
iSCSI, xrefs: 00007FF78EB0525E
RAMDisk, xrefs: 00007FF78EB050ED
Fixed, xrefs: 00007FF78EB05111
SCSI, xrefs: 00007FF78EB051F9
ATA, xrefs: 00007FF78EB051E7
Removable, xrefs: 00007FF78EB0511D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 95469adb000f55e80b35bf279774cb29b0463a79c734ed7031b91ee428a0fd32
Instruction ID: bd1c999138307bd3af48008b35f11f1b050562d7da00cb33bdbe9be39a37aa5a
Opcode Fuzzy Hash: 95469adb000f55e80b35bf279774cb29b0463a79c734ed7031b91ee428a0fd32
Instruction Fuzzy Hash: 1DB15C21B0EA4394EA64BBE5D840DBDAB61BF40B84BF45131D90E47A99EF3CF945C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2ECB4 Relevance: 39.2, APIs: 26, Instructions: 179windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 00007FF78EB2ECFB
SetTextColor.GDI32 ref: 00007FF78EB2ED06
GetSysColorBrush.USER32 ref: 00007FF78EB2ED21
GetSysColor.USER32 ref: 00007FF78EB2ED34
CreateSolidBrush.GDI32 ref: 00007FF78EB2ED3E
GetSysColor.USER32 ref: 00007FF78EB2ED5F
CreatePen.GDI32 ref: 00007FF78EB2ED76
SelectObject.GDI32 ref: 00007FF78EB2ED87
SetBkColor.GDI32 ref: 00007FF78EB2ED97
SelectObject.GDI32 ref: 00007FF78EB2EDAA
InflateRect.USER32 ref: 00007FF78EB2EDD1
RoundRect.GDI32 ref: 00007FF78EB2EDFD
GetWindowLongW.USER32 ref: 00007FF78EB2EE0B
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF78EB2E98C), ref: 00007FF78EB2EE58
GetWindowTextW.USER32 ref: 00007FF78EB2EE90
InflateRect.USER32 ref: 00007FF78EB2EEB3
DrawFocusRect.USER32 ref: 00007FF78EB2EEC1
GetSysColor.USER32 ref: 00007FF78EB2EED0
SetTextColor.GDI32 ref: 00007FF78EB2EEDB
DrawTextW.USER32 ref: 00007FF78EB2EEF9
SelectObject.GDI32 ref: 00007FF78EB2EF17
DeleteObject.GDI32 ref: 00007FF78EB2EF25
SelectObject.GDI32 ref: 00007FF78EB2EF33
DeleteObject.GDI32 ref: 00007FF78EB2EF3E
SetTextColor.GDI32 ref: 00007FF78EB2EF4A
SetBkColor.GDI32 ref: 00007FF78EB2EF5A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: af2003aee250e54b852e397d0315c9d0f6196c66345de4a516034d00de27f57a
Instruction ID: d07cbe4f9dd196dab670d4552eb6c1a5c0696e995a1374d50f7121b5e9e2b8ab
Opcode Fuzzy Hash: af2003aee250e54b852e397d0315c9d0f6196c66345de4a516034d00de27f57a
Instruction Fuzzy Hash: AC71C736A09A8187E764EB91E845A7AB7A1FB88BA0F604334DD5E43B94DF3CD444C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB26EA0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 268windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF78EB26FE4
GetDesktopWindow.USER32 ref: 00007FF78EB26FF4
GetWindowRect.USER32 ref: 00007FF78EB27002
GetWindowLongW.USER32 ref: 00007FF78EB2705E
DestroyWindow.USER32 ref: 00007FF78EB2707C
CreateWindowExW.USER32 ref: 00007FF78EB270D3
SendMessageW.USER32 ref: 00007FF78EB270EF
SendMessageW.USER32 ref: 00007FF78EB27108
SendMessageW.USER32 ref: 00007FF78EB27123
SendMessageW.USER32 ref: 00007FF78EB27140
IsWindowVisible.USER32 ref: 00007FF78EB27192
SendMessageW.USER32 ref: 00007FF78EB271B6
SendMessageW.USER32 ref: 00007FF78EB271D1
GetWindowRect.USER32 ref: 00007FF78EB271EC
MonitorFromPoint.USER32 ref: 00007FF78EB27210
GetMonitorInfoW.USER32 ref: 00007FF78EB27224
CopyRect.USER32 ref: 00007FF78EB27237
SendMessageW.USER32 ref: 00007FF78EB2729C

Strings

tooltips_class32, xrefs: 00007FF78EB27095

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: tooltips_class32
API String ID: 698492251-1918224756
Opcode ID: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
Instruction ID: 33d48588234c51a2338b2df23969baa0cb2692b3f78612b8a3e42eb9ae4a15b9
Opcode Fuzzy Hash: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
Instruction Fuzzy Hash: 51C15432A087968AEB14DFA5E4446AEBBA1FF88B45FA00035DA5D47B54CF3CE845C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF2C10 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 175windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00007FF78EAF2C3E
SendMessageW.USER32 ref: 00007FF78EAF2C56
SetWindowTextW.USER32 ref: 00007FF78EAF2C6F
GetDlgItem.USER32 ref: 00007FF78EAF2C87
SetWindowTextW.USER32 ref: 00007FF78EAF2C94
GetDlgItem.USER32 ref: 00007FF78EAF2CAE
SetWindowTextW.USER32 ref: 00007FF78EAF2CBB
SendDlgItemMessageW.USER32 ref: 00007FF78EAF2CE0
SendDlgItemMessageW.USER32 ref: 00007FF78EAF2D03
GetWindowRect.USER32 ref: 00007FF78EAF2D14
SetWindowTextW.USER32 ref: 00007FF78EAF2DB5
GetDesktopWindow.USER32 ref: 00007FF78EAF2DBB
GetWindowRect.USER32 ref: 00007FF78EAF2DC8
MoveWindow.USER32 ref: 00007FF78EAF2E20
GetClientRect.USER32 ref: 00007FF78EAF2E31
PostMessageW.USER32 ref: 00007FF78EAF2E60
SetTimer.USER32 ref: 00007FF78EAF2E91

Strings

@, xrefs: 00007FF78EAF2DD7

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @
API String ID: 3869813825-2766056989
Opcode ID: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction ID: e11d69da1dd13e288a95146af3e3ebb2446ebb6a0e0487bd048e841ee778b9dd
Opcode Fuzzy Hash: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
Instruction Fuzzy Hash: EE818132A05A4286E740EFB5E854A7D77A0FB44F88FA44532DE4DA7B98DF38D845C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA82620 Relevance: 28.7, APIs: 19, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82750: GetWindowLongPtrW.USER32 ref: 00007FF78EA82766

GetSysColor.USER32 ref: 00007FF78EA82663
GetSysColor.USER32 ref: 00007FF78EA826F8
SetTextColor.GDI32 ref: 00007FF78EA82703
SetBkMode.GDI32 ref: 00007FF78EA82718
GetStockObject.GDI32 ref: 00007FF78EA82723
GetSysColor.USER32 ref: 00007FF78EACA84E
GetWindowLongW.USER32 ref: 00007FF78EACA863
SetBkColor.GDI32 ref: 00007FF78EACA940

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Color$LongWindow$ModeObjectStockText
String ID:
API String ID: 554392163-0
Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction ID: 82832ceb180f17a018006b8cafd663a4fc79815cd52f7bc682ca930916d6ca59
Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction Fuzzy Hash: CC81E631D0856682EA30A7A99848A79A791FF45F65FF50231C99E037E4DF3CE882C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFC81C Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF78EAFC841
GetFileVersionInfoW.VERSION ref: 00007FF78EAFC869
wcscpy.LIBCMT ref: 00007FF78EAFC8A6
wcscat.LIBCMT ref: 00007FF78EAFC8C8
wcsstr.LIBVCRUNTIME ref: 00007FF78EAFC8D3
VerQueryValueW.VERSION ref: 00007FF78EAFC8F4
wcscat.LIBCMT ref: 00007FF78EAFC934
wcscat.LIBCMT ref: 00007FF78EAFC93F
wcscat.LIBCMT ref: 00007FF78EAFC94A
VerQueryValueW.VERSION ref: 00007FF78EAFC9A0

Strings

StringFileInfo\, xrefs: 00007FF78EAFC8BE
DefaultLangCodepage, xrefs: 00007FF78EAFC94F
04090000, xrefs: 00007FF78EAFC92A
\VarFileInfo\Translation, xrefs: 00007FF78EAFC8ED
%u.%u.%u.%u, xrefs: 00007FF78EAFC9BE

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: wcscat$FileInfoQueryValueVersion$Sizewcscpywcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 222038402-1459072770
Opcode ID: 2d5e5e3e76826f94c3f6d4a5c1a7de8f40f2fa6e444124fee147eef73f68b5d3
Instruction ID: 94d60e0ac33189c616e896da819d2574b1bfbfa708985b3944d2f21391769692
Opcode Fuzzy Hash: 2d5e5e3e76826f94c3f6d4a5c1a7de8f40f2fa6e444124fee147eef73f68b5d3
Instruction Fuzzy Hash: 4551C021B0874292EA14FBA3A4419B9A791BF85FD0FE08432ED4D47B96DF3CE501C766

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB26608 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 475windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF78EB266C7
SendMessageW.USER32 ref: 00007FF78EB26749

Strings

UNCHECK, xrefs: 00007FF78EB26B76
GETSELECTED, xrefs: 00007FF78EB2698F
GETITEMCOUNT, xrefs: 00007FF78EB26922
EXISTS, xrefs: 00007FF78EB26833
COLLAPSE, xrefs: 00007FF78EB267D1
CHECK, xrefs: 00007FF78EB2676F
GETTOTALCOUNT, xrefs: 00007FF78EB266F9
GETTEXT, xrefs: 00007FF78EB269F7
EXPAND, xrefs: 00007FF78EB268B4
SELECT, xrefs: 00007FF78EB26B0B
ISCHECKED, xrefs: 00007FF78EB26A78

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: f7eb3b82bd33efc39cdfbe657952fc67dbcbb2fb0c02c8aa3a7f3dc4219201ec
Instruction ID: a79fe4a1aa9ff139f285a747cc65f71edd409642fbc255898b1ec17bf19ad593
Opcode Fuzzy Hash: f7eb3b82bd33efc39cdfbe657952fc67dbcbb2fb0c02c8aa3a7f3dc4219201ec
Instruction Fuzzy Hash: E312E313B1869382EE54BBA588059BDEBA0BF54F85BE44531DE1E47799EF3DE801C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB03FD0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 197COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF78EB04077
GetDriveTypeW.KERNEL32 ref: 00007FF78EB04162
mciSendStringW.WINMM ref: 00007FF78EB041AA
mciSendStringW.WINMM ref: 00007FF78EB041F1
mciSendStringW.WINMM ref: 00007FF78EB04229

Strings

closed, xrefs: 00007FF78EB0408C
close, xrefs: 00007FF78EB0407D
set cd door , xrefs: 00007FF78EB041B8
open , xrefs: 00007FF78EB04171
close cd wait, xrefs: 00007FF78EB0420D
open, xrefs: 00007FF78EB040DC
wait, xrefs: 00007FF78EB041D5
type cdaudio alias cd wait, xrefs: 00007FF78EB0418E

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1600147383-4113822522
Opcode ID: f252e619c40fa0aff5f0b1f1e37f3765b913bf4df1bc6161e1addbf501e4a31a
Instruction ID: 877a8eeda54cdad7b68f343a8940cc512d32af935552d8a2bcfc0902b2a34004
Opcode Fuzzy Hash: f252e619c40fa0aff5f0b1f1e37f3765b913bf4df1bc6161e1addbf501e4a31a
Instruction Fuzzy Hash: 5F81C232B14A52C5EB00ABA5D851ABDB7B1FB54B98FA04431CE4D97B94EF3CE945C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB30118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF78EB30201
LoadLibraryExW.KERNEL32 ref: 00007FF78EB3026C
LoadImageW.USER32 ref: 00007FF78EB302B0
LoadImageW.USER32 ref: 00007FF78EB302EB
LoadImageW.USER32 ref: 00007FF78EB3032F
FreeLibrary.KERNEL32 ref: 00007FF78EB3033C
ExtractIconExW.SHELL32 ref: 00007FF78EB3034E
DestroyIcon.USER32 ref: 00007FF78EB30360
SendMessageW.USER32 ref: 00007FF78EB3037F
SendMessageW.USER32 ref: 00007FF78EB30397

Part of subcall function 00007FF78EAA8E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAA8E4F

Part of subcall function 00007FF78EAA8E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAA8EED

Strings

.dll, xrefs: 00007FF78EB301B5
.exe, xrefs: 00007FF78EB30193
.icl, xrefs: 00007FF78EB30171

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 258715311-1154884017
Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction ID: 5387f243ed2fd6f310b819aaff85605985b5d9a5728daaf6117d2656673e4981
Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction Fuzzy Hash: BD71B332A05B5282EB64AFA29445EB9A7E0FF49F98F940635ED1D47B94DF3CD444C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB303D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF78EB30422
GetFileSize.KERNEL32 ref: 00007FF78EB30436
GlobalAlloc.KERNEL32 ref: 00007FF78EB30445
CloseHandle.KERNEL32 ref: 00007FF78EB30456
GlobalLock.KERNEL32 ref: 00007FF78EB30466
ReadFile.KERNEL32 ref: 00007FF78EB3047E
GlobalUnlock.KERNEL32 ref: 00007FF78EB30489
CloseHandle.KERNEL32 ref: 00007FF78EB30492
CreateStreamOnHGlobal.OLE32 ref: 00007FF78EB304A8
OleLoadPicture.OLEAUT32 ref: 00007FF78EB304CB
GlobalFree.KERNEL32 ref: 00007FF78EB304DE
GetObjectW.GDI32 ref: 00007FF78EB30508
CopyImage.USER32 ref: 00007FF78EB30541
DeleteObject.GDI32 ref: 00007FF78EB3056E
SendMessageW.USER32 ref: 00007FF78EB3058D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction ID: 638867fc6ac08277774ea1af4fef5cf773bb8c7fba67f4adceb3426f21841498
Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction Fuzzy Hash: 1B517836B15B4186EB14EFA6E849E6D77A0FB88B94BA14231DE5E03B14DF3DD805C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB00D70 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 388COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF78EB0102D
VariantClear.OLEAUT32 ref: 00007FF78EB0111F

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00007FF78EB00F10
Default, xrefs: 00007FF78EB00E89

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Variant$ClearInit
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 2610073882-3931177956
Opcode ID: 3a4deae4be3d28b748e7cdb3881e49b2f52cd22b671274b5b57ee26e9b6474c9
Instruction ID: fbf490577af70edd26c7e5ad6c0b936e817ce687396cc88be1bc1619651e4028
Opcode Fuzzy Hash: 3a4deae4be3d28b748e7cdb3881e49b2f52cd22b671274b5b57ee26e9b6474c9
Instruction Fuzzy Hash: A1028932A09642C6EB5DBBA5C154D7DBBA1FB05B80FA98535DA0E07A94DF3CF950C220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF78EB02590
wcscat.LIBCMT ref: 00007FF78EB025A3
wcscat.LIBCMT ref: 00007FF78EB025E1
wcscat.LIBCMT ref: 00007FF78EB025F4

Part of subcall function 00007FF78EA867D8: _fread_nolock.LIBCMT ref: 00007FF78EA86805

GetTempPathW.KERNEL32 ref: 00007FF78EB0271B
GetTempFileNameW.KERNEL32 ref: 00007FF78EB02737

Part of subcall function 00007FF78EAB48E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB4835

DeleteFileW.KERNEL32 ref: 00007FF78EB02854
DeleteFileW.KERNEL32 ref: 00007FF78EB028BB

Strings

aut, xrefs: 00007FF78EB02729

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
String ID: aut
API String ID: 130057722-3010740371
Opcode ID: bdbe7f6e9be2466084ded0a7f968f31c408d930c5ced813d0871173edae7c5aa
Instruction ID: e1f7f87c4318200c3962646f22bfa128deae86813807b95b3e2ba441258646e2
Opcode Fuzzy Hash: bdbe7f6e9be2466084ded0a7f968f31c408d930c5ced813d0871173edae7c5aa
Instruction Fuzzy Hash: 51C189326146C695EB30EFA5E8409F9A754FB84B88F904036EB8D47B59DF3CE609C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2E40C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF78EB2E510
CreateWindowExW.USER32 ref: 00007FF78EB2E5BC
SendMessageW.USER32 ref: 00007FF78EB2E5E3
SendMessageW.USER32 ref: 00007FF78EB2E5F8
DestroyWindow.USER32 ref: 00007FF78EB2E61C
CreateWindowExW.USER32 ref: 00007FF78EB2E675
SendMessageW.USER32 ref: 00007FF78EB2E692
GetDesktopWindow.USER32 ref: 00007FF78EB2E6AE
GetWindowRect.USER32 ref: 00007FF78EB2E6BB
SendMessageW.USER32 ref: 00007FF78EB2E6D0
SendMessageW.USER32 ref: 00007FF78EB2E6EE

Strings

tooltips_class32, xrefs: 00007FF78EB2E570, 00007FF78EB2E63F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopRect
String ID: tooltips_class32
API String ID: 2443926738-1918224756
Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction ID: 7034c25f15046b95288628199feb7276913196bbd88785035cbcca5059004c95
Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction Fuzzy Hash: AF91AC32A19B8586EB51DFA5E440BADBBA1FB88B84FA04036DE4D47B58DF3CD045C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB14F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF78EB14FDF
CreateCompatibleBitmap.GDI32 ref: 00007FF78EB14FF3
CreateCompatibleDC.GDI32 ref: 00007FF78EB15001
SelectObject.GDI32 ref: 00007FF78EB15011
StretchBlt.GDI32 ref: 00007FF78EB15087
GetDIBits.GDI32 ref: 00007FF78EB150CE
GetDIBits.GDI32 ref: 00007FF78EB15107
SelectObject.GDI32 ref: 00007FF78EB15116
DeleteObject.GDI32 ref: 00007FF78EB1511F
DeleteDC.GDI32 ref: 00007FF78EB15128
ReleaseDC.USER32 ref: 00007FF78EB15133

Strings

, xrefs: 00007FF78EB15053

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID:
API String ID: 2598888154-3916222277
Opcode ID: 0687041585a76cffa9d893ce7bd17f4e87b15e62bb487ba43aaf867343990d1c
Instruction ID: 8dedda7dd791467558c8cb16e6372646088fed66173408dd63d6cbcdbe476ded
Opcode Fuzzy Hash: 0687041585a76cffa9d893ce7bd17f4e87b15e62bb487ba43aaf867343990d1c
Instruction Fuzzy Hash: DF516336B15641CBE750DFA5E844AAEBBE1F748B98B508139EE4A53B18CF38E415CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEB0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32 ref: 00007FF78EAEB101
SafeArrayAllocData.OLEAUT32 ref: 00007FF78EAEB163
VariantInit.OLEAUT32 ref: 00007FF78EAEB175
SafeArrayAccessData.OLEAUT32 ref: 00007FF78EAEB198
VariantCopy.OLEAUT32 ref: 00007FF78EAEB203
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF78EAEB217
VariantClear.OLEAUT32 ref: 00007FF78EAEB22E
SafeArrayDestroyData.OLEAUT32 ref: 00007FF78EAEB23D
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF78EAEB247
VariantClear.OLEAUT32 ref: 00007FF78EAEB25A
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF78EAEB266

Strings

NULL Pointer assignment, xrefs: 00007FF78EAEB0D3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID: NULL Pointer assignment
API String ID: 2706829360-2785691316
Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction ID: 5de04c0abcc01589b22cc0b491e4314f49db4a6362e70ac6eb2466ef0fda3c49
Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction Fuzzy Hash: 22513132B15A128AEB50EFA5D895ABCB770FB84F88F914431DA0E47A69DF38D445C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB21110 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 371COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF78EB1FD7B), ref: 00007FF78EB21143

Strings

HKCR, xrefs: 00007FF78EB21369
HKEY_LOCAL_MACHINE, xrefs: 00007FF78EB21285
HKEY_USERS, xrefs: 00007FF78EB21505
HKCC, xrefs: 00007FF78EB2140E
HKEY_CURRENT_USER, xrefs: 00007FF78EB2146B
HKCU, xrefs: 00007FF78EB214A8
HKEY_CLASSES_ROOT, xrefs: 00007FF78EB2132C
HKEY_CURRENT_CONFIG, xrefs: 00007FF78EB213D1
HKLM, xrefs: 00007FF78EB212C2
HKU, xrefs: 00007FF78EB21542

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: e7e63e4dd25da427c1142b0bbb9523a4c6b780727a3c5ada72161eb03b32f57b
Instruction ID: c9ee798f28ab7c0da0e2b4ae67f59709ce9bda400681b40c63bbd6cf101b1557
Opcode Fuzzy Hash: e7e63e4dd25da427c1142b0bbb9523a4c6b780727a3c5ada72161eb03b32f57b
Instruction Fuzzy Hash: CBE1C312F086D781EA60AFE5D840AB9A7A1BF10B98FE48531D91E577D4EF3CE945C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB087CC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

wcscat.LIBCMT ref: 00007FF78EB0898D
wcscat.LIBCMT ref: 00007FF78EB0899E
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB089AF
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB089BC
GetFileAttributesW.KERNEL32 ref: 00007FF78EB089ED
SetFileAttributesW.KERNEL32 ref: 00007FF78EB08A03
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB08A14
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB08A76
wcscpy.LIBCMT ref: 00007FF78EB08A88
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EB08AC5

Strings

*.*, xrefs: 00007FF78EB08A7C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
String ID: *.*
API String ID: 4125642244-438819550
Opcode ID: 1ea90ef3ac2d7d254d472ba41b7dd042367ce3fbfdec11002f51064aa4e1dc95
Instruction ID: 4e897b72276e6de8f640c7ae04280e094dd6323f4a75da5ed2c24811cdc78392
Opcode Fuzzy Hash: 1ea90ef3ac2d7d254d472ba41b7dd042367ce3fbfdec11002f51064aa4e1dc95
Instruction Fuzzy Hash: 51818032618A8286EB50EF95D840EBDB7A0FB44B84FE44036DA4E47B95DF7CE644C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFA40C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF78EAFA4B8
SetMenuItemInfoW.USER32 ref: 00007FF78EAFA4F0
Sleep.KERNEL32 ref: 00007FF78EAFA503
GetMenuItemCount.USER32 ref: 00007FF78EAFA549
GetMenuItemID.USER32 ref: 00007FF78EAFA566
GetMenuItemID.USER32 ref: 00007FF78EAFA58D
GetMenuItemID.USER32 ref: 00007FF78EAFA5CB
CheckMenuRadioItem.USER32 ref: 00007FF78EAFA610
GetMenuItemInfoW.USER32 ref: 00007FF78EAFA62B
SetMenuItemInfoW.USER32 ref: 00007FF78EAFA650

Strings

P, xrefs: 00007FF78EAFA432

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: P
API String ID: 1460738036-3110715001
Opcode ID: 09c43fc9986b4157130dcd1dffd3aa1f9b08a6e3a366ab44e0db326a1696cd75
Instruction ID: 9bb1e6eee3ae42929747fd2e80f9ab4e2a387c6ecc433dc162ef4d890167c466
Opcode Fuzzy Hash: 09c43fc9986b4157130dcd1dffd3aa1f9b08a6e3a366ab44e0db326a1696cd75
Instruction Fuzzy Hash: 6271F732A0864246F760FFA49444AFDA7A1BB44F49FB48432DE4E07A85CF7CE44AC721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF2F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF78EAF2FB1
GetWindowRect.USER32 ref: 00007FF78EAF2FCD
MoveWindow.USER32 ref: 00007FF78EAF3048
GetDlgItem.USER32 ref: 00007FF78EAF3063
GetWindowRect.USER32 ref: 00007FF78EAF3078
MoveWindow.USER32 ref: 00007FF78EAF30E2
GetDlgItem.USER32 ref: 00007FF78EAF30F4
GetWindowRect.USER32 ref: 00007FF78EAF3109
MoveWindow.USER32 ref: 00007FF78EAF315B
GetDlgItem.USER32 ref: 00007FF78EAF3173
MoveWindow.USER32 ref: 00007FF78EAF3198
InvalidateRect.USER32 ref: 00007FF78EAF31AB

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction ID: 228265bd91b3e456b7338f142cf6073b70a2e84c2b0f56c6bf3a6b205eb53722
Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction Fuzzy Hash: 0F618372B156418BE714DFAAE444A6DB7E2B788B84F60813ADE0993F58DF3CD905CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF7E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF78EAF7F01
SetKeyboardState.USER32 ref: 00007FF78EAF7F58
GetAsyncKeyState.USER32 ref: 00007FF78EAF7F7E
GetKeyState.USER32 ref: 00007FF78EAF7F93
GetAsyncKeyState.USER32 ref: 00007FF78EAF7FC2
GetKeyState.USER32 ref: 00007FF78EAF7FD2
GetAsyncKeyState.USER32 ref: 00007FF78EAF8001
GetKeyState.USER32 ref: 00007FF78EAF8011
GetAsyncKeyState.USER32 ref: 00007FF78EAF8040
GetKeyState.USER32 ref: 00007FF78EAF8050
GetAsyncKeyState.USER32 ref: 00007FF78EAF807F
GetKeyState.USER32 ref: 00007FF78EAF808F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c617befc0bd1dbd4d54129b7722c2ebd01a7f232fb97f78571421a33ec3567e4
Instruction ID: 052484c63df6ff391bf11ed12e13c95dcc65ddc54ee44cede27998ce0a0a9ac9
Opcode Fuzzy Hash: c617befc0bd1dbd4d54129b7722c2ebd01a7f232fb97f78571421a33ec3567e4
Instruction Fuzzy Hash: FB71B622A1C6C155FB35ABA4D010AB9ABA1FB45F88FF9003AD68D03691CF7DD945C732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB04708 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF78EB04795
GetDriveTypeW.KERNEL32 ref: 00007FF78EB04A03
wcscpy.LIBCMT ref: 00007FF78EB04AA7

Strings

cdrom, xrefs: 00007FF78EB047F7
all, xrefs: 00007FF78EB047A0
unknown, xrefs: 00007FF78EB0498F
fixed, xrefs: 00007FF78EB04890
removable, xrefs: 00007FF78EB0484A
network, xrefs: 00007FF78EB048EC
ramdisk, xrefs: 00007FF78EB0493F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: BuffCharDriveLowerTypewcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 1561581874-1000479233
Opcode ID: aa9232cdcb08be56f6ec1ea37b61e18ec474b2dff0b6b2e38bdc824ec9ac4fd9
Instruction ID: 7f3fc45da23c7235b2aff9f8182657770bf92beb67f94854f1e3986d629d728a
Opcode Fuzzy Hash: aa9232cdcb08be56f6ec1ea37b61e18ec474b2dff0b6b2e38bdc824ec9ac4fd9
Instruction Fuzzy Hash: FCD1C132E0869681EA20BB95D540D7AEBA1FF94BE4FA04231DA5D53B94DF3CF945C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEFF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF78EAEFFAC
SendMessageTimeoutW.USER32 ref: 00007FF78EAF00C8
GetClassNameW.USER32 ref: 00007FF78EAF013C
GetDlgCtrlID.USER32 ref: 00007FF78EAF0193
GetWindowRect.USER32 ref: 00007FF78EAF01B9
GetParent.USER32 ref: 00007FF78EAF01D6
ScreenToClient.USER32 ref: 00007FF78EAF01E6
GetClassNameW.USER32 ref: 00007FF78EAF0281
GetWindowTextW.USER32 ref: 00007FF78EAF02C1

Strings

%s%u, xrefs: 00007FF78EAF0044

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
String ID: %s%u
API String ID: 1412819556-679674701
Opcode ID: f9492e365b3c9b1664e5547271ff71d1b3654b4394d6c6a0ded6dd80ebcdab63
Instruction ID: 498af5c60384b8774cccab939256815c19e11a15a8e9c26bbc75cb954b32f3b9
Opcode Fuzzy Hash: f9492e365b3c9b1664e5547271ff71d1b3654b4394d6c6a0ded6dd80ebcdab63
Instruction Fuzzy Hash: 30B1E072B0868696EB18EB65D884EF9B7A0FB45F84FE00032CA1D47785DF39E555C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEC034 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR ref: 00007FF78EAEC143
RegConnectRegistryW.ADVAPI32 ref: 00007FF78EAEC164
RegOpenKeyExW.ADVAPI32 ref: 00007FF78EAEC193
RegQueryValueExW.ADVAPI32 ref: 00007FF78EAEC1CD
CLSIDFromString.OLE32 ref: 00007FF78EAEC1F4
RegCloseKey.ADVAPI32 ref: 00007FF78EAEC203
RegCloseKey.ADVAPI32 ref: 00007FF78EAEC20E

Strings

\IPC$, xrefs: 00007FF78EAEC118
SOFTWARE\Classes\, xrefs: 00007FF78EAEC088
\CLSID, xrefs: 00007FF78EAEC0A6

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 3030280669-22481851
Opcode ID: 90b4c898eb35061ed4b9b6613609b6b05beff67f0cc0e7091b8895ca5ea8a7fb
Instruction ID: 3d403a5266356b2aa91f7629e1d31c00e5f1e38fe8c961b2969a6faccdbf0b87
Opcode Fuzzy Hash: 90b4c898eb35061ed4b9b6613609b6b05beff67f0cc0e7091b8895ca5ea8a7fb
Instruction Fuzzy Hash: 6A519532A18A9395EB50EBA5E890AFDA7A0FB84794F900031EE4D47A79DF3CD585C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2AD1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA8932C: CreateWindowExW.USER32 ref: 00007FF78EA893BC
Part of subcall function 00007FF78EA8932C: GetStockObject.GDI32 ref: 00007FF78EA893D9
Part of subcall function 00007FF78EA8932C: SendMessageW.USER32 ref: 00007FF78EA893EC

MoveWindow.USER32 ref: 00007FF78EB2AE48
CreateCompatibleDC.GDI32 ref: 00007FF78EB2AE50
SendMessageW.USER32 ref: 00007FF78EB2AE67
SelectObject.GDI32 ref: 00007FF78EB2AE73
GetPixel.GDI32 ref: 00007FF78EB2AE81
DeleteDC.GDI32 ref: 00007FF78EB2AE8C
GetWindowLongW.USER32 ref: 00007FF78EB2AE9A
SetLayeredWindowAttributes.USER32 ref: 00007FF78EB2AEB4
DestroyWindow.USER32 ref: 00007FF78EB2AEBE

Strings

static, xrefs: 00007FF78EB2AD5D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
String ID: static
API String ID: 3821898125-2160076837
Opcode ID: 07e3f444be573a5f56ad52c65b5350ec7a57582bf5bde69e8b4e79c46b6fcd17
Instruction ID: c2ad0429fc95ea2faee7e7b06464d9ed2cd1394f881db3ebbcb002c4e060c23b
Opcode Fuzzy Hash: 07e3f444be573a5f56ad52c65b5350ec7a57582bf5bde69e8b4e79c46b6fcd17
Instruction Fuzzy Hash: 3C418D3260978187EB70AFA5E845B5AB7A1FB88790FA04235DA9D43B98CF3CD445CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB03E20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF78EB03E61
CreateDirectoryW.KERNEL32 ref: 00007FF78EB03EB2
CreateFileW.KERNEL32 ref: 00007FF78EB03EE4
RemoveDirectoryW.KERNEL32 ref: 00007FF78EB03EF6
DeviceIoControl.KERNEL32 ref: 00007FF78EB03FA5
CloseHandle.KERNEL32 ref: 00007FF78EB03FB2
CloseHandle.KERNEL32 ref: 00007FF78EB03FBD

Strings

\, xrefs: 00007FF78EB03E97
:, xrefs: 00007FF78EB03E9F
\??\%s, xrefs: 00007FF78EB03E79

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
String ID: :$\$\??\%s
API String ID: 3827137101-3457252023
Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction ID: 54229878df45cfc16fa4c71a9cdd992cc1b7c0d38055da5e72b058b14f30d050
Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction Fuzzy Hash: 4941B62161868385E720AF61E804AFDA7A0FF95B98FA40135DA4D47FA8DF7CD546C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEC5FC Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAECD34: GetUserObjectSecurity.USER32 ref: 00007FF78EAECD65
Part of subcall function 00007FF78EAECD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF78EAEC65A), ref: 00007FF78EAECD71
Part of subcall function 00007FF78EAECD34: GetUserObjectSecurity.USER32 ref: 00007FF78EAECD9C

Part of subcall function 00007FF78EAECE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF78EAEC66F), ref: 00007FF78EAECE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF78EAEC68B
GetAclInformation.ADVAPI32 ref: 00007FF78EAEC6C5
GetLengthSid.ADVAPI32 ref: 00007FF78EAEC6D6
GetAce.ADVAPI32 ref: 00007FF78EAEC714
AddAce.ADVAPI32 ref: 00007FF78EAEC73B
GetLengthSid.ADVAPI32 ref: 00007FF78EAEC753
GetLengthSid.ADVAPI32 ref: 00007FF78EAEC776
CopySid.ADVAPI32 ref: 00007FF78EAEC785
AddAce.ADVAPI32 ref: 00007FF78EAEC7CB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF78EAEC7EE
SetUserObjectSecurity.USER32 ref: 00007FF78EAEC803

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction ID: 8567619532f62865952441f07b535b7fd8f5b5825059dfbe31657a08c683765f
Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction Fuzzy Hash: 40618F32B0469296EB10EFA1D8459BC7BE4FB44F88BA48035DE1D53B94DF39D545C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF7BA0 Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF78EAF7BD0
GetAsyncKeyState.USER32 ref: 00007FF78EAF7C3F
GetKeyState.USER32 ref: 00007FF78EAF7C54
GetAsyncKeyState.USER32 ref: 00007FF78EAF7C6D
GetKeyState.USER32 ref: 00007FF78EAF7C7D
GetAsyncKeyState.USER32 ref: 00007FF78EAF7C97
GetKeyState.USER32 ref: 00007FF78EAF7CA7
GetAsyncKeyState.USER32 ref: 00007FF78EAF7CC1
GetKeyState.USER32 ref: 00007FF78EAF7CD1
GetAsyncKeyState.USER32 ref: 00007FF78EAF7CEB
GetKeyState.USER32 ref: 00007FF78EAF7CFB

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction ID: f1cba224f0e1f4729ddb271bd35aeabe27f5dbc96d23effdc0671b62b8b48b61
Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction Fuzzy Hash: 7B417E21E1CAC555FB71ABA4D401B79AE90BB11B44FE8413AEA8A035C1CF7DA895C372

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA8E774 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA86838: CreateFileW.KERNEL32 ref: 00007FF78EA868A2

Part of subcall function 00007FF78EAA4380: GetCurrentDirectoryW.KERNEL32(?,00007FF78EA8E817), ref: 00007FF78EAA439C

Part of subcall function 00007FF78EA856D4: GetFullPathNameW.KERNEL32(?,00007FF78EA856C1,?,00007FF78EA87A0C,?,?,?,00007FF78EA8109E), ref: 00007FF78EA856FF

SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EA8E8B0
SetCurrentDirectoryW.KERNEL32 ref: 00007FF78EA8E9FA

Part of subcall function 00007FF78EA89F10: wcscpy.LIBCMT ref: 00007FF78EA89F61

Strings

Unterminated string, xrefs: 00007FF78EADA483
Bad directive syntax error, xrefs: 00007FF78EADA3FB
EA06, xrefs: 00007FF78EADA0BB
>>>AUTOIT SCRIPT<<<, xrefs: 00007FF78EADA109
Error opening the file, xrefs: 00007FF78EADA09B, 00007FF78EADA428
AU3!, xrefs: 00007FF78EA8E85F
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00007FF78EADA07A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2207129308-1018226102
Opcode ID: d4f4e905929ff731fc64366d578c9f4c84fceb5eabe737004fb488fe7275a5ec
Instruction ID: 0335d13f6bf167972957df9af412ba1f3da3796187a1a72f6b6a4858cab35547
Opcode Fuzzy Hash: d4f4e905929ff731fc64366d578c9f4c84fceb5eabe737004fb488fe7275a5ec
Instruction Fuzzy Hash: ED12D532A1865286EB10FBA1D4449FEE760FB85F84FE04132EA4E47699DF7CD505C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB166B4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF78EB16717
CoUninitialize.OLE32 ref: 00007FF78EB16721
CoCreateInstance.OLE32 ref: 00007FF78EB16791
IIDFromString.OLE32 ref: 00007FF78EB16810
VariantInit.OLEAUT32 ref: 00007FF78EB168AF
VariantClear.OLEAUT32 ref: 00007FF78EB16900

Strings

Failed to create object, xrefs: 00007FF78EB1679B
NULL Pointer assignment, xrefs: 00007FF78EB167DE
Invalid parameter, xrefs: 00007FF78EB16828

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 169f94b154b07c145e8afc4df5feea87b6ccedfebeea82715f136f646080e8d1
Instruction ID: 7a198cefefb46c6a7d5dcbc99fff109dab4900129e26bbfa562247d6a6b595fa
Opcode Fuzzy Hash: 169f94b154b07c145e8afc4df5feea87b6ccedfebeea82715f136f646080e8d1
Instruction Fuzzy Hash: 8D718122A08B0781EB15EFA6D4409BDABA1FB44FA8FA45432DE1E47759DF3CE445C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB12A18 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF78EB12A8F
inet_addr.WSOCK32 ref: 00007FF78EB12AED
gethostbyname.WSOCK32 ref: 00007FF78EB12AFA
IcmpCreateFile.IPHLPAPI ref: 00007FF78EB12B08
IcmpSendEcho.IPHLPAPI ref: 00007FF78EB12BAD
IcmpCloseHandle.IPHLPAPI ref: 00007FF78EB12C77
WSACleanup.WSOCK32 ref: 00007FF78EB12C7D

Strings

5, xrefs: 00007FF78EB12B79
Ping, xrefs: 00007FF78EB12B3F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addr
String ID: 5$Ping
API String ID: 1486594354-1972892582
Opcode ID: c5ec28ae87b9963566e486c3747175212f4b4effce9ee38a7591bc62717ee17b
Instruction ID: 2422e9bfc3a970d8ecd77f75b642ae34d52aa0a26bfc3f606b4e52db4f5546be
Opcode Fuzzy Hash: c5ec28ae87b9963566e486c3747175212f4b4effce9ee38a7591bc62717ee17b
Instruction Fuzzy Hash: A1718E72A0864282EB20EB96D480B7DBBA0FF84B90FA18431DA5D47791DF7CD541C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEE1AC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF0730: GetClassNameW.USER32 ref: 00007FF78EAF075B

SendMessageW.USER32 ref: 00007FF78EAEE244
GetDlgCtrlID.USER32 ref: 00007FF78EAEE256
GetParent.USER32 ref: 00007FF78EAEE267
SendMessageW.USER32 ref: 00007FF78EAEE27B
GetDlgCtrlID.USER32 ref: 00007FF78EAEE287
GetParent.USER32 ref: 00007FF78EAEE296
SendMessageW.USER32 ref: 00007FF78EAEE2AA

Strings

ComboBox, xrefs: 00007FF78EAEE1C6
ListBox, xrefs: 00007FF78EAEE1FF

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 09a0585a879aa7a3574045f94ed89f574aca608bff89165bfbbf01bae2deb851
Instruction ID: e36bb3315f4b1b0a99a0de04f06406a3e5b46ff657ff742fabd0470e23a368a1
Opcode Fuzzy Hash: 09a0585a879aa7a3574045f94ed89f574aca608bff89165bfbbf01bae2deb851
Instruction Fuzzy Hash: F231C231A09A8282EA10EF91E8549B9A761FF89FD0FE44131DE9D03B95DF3CE505C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEE08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF0730: GetClassNameW.USER32 ref: 00007FF78EAF075B

SendMessageW.USER32 ref: 00007FF78EAEE125
GetDlgCtrlID.USER32 ref: 00007FF78EAEE137
GetParent.USER32 ref: 00007FF78EAEE148
SendMessageW.USER32 ref: 00007FF78EAEE15C
GetDlgCtrlID.USER32 ref: 00007FF78EAEE168
GetParent.USER32 ref: 00007FF78EAEE177
SendMessageW.USER32 ref: 00007FF78EAEE18B

Strings

ComboBox, xrefs: 00007FF78EAEE0A6
ListBox, xrefs: 00007FF78EAEE0DF

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: dfc79a9e17b0648763ebb6a0e3bc46e10628265031a1e09320b73760a5a57e34
Instruction ID: d844487c0650954c718d818146f593c7439785a48d4cecdafedbf5d20b043d35
Opcode Fuzzy Hash: dfc79a9e17b0648763ebb6a0e3bc46e10628265031a1e09320b73760a5a57e34
Instruction Fuzzy Hash: 7731D131A09A4182EA10BB91E8509B8A761FF89FE0FE48231DEAD137D5CF3CE505C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFCA98 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32 ref: 00007FF78EAFCAB8
gethostname.WSOCK32 ref: 00007FF78EAFCAD0
gethostbyname.WSOCK32 ref: 00007FF78EAFCADB
wcscpy.LIBCMT ref: 00007FF78EAFCB12
inet_ntoa.WSOCK32 ref: 00007FF78EAFCB38
wcscpy.LIBCMT ref: 00007FF78EAFCB61
WSACleanup.WSOCK32 ref: 00007FF78EAFCB6E
wcscpy.LIBCMT ref: 00007FF78EAFCB80

Strings

0.0.0.0, xrefs: 00007FF78EAFCB08

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2479661705-3771769585
Opcode ID: 39908202b238dba1e9305c57f171ff884d1651b8f70c43c4d4bd0128cd43e1dd
Instruction ID: 3a9b29d7628f5d6f67e30f05809d7a76c362808949feab6439d7d7e7ef7ed0c9
Opcode Fuzzy Hash: 39908202b238dba1e9305c57f171ff884d1651b8f70c43c4d4bd0128cd43e1dd
Instruction Fuzzy Hash: 6A215131A0868391EA20BB92E585BBDE361BF94F80FE04132D54E47AA5DF3CD544C325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB30D7C Relevance: 15.2, APIs: 10, Instructions: 209windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82A54: GetWindowLongPtrW.USER32 ref: 00007FF78EA82A71

PostMessageW.USER32 ref: 00007FF78EB30DEE
GetFocus.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF78EB30DFF
GetDlgCtrlID.USER32 ref: 00007FF78EB30E0C
GetMenuItemInfoW.USER32 ref: 00007FF78EB30F43
GetMenuItemCount.USER32 ref: 00007FF78EB30F61
GetMenuItemID.USER32 ref: 00007FF78EB30F76
GetMenuItemInfoW.USER32 ref: 00007FF78EB30FB1
GetMenuItemInfoW.USER32 ref: 00007FF78EB30FFC
CheckMenuRadioItem.USER32 ref: 00007FF78EB31033

Part of subcall function 00007FF78EB2FB28: IsWindow.USER32 ref: 00007FF78EB2FBED
Part of subcall function 00007FF78EB2FB28: IsWindowEnabled.USER32 ref: 00007FF78EB2FBFA

DefDlgProcW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF78EB3106A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ItemMenu$InfoWindow$CheckCountCtrlEnabledFocusLongMessagePostProcRadio
String ID:
API String ID: 2672075419-0
Opcode ID: 483736ca4524e46e39a6667cb4a9483b8f15c912601d7af63434f91fd575caa3
Instruction ID: 98b57517ca19a55ea50fcffaff00602e8b4811b7df0e4599c324b2c21e956a0e
Opcode Fuzzy Hash: 483736ca4524e46e39a6667cb4a9483b8f15c912601d7af63434f91fd575caa3
Instruction Fuzzy Hash: 10919E36B096528AEB50AFE5D441BBDABE1FF45B88FA00035DE0D53A99DF38E405C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEE908 Relevance: 15.1, APIs: 10, Instructions: 59keyboardsleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF03F8: GetWindowThreadProcessId.USER32 ref: 00007FF78EAF0414
Part of subcall function 00007FF78EAF03F8: GetCurrentThreadId.KERNEL32 ref: 00007FF78EAF041C
Part of subcall function 00007FF78EAF03F8: AttachThreadInput.USER32(?,?,?,00007FF78EAEE921), ref: 00007FF78EAF0441

MapVirtualKeyW.USER32 ref: 00007FF78EAEE92C
PostMessageW.USER32 ref: 00007FF78EAEE947
Sleep.KERNEL32 ref: 00007FF78EAEE94F
MapVirtualKeyW.USER32 ref: 00007FF78EAEE959
MapVirtualKeyW.USER32 ref: 00007FF78EAEE964
PostMessageW.USER32 ref: 00007FF78EAEE982
Sleep.KERNEL32 ref: 00007FF78EAEE98A
MapVirtualKeyW.USER32 ref: 00007FF78EAEE994
PostMessageW.USER32 ref: 00007FF78EAEE9B6
Sleep.KERNEL32 ref: 00007FF78EAEE9BE

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
String ID:
API String ID: 685491774-0
Opcode ID: c5260aafb6a4b6d42d2605749b26c771a95cedda71831fed2f7dc5c01b1cab92
Instruction ID: 5ff7222665086d9e44a9687f023b4d7a2ea02beb89ca8e1e6167e9c9733a6856
Opcode Fuzzy Hash: c5260aafb6a4b6d42d2605749b26c771a95cedda71831fed2f7dc5c01b1cab92
Instruction Fuzzy Hash: C5119075B0590282F714ABF6A899D7D66A1BFCCB81FA09039C90E4BB50DF3DE054C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEF7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

REGEXPCLASS, xrefs: 00007FF78EAEF988, 00007FF78EAEF99D
CLASSNN, xrefs: 00007FF78EAEF924, 00007FF78EAEF935
INSTANCE, xrefs: 00007FF78EAEFCC3, 00007FF78EAEFCD4
NAME, xrefs: 00007FF78EAEFAA9, 00007FF78EAEFABA
TEXT, xrefs: 00007FF78EAEFD2F, 00007FF78EAEFD40
CLASS, xrefs: 00007FF78EAEF8A8, 00007FF78EAEF8D1

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 0-1603158881
Opcode ID: 8592d670b6a5495871e12ff66e0da7572921ba9f8c170d8e8a2b49cf93bae69b
Instruction ID: 25247c6a550fe515e6eb13a1799b41469c7f5849ad8dc8b9fa47ce18da6e6fdd
Opcode Fuzzy Hash: 8592d670b6a5495871e12ff66e0da7572921ba9f8c170d8e8a2b49cf93bae69b
Instruction Fuzzy Hash: 9A12B466B1C68392FA58ABA1C851EF9F291FF54F84FE44531CA1D97290EF3CE950C221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2A350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA8932C: CreateWindowExW.USER32 ref: 00007FF78EA893BC
Part of subcall function 00007FF78EA8932C: GetStockObject.GDI32 ref: 00007FF78EA893D9
Part of subcall function 00007FF78EA8932C: SendMessageW.USER32 ref: 00007FF78EA893EC

SendMessageW.USER32(0000001B,?,?,?,?,00007FF78EACDB45), ref: 00007FF78EB2A461
SendMessageW.USER32(0000001B,?,?,?,?,00007FF78EACDB45), ref: 00007FF78EB2A47A
SetWindowPos.USER32 ref: 00007FF78EB2A4A7
wcscat.LIBCMT ref: 00007FF78EB2A509
SendMessageW.USER32 ref: 00007FF78EB2A51D
SendMessageW.USER32 ref: 00007FF78EB2A54E

Strings

SysListView32, xrefs: 00007FF78EB2A3B0
-----, xrefs: 00007FF78EB2A4FB

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStockwcscat
String ID: -----$SysListView32
API String ID: 2361508679-3975388722
Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction ID: 98765fc1461d2dc4c4169409284943a74c1fd916c883e5c0c996a2d8e5c80e7d
Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction Fuzzy Hash: C251E332A047818AE720DF65E844AEEB7E1FB88784F90013ADE4D57B59CF38D994CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEE2CC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF78EAEE2DF
GetClassNameW.USER32 ref: 00007FF78EAEE2F6

Part of subcall function 00007FF78EAA8E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAA8E4F

SendMessageW.USER32 ref: 00007FF78EAEE386

Strings

SHELLDLL_DefView, xrefs: 00007FF78EAEE2FC
list, xrefs: 00007FF78EAEE365
details, xrefs: 00007FF78EAEE32F
smallicons, xrefs: 00007FF78EAEE34A
largeicons, xrefs: 00007FF78EAEE314

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 2019164449-3381328864
Opcode ID: 8e262b819e6f56a90fb6f0dff8af3bf336551f9b4e3e960db18143356d212841
Instruction ID: 3df4498795a4a5dc2c71e17961374701928fcb48a9e0238da5d23675a2f497c7
Opcode Fuzzy Hash: 8e262b819e6f56a90fb6f0dff8af3bf336551f9b4e3e960db18143356d212841
Instruction Fuzzy Hash: EB214C21B1C64390EA20B792E945E79A791BF81B84FA08035C90D87695EF3CE916C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB17054 Relevance: 13.9, APIs: 9, Instructions: 373COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF78EB17168
FreeLibrary.KERNEL32 ref: 00007FF78EB171A9
QueryPathOfRegTypeLib.OLEAUT32 ref: 00007FF78EB173B2
SysFreeString.OLEAUT32 ref: 00007FF78EB173E7
StringFromGUID2.OLE32 ref: 00007FF78EB17585

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FreeString$FileFromLibraryModuleNamePathQueryType
String ID:
API String ID: 1903627254-0
Opcode ID: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction ID: ebc76aee2e67ce7302eb1d927fa25a734712fa358131f253b9fb3186cd55b305
Opcode Fuzzy Hash: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction Fuzzy Hash: C5025D22A08A9286DB50EF65D4445BDBBA1FB85F94FA04032EF4E47B64CF3CD549C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2C324 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,?,?,00007FF78EACDF87), ref: 00007FF78EB2C40A
ShowWindow.USER32(00000000,?,?,00007FF78EACDF87), ref: 00007FF78EB2C449
ShowWindow.USER32 ref: 00007FF78EB2C457
SetFocus.USER32 ref: 00007FF78EB2C460

Part of subcall function 00007FF78EB2E7D4: DeleteObject.GDI32 ref: 00007FF78EB2E82A

GetWindowLongW.USER32 ref: 00007FF78EB2C4A8
SetWindowLongPtrW.USER32 ref: 00007FF78EB2C4BD
InvalidateRect.USER32(00000000,?,?,00007FF78EACDF87), ref: 00007FF78EB2C4F7
SendMessageW.USER32(00000000,?,?,00007FF78EACDF87), ref: 00007FF78EB2C536
SendMessageW.USER32 ref: 00007FF78EB2C54A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction ID: 89a8e88a591eff6b5d84bb1380d8acf8eff844b9ff4aeb657cd2b8d3dd97381f
Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction Fuzzy Hash: 4C619131A0858396FB34BAA59841FBA9A51BF407A4FB08531DA1D036E5CF7DEC41DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB30B24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82A54: GetWindowLongPtrW.USER32 ref: 00007FF78EA82A71

Part of subcall function 00007FF78EA81CEC: GetCursorPos.USER32 ref: 00007FF78EA81D1B
Part of subcall function 00007FF78EA81CEC: ScreenToClient.USER32 ref: 00007FF78EA81D3A
Part of subcall function 00007FF78EA81CEC: GetAsyncKeyState.USER32 ref: 00007FF78EA81D62
Part of subcall function 00007FF78EA81CEC: GetAsyncKeyState.USER32 ref: 00007FF78EA81D82

ImageList_DragLeave.COMCTL32 ref: 00007FF78EB30BA4
ImageList_EndDrag.COMCTL32 ref: 00007FF78EB30BAA
ReleaseCapture.USER32 ref: 00007FF78EB30BB0
SetWindowTextW.USER32 ref: 00007FF78EB30C5E
SendMessageW.USER32 ref: 00007FF78EB30C73

Strings

@GUI_DROPID, xrefs: 00007FF78EB30C99
@GUI_DRAGFILE, xrefs: 00007FF78EB30CE0

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 3721556410-2107944366
Opcode ID: 3604d4c7ce96f57bdd947ebfa5ae980c85c78aa1d887a29cd4c966ae94874c70
Instruction ID: bc3abefdb6cfabb9b1c15cad67ab037d5d2b29e6913d9bf6e1f33b021f7de1d8
Opcode Fuzzy Hash: 3604d4c7ce96f57bdd947ebfa5ae980c85c78aa1d887a29cd4c966ae94874c70
Instruction Fuzzy Hash: 07617F76A14A5285EB00FFA5E8819FDBBB0FB44B98FA01132DD1D13AA5CF38E545C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1E580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAFBE00: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF78EAFBE3B
Part of subcall function 00007FF78EAFBE00: Process32FirstW.KERNEL32 ref: 00007FF78EAFBE4B
Part of subcall function 00007FF78EAFBE00: CloseHandle.KERNEL32 ref: 00007FF78EAFBF55

OpenProcess.KERNEL32 ref: 00007FF78EB1E610
GetLastError.KERNEL32 ref: 00007FF78EB1E622
OpenProcess.KERNEL32 ref: 00007FF78EB1E65B
TerminateProcess.KERNEL32 ref: 00007FF78EB1E702
GetLastError.KERNEL32 ref: 00007FF78EB1E70C
CloseHandle.KERNEL32 ref: 00007FF78EB1E75A

Strings

SeDebugPrivilege, xrefs: 00007FF78EB1E633

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f739a1b5ec9dcf9be788f6fa4a29232cbc47b3c853728f973a89d79ffbc52252
Instruction ID: 7920aab335a7950f61619712de3a0124accfa1962aef58ceeb2ccbc9b9c5b236
Opcode Fuzzy Hash: f739a1b5ec9dcf9be788f6fa4a29232cbc47b3c853728f973a89d79ffbc52252
Instruction Fuzzy Hash: 56517D62A0869282EB00FBA5C590B7CBB60FF84F91FA58431D60E07792DF3CE404CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFA070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF78EAFA12F
IsMenu.USER32 ref: 00007FF78EAFA151
CreatePopupMenu.USER32 ref: 00007FF78EAFA183
GetMenuItemCount.USER32 ref: 00007FF78EAFA1DD
InsertMenuItemW.USER32 ref: 00007FF78EAFA209

Strings

P, xrefs: 00007FF78EAFA0D0
2, xrefs: 00007FF78EAFA167

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 2$P
API String ID: 93392585-1110268094
Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction ID: 368bb5b08068b0765966e753fe0cddfdefb7782a777aadffa2d81978c986c553
Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction Fuzzy Hash: 2151C332B0864289F760AFE5E440AFDB7A5BB40B58FB44136CA5E53694DF38E481C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2E248 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF78EB0BDFB), ref: 00007FF78EB2E32E
SetWindowLongPtrW.USER32 ref: 00007FF78EB2E346
SetWindowLongPtrW.USER32 ref: 00007FF78EB2E360
SendMessageW.USER32 ref: 00007FF78EB2E38D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF78EB0BDFB), ref: 00007FF78EB2E3B1
SetWindowPos.USER32 ref: 00007FF78EB2E3F7

Strings

', xrefs: 00007FF78EB2E3E2

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$LongMessageSend$Show
String ID: '
API String ID: 257662517-1997036262
Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction ID: 4511265582969683266dd62e26ceb09172a911e31c3cac61e5eb36cdfc9906ee
Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction Fuzzy Hash: 4C51D73290868281E762ABA7A554E7DBF90FF85B91FA48132CE5E03790CF3DE441D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFAD94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAA8E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAA8E4F

LoadIconW.USER32 ref: 00007FF78EAFAE50

Strings

info, xrefs: 00007FF78EAFADE8
stop, xrefs: 00007FF78EAFAE1C
question, xrefs: 00007FF78EAFAE02
blank, xrefs: 00007FF78EAFADC9
warning, xrefs: 00007FF78EAFAE36

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: IconLoad_invalid_parameter_noinfo
String ID: blank$info$question$stop$warning
API String ID: 4060274358-404129466
Opcode ID: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction ID: edd26cb1a14356e960271e3dcb32a80c31dfe6b0f439ef9db110cb3dce7df023
Opcode Fuzzy Hash: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
Instruction Fuzzy Hash: 6D216D21B0C79381FA60BB96E9109BAE755BF44B80FE45032DD4D42795EF7CE852C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFC5C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF78EAFC5DC
LoadStringW.USER32 ref: 00007FF78EAFC5F2
GetModuleHandleW.KERNEL32 ref: 00007FF78EAFC5FA
LoadStringW.USER32 ref: 00007FF78EAFC616
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF78EAFC649
MessageBoxW.USER32 ref: 00007FF78EAFC665

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00007FF78EAFC642

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4051287042-3128320259
Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction ID: 0ca9eb40161d1006cc3438f2805ca3aa0ae2dcd9b1f8dda27e936b3b5224006f
Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction Fuzzy Hash: A9116571B1DB8591D730AB50F445BEAA7A0FB48748FD05036EA8E43A58DF7CC149C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB3233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82A54: GetWindowLongPtrW.USER32 ref: 00007FF78EA82A71

GetSystemMetrics.USER32 ref: 00007FF78EB323A5
GetSystemMetrics.USER32 ref: 00007FF78EB323C4
MoveWindow.USER32 ref: 00007FF78EB325F9
SendMessageW.USER32 ref: 00007FF78EB3261A
SendMessageW.USER32 ref: 00007FF78EB3263E
ShowWindow.USER32 ref: 00007FF78EB3265E
InvalidateRect.USER32(?,?,?,00000000,?,?,?,00007FF78EACAA58), ref: 00007FF78EB3268B
DefDlgProcW.USER32(?,?,?,00000000,?,?,?,00007FF78EACAA58), ref: 00007FF78EB326B3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction ID: abbbfbceed89fe1a90336968d9f82688d79aaf664099c187a2922468dd3faa33
Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction Fuzzy Hash: 4AA10232B1868282EB68AFE59555F79BAE0FB84B44F605035DE0A43E90DF3CE851C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1FCC0 Relevance: 12.2, APIs: 8, Instructions: 246registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EB21110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF78EB1FD7B), ref: 00007FF78EB21143

RegConnectRegistryW.ADVAPI32 ref: 00007FF78EB1FDAE
RegOpenKeyExW.ADVAPI32 ref: 00007FF78EB1FE30
RegDeleteValueW.ADVAPI32 ref: 00007FF78EB1FEC7
RegCloseKey.ADVAPI32 ref: 00007FF78EB1FF34
RegCloseKey.ADVAPI32 ref: 00007FF78EB20041

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Close$BuffCharConnectDeleteOpenRegistryUpperValue
String ID:
API String ID: 50796853-0
Opcode ID: b3e9e5569108577abde508208a8a77bfdd0d9330c3e28af58334325f69aefe54
Instruction ID: a67bf5a67f4273cc5b82fa0a898350bf3c6406932fa912823ebb72edecb42daf
Opcode Fuzzy Hash: b3e9e5569108577abde508208a8a77bfdd0d9330c3e28af58334325f69aefe54
Instruction Fuzzy Hash: 31B19D32B0969286EB10EFA5D491BBDAB60FF85B84FA14031DA4E17B96CF3CD105C725

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF78EAA44CD
ShowWindow.USER32 ref: 00007FF78EAEA753
ShowWindow.USER32 ref: 00007FF78EAEA7ED

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction ID: 199731003b857c6792ac52e87b58704dff83323c9e62deb908bd03d76b214d25
Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction Fuzzy Hash: B251A831E0C2438AF765BBAA9445B7DBA92BF42F44FB84075D50E429D5DF3CE484C262

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB290A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF78EB290D8
GetDC.USER32 ref: 00007FF78EB290E0
GetDeviceCaps.GDI32 ref: 00007FF78EB290F1
ReleaseDC.USER32 ref: 00007FF78EB290FE
CreateFontW.GDI32 ref: 00007FF78EB29195
SendMessageW.USER32 ref: 00007FF78EB291AB
MoveWindow.USER32 ref: 00007FF78EB291F1
SendMessageW.USER32 ref: 00007FF78EB29213

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction ID: d84ea85dd9f8ba6ab05a31b889d513e4aea8188ca39f7e5ce7c0417cdf590719
Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction Fuzzy Hash: B541A97662968187E7248BA2B445B6ABBA0FB88B91F604135EF8E43F54DF3CD440CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC0BBC Relevance: 10.8, APIs: 7, Instructions: 294COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC1001

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction ID: d321665dd2e0c6a6ea1cb48fa05c44de5a23f687dffef1ed9558772f9e752098
Opcode Fuzzy Hash: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
Instruction Fuzzy Hash: C5C1FA22A0C68285EA61AF9590C0A7EEB91BF85F90FB54135DA4E077D5CF3DE4C0C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB009C4 Relevance: 10.7, APIs: 7, Instructions: 248COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32 ref: 00007FF78EB00AAF
SafeArrayAccessData.OLEAUT32 ref: 00007FF78EB00B05
SafeArrayAccessData.OLEAUT32 ref: 00007FF78EB00BEC
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF78EB00C13
SafeArrayAccessData.OLEAUT32 ref: 00007FF78EB00C24
SafeArrayAccessData.OLEAUT32 ref: 00007FF78EB00C92
SafeArrayAccessData.OLEAUT32 ref: 00007FF78EB00D07

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: cc58eafc9923de1e7c3249b18b6e84dbd69b0111c8c505ccc1afaa6432328985
Instruction ID: 5d395e5f067ea3ffe649269f4f3c98b6c70e209dabca5815c865c38b8d9efdba
Opcode Fuzzy Hash: cc58eafc9923de1e7c3249b18b6e84dbd69b0111c8c505ccc1afaa6432328985
Instruction Fuzzy Hash: 69A19032A0861285FB54AFA5C454FBCABA1FB46B88FA54831DE0D47691DF7CF581C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA82100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction ID: 39764dcb974c8507d2d6566f10fcf11380e8db00b118a339f124f811c6aac936
Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction Fuzzy Hash: 3FA1A072A0C6C087D7749F59A400A7EFBB5FB85B95FA04125EA8913B69CB3CD442CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2FB28 Relevance: 10.7, APIs: 7, Instructions: 212windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF78EB2FBED
IsWindowEnabled.USER32 ref: 00007FF78EB2FBFA
SendMessageW.USER32 ref: 00007FF78EB2FD22
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,00007FF78EACAAA9), ref: 00007FF78EB2FE2A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSendWindow$Enabled
String ID:
API String ID: 3694350264-0
Opcode ID: 4a77701bf279e5e10e090b08d0e82f3a928381821d52e04601c4e196b5ce2c82
Instruction ID: a149a5a855695552483ccbb90b5dc8c84cb3ee378345705ab3ee06b39316a794
Opcode Fuzzy Hash: 4a77701bf279e5e10e090b08d0e82f3a928381821d52e04601c4e196b5ce2c82
Instruction Fuzzy Hash: A791AE21E0D68642FB74BB949454BB9AB92BF84B84FA44036CA4D23799CF3CE491C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF8E18 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF78EAF8E69
GetKeyboardState.USER32 ref: 00007FF78EAF8E7D
SetKeyboardState.USER32 ref: 00007FF78EAF8ECC
PostMessageW.USER32 ref: 00007FF78EAF8EF9
PostMessageW.USER32 ref: 00007FF78EAF8F21
PostMessageW.USER32 ref: 00007FF78EAF8F6C
PostMessageW.USER32 ref: 00007FF78EAF8F98

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction ID: a14514bcaa1338c6c76b10351e764c13f138532d0ec76f77c3306aec0c02a6ef
Opcode Fuzzy Hash: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
Instruction Fuzzy Hash: 4351D423A0D2D255FB6197B19111E7DAFA1FB46FC0FA88076DA8907E46CF28E454C332

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF4860 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAEB748: CLSIDFromProgID.OLE32 ref: 00007FF78EAEB771
Part of subcall function 00007FF78EAEB748: ProgIDFromCLSID.OLE32 ref: 00007FF78EAEB790
Part of subcall function 00007FF78EAEB748: lstrcmpiW.KERNEL32 ref: 00007FF78EAEB7A2
Part of subcall function 00007FF78EAEB748: CoTaskMemFree.OLE32 ref: 00007FF78EAEB7B4

IIDFromString.OLE32 ref: 00007FF78EAF48EF
CoCreateInstance.OLE32 ref: 00007FF78EAF4931
SetErrorMode.KERNEL32 ref: 00007FF78EAF496D
GetProcAddress.KERNEL32 ref: 00007FF78EAF4983
SetErrorMode.KERNEL32 ref: 00007FF78EAF4A15

Strings

DllGetClassObject, xrefs: 00007FF78EAF4973

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
String ID: DllGetClassObject
API String ID: 668425406-1075368562
Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction ID: 0895ce2f05c4364c9a7a5cbc68457e1a675bbffc4a44e1cacbfb17bf11dd66fb
Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction Fuzzy Hash: 56519D32A08B4686EB14AF96E540B79A7A0FF84F84FA04036DB4D57A45DF7CF094C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB137A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EB15E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF78EB137FB), ref: 00007FF78EB15E4D

socket.WSOCK32 ref: 00007FF78EB13827
WSAGetLastError.WSOCK32 ref: 00007FF78EB13836

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction ID: 70d46e6a9192ad8829739a1aae81a2bff02e104e0153268a8c12bc158534d7cf
Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction Fuzzy Hash: 3D41B572A0C68282E720AFA5A444ABDF7A1FB44BE4FA14231DE6E43B95DF3CD445C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2A884 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00007FF78EB2A8D1
SetMenu.USER32 ref: 00007FF78EB2A8E4
GetMenuItemInfoW.USER32 ref: 00007FF78EB2A977
IsMenu.USER32 ref: 00007FF78EB2A991
CreatePopupMenu.USER32 ref: 00007FF78EB2A99B
InsertMenuItemW.USER32 ref: 00007FF78EB2A9D1
DrawMenuBar.USER32 ref: 00007FF78EB2A9DA

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID:
API String ID: 161812096-0
Opcode ID: f652d99759d139f7e87a15b3a4320fe0bc8d646037924ff5962e8acb98e6298b
Instruction ID: ca3916ac08439736acd36825aaba617287ae5a10d7f4a4efda576e266bca242a
Opcode Fuzzy Hash: f652d99759d139f7e87a15b3a4320fe0bc8d646037924ff5962e8acb98e6298b
Instruction Fuzzy Hash: 27419F36A05B4585EB50DFA6D880AAC7BB0FB84B98FA54036DE4D43B64CF38E445C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF4FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF78EAF5028
MultiByteToWideChar.KERNEL32 ref: 00007FF78EAF5059
SysAllocString.OLEAUT32 ref: 00007FF78EAF5062
SysAllocString.OLEAUT32 ref: 00007FF78EAF5086
SysFreeString.OLEAUT32 ref: 00007FF78EAF5092
StringFromGUID2.OLE32 ref: 00007FF78EAF50B0
SysAllocString.OLEAUT32 ref: 00007FF78EAF50BF

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 44f7315ec137fccb8cfc24c068c372bc78d2615cd5705ef111b775d28ff6eb28
Instruction ID: 648b8e4e7f25960783718bb5d8bd6608dbc6dc270902eca0d7cc563c61559e03
Opcode Fuzzy Hash: 44f7315ec137fccb8cfc24c068c372bc78d2615cd5705ef111b775d28ff6eb28
Instruction Fuzzy Hash: D231AE31A08B4689DA20AF92E444978F7E0FB85FD0FA98236DA5E03B90CF3DE444C354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF4EB0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF78EAF4F03
MultiByteToWideChar.KERNEL32 ref: 00007FF78EAF4F34
SysAllocString.OLEAUT32 ref: 00007FF78EAF4F3D
SysAllocString.OLEAUT32 ref: 00007FF78EAF4FA5

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AllocByteCharMultiStringWide
String ID:
API String ID: 3603722519-0
Opcode ID: b1007ac638b947db620a6db0c2ebc1e3135516e026687e2bb7390bcafa021b90
Instruction ID: ba0b2ca00fa7d6c6c74580398d5a4d04e4fbcce552de943664adef999ecdbb61
Opcode Fuzzy Hash: b1007ac638b947db620a6db0c2ebc1e3135516e026687e2bb7390bcafa021b90
Instruction Fuzzy Hash: 90314F31A09B4589EB20AF52E444979F7E0FB44F91FA84236EA5E53B95CF3CE584C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2AEDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA8932C: CreateWindowExW.USER32 ref: 00007FF78EA893BC
Part of subcall function 00007FF78EA8932C: GetStockObject.GDI32 ref: 00007FF78EA893D9
Part of subcall function 00007FF78EA8932C: SendMessageW.USER32 ref: 00007FF78EA893EC

SendMessageW.USER32 ref: 00007FF78EB2AF8C
SendMessageW.USER32 ref: 00007FF78EB2AFA0
SendMessageW.USER32 ref: 00007FF78EB2AFB4
SendMessageW.USER32 ref: 00007FF78EB2AFCB
SendMessageW.USER32 ref: 00007FF78EB2AFE3

Strings

Msctls_Progress32, xrefs: 00007FF78EB2AF12

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction ID: d69dc8b03c38d53cb9986efad1d985b5387088a1516e9a6ad7f5e94b32556826
Opcode Fuzzy Hash: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
Instruction Fuzzy Hash: AA31673260968187E3609F65F485F1ABB61FB88790F609239EB9853F98CF3CD845CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFF9EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF78EAFFA11
CreatePipe.KERNEL32 ref: 00007FF78EAFFA5D

Strings

nul, xrefs: 00007FF78EAFFA99

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction ID: 9c50124af42e49293024c979370d274f6b966bfd795010d5bff731c941a4ff55
Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction Fuzzy Hash: B4218E36A1DB4682EB10AB64D014B79A3A0FF85B78FA44332DA6E067D8DF7CD044C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFFAFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF78EAFFB23
CreatePipe.KERNEL32 ref: 00007FF78EAFFB6F

Strings

nul, xrefs: 00007FF78EAFFBB3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction ID: 3d78c79ac627ed638dc80937c80a4a721607d603a0df14d917ac04acecb0b484
Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction Fuzzy Hash: 10318036A1CA4686EB10AB64D414B79A6A0FB85B78FA00332DA7D467D4CF3CD445C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA88F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF78EA88F7D
GetWindowRect.USER32 ref: 00007FF78EA88FBF
ScreenToClient.USER32 ref: 00007FF78EA88FE5
GetClientRect.USER32 ref: 00007FF78EA89175
GetWindowRect.USER32 ref: 00007FF78EA8919E
GetSystemMetrics.USER32 ref: 00007FF78EACE005

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction ID: e476353fe29f24e5e7a8573fe919036830e88589ddf711b4afd07adb30054959
Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction Fuzzy Hash: D8A1F56AA1825385E764AFB18404BBDB3B0FF04F58FA55035DE1D97A94EB3D9840D332

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAAA054 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAAA08F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAAA460
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAAA701

Strings

f, xrefs: 00007FF78EAAA194
p, xrefs: 00007FF78EAAA19C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p
API String ID: 3215553584-1290815066
Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction ID: 7ab536b70e229abcc98dda91deef93d3a732a2475f8241f4c802a56dda7b560d
Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction Fuzzy Hash: D612A522E0C35386FB20BA96E044A7AE6D1FB40F94FE44232D69D075C4DB3DE550CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEAD30 Relevance: 9.2, APIs: 6, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF78EAEAD45
VariantClear.OLEAUT32 ref: 00007FF78EAEADCA
VariantCopy.OLEAUT32 ref: 00007FF78EAEADD6
VariantClear.OLEAUT32 ref: 00007FF78EAEADE1
SysAllocString.OLEAUT32 ref: 00007FF78EAEAE11
VariantCopy.OLEAUT32 ref: 00007FF78EAEAE73

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 2ee1352e520512debfa067338aa973891b78a2f0a8d3fc5eb6061229bd62edbc
Instruction ID: e82ace90cfee8a23c1294a0f2e4fe242955a03f924621d3a596cc95384133432
Opcode Fuzzy Hash: 2ee1352e520512debfa067338aa973891b78a2f0a8d3fc5eb6061229bd62edbc
Instruction Fuzzy Hash: 4C711972A0824381EA28BBA9955497CB7A0BF45F80FA48536D74E07B95DF3CE911C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA81E04 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82A54: GetWindowLongPtrW.USER32 ref: 00007FF78EA82A71

BeginPaint.USER32 ref: 00007FF78EA81E4C
GetWindowRect.USER32 ref: 00007FF78EA81EB7
ScreenToClient.USER32 ref: 00007FF78EA81EDE
SetViewportOrgEx.GDI32 ref: 00007FF78EA81EF9
EndPaint.USER32 ref: 00007FF78EA81F5A
Rectangle.GDI32 ref: 00007FF78EACA458

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction ID: 76c25b8294f6d6e6dffd3cb0ca8ecc0a78fd8427999757578329af1673ea5f23
Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction Fuzzy Hash: 6451D436A18B9286E720EB55E444BB9BBA0FB45F94FA04236CE5D43B94CF7CE441C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF2240 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF78EAF226B
GetDeviceCaps.GDI32 ref: 00007FF78EAF227C
GetDeviceCaps.GDI32 ref: 00007FF78EAF228C
ReleaseDC.USER32 ref: 00007FF78EAF2299
MulDiv.KERNEL32 ref: 00007FF78EAF22AC
MulDiv.KERNEL32 ref: 00007FF78EAF22BE

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction ID: 764b64c67c0d16160bbc7babfd65440c9d03d04e717e3c5148f77e38f5c38e55
Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction Fuzzy Hash: 3D119E35B15B0186EB08DBA1A949429BAA5FB88FC0FA08039CE0E47F94DF3DD801C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB309FC Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82370: ExtCreatePen.GDI32 ref: 00007FF78EA823FF
Part of subcall function 00007FF78EA82370: SelectObject.GDI32 ref: 00007FF78EA82412
Part of subcall function 00007FF78EA82370: BeginPath.GDI32 ref: 00007FF78EA8242B
Part of subcall function 00007FF78EA82370: SelectObject.GDI32 ref: 00007FF78EA82452

MoveToEx.GDI32 ref: 00007FF78EB30A3F
LineTo.GDI32 ref: 00007FF78EB30A4E
MoveToEx.GDI32 ref: 00007FF78EB30A60
LineTo.GDI32 ref: 00007FF78EB30A6F
EndPath.GDI32 ref: 00007FF78EB30A81
StrokePath.GDI32 ref: 00007FF78EB30A91

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction ID: 5a17a9a5b6f1911cf15f16a9c832bccac3b7be1316dbf3933226986a67edccc5
Opcode Fuzzy Hash: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
Instruction Fuzzy Hash: 2C11BF31B1469282E714AB56B805B69BFA1FF86B84FA84131CF0603F51CFBDA448C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA2D5C Relevance: 9.0, APIs: 6, Instructions: 39keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2D8E
MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2D9C
MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2DAC
MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2DBC
MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2DCA
MapVirtualKeyW.USER32(?,?,?,00007FF78EA87FA5), ref: 00007FF78EAA2DD8

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction ID: 1fab609de6acaf3ae5f9cbcec99277cd7dff64f2476bf9a06a14cebcd52439fd
Opcode Fuzzy Hash: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
Instruction Fuzzy Hash: BF1152729066408AD348DF79DC489197BF2FB58B09B948034C2499F665EF39D49AC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFDA1C Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF78EAFDA2F
SendMessageTimeoutW.USER32 ref: 00007FF78EAFDA5C
GetWindowThreadProcessId.USER32 ref: 00007FF78EAFDA6F
OpenProcess.KERNEL32 ref: 00007FF78EAFDA81
TerminateProcess.KERNEL32 ref: 00007FF78EAFDA8F
CloseHandle.KERNEL32 ref: 00007FF78EAFDA98

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction ID: 9c120b8b0a60a11bb3c63ca02bfbeaeed5d548d2338774a386f75626c102cf0a
Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction Fuzzy Hash: 02018F72A1574183EB10ABA1E805E29F7A1FF89B95F945034CA0A06F14DF3CD048CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB17E38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAEB748: CLSIDFromProgID.OLE32 ref: 00007FF78EAEB771
Part of subcall function 00007FF78EAEB748: ProgIDFromCLSID.OLE32 ref: 00007FF78EAEB790
Part of subcall function 00007FF78EAEB748: lstrcmpiW.KERNEL32 ref: 00007FF78EAEB7A2
Part of subcall function 00007FF78EAEB748: CoTaskMemFree.OLE32 ref: 00007FF78EAEB7B4

Part of subcall function 00007FF78EAEC034: WNetAddConnection2W.MPR ref: 00007FF78EAEC143
Part of subcall function 00007FF78EAEC034: RegConnectRegistryW.ADVAPI32 ref: 00007FF78EAEC164
Part of subcall function 00007FF78EAEC034: RegOpenKeyExW.ADVAPI32 ref: 00007FF78EAEC193
Part of subcall function 00007FF78EAEC034: RegQueryValueExW.ADVAPI32 ref: 00007FF78EAEC1CD

CoInitializeSecurity.OLE32 ref: 00007FF78EB17F26
CoCreateInstanceEx.OLE32 ref: 00007FF78EB180C6
CoTaskMemFree.OLE32 ref: 00007FF78EB180D2
CoSetProxyBlanket.OLE32 ref: 00007FF78EB1812B

Strings

NULL Pointer assignment, xrefs: 00007FF78EB18148

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FreeFromProgTask$BlanketConnectConnection2CreateInitializeInstanceOpenProxyQueryRegistrySecurityValuelstrcmpi
String ID: NULL Pointer assignment
API String ID: 1653399731-2785691316
Opcode ID: 74e140c0a3b96a9d62fba3994218285520586fa5553d09b37dc0b1daa8a1d12d
Instruction ID: a0f16bd49b1dd090c924c5886b44979c9fb197cb7626152d32c92f3f4ce5dc58
Opcode Fuzzy Hash: 74e140c0a3b96a9d62fba3994218285520586fa5553d09b37dc0b1daa8a1d12d
Instruction Fuzzy Hash: 13B17F33A04B918AE710EFA1D4409ADBBB1FB887A8FA00135EE4D57B58DF38E545CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1CDF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000003,00000000,?,00007FF78EB1BF47), ref: 00007FF78EB1CE29

Strings

none, xrefs: 00007FF78EB1D05A
winapi, xrefs: 00007FF78EB1CF88
cdecl, xrefs: 00007FF78EB1CF2F
stdcall, xrefs: 00007FF78EB1CFCB

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: cfd27aa9078fe54b5237ae4ae96dd4eb24f1e30810729373652e6a66a1bfe0f4
Instruction ID: c0fbd417c66400b1ba5bf615f3626e4f4846dc15043040d20b00457544805a44
Opcode Fuzzy Hash: cfd27aa9078fe54b5237ae4ae96dd4eb24f1e30810729373652e6a66a1bfe0f4
Instruction Fuzzy Hash: 11912823B1865391EA18AFA59440D7DABA2BF147A0BF04535DE5D93B84DF3DEC42C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB16920 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF78EB1695A
CharUpperBuffW.USER32 ref: 00007FF78EB16A77
VariantClear.OLEAUT32 ref: 00007FF78EB16C11

Part of subcall function 00007FF78EB003E8: VariantInit.OLEAUT32 ref: 00007FF78EB00437
Part of subcall function 00007FF78EB003E8: VariantCopy.OLEAUT32 ref: 00007FF78EB00443
Part of subcall function 00007FF78EB003E8: VariantClear.OLEAUT32 ref: 00007FF78EB00450

Strings

AUTOIT.ERROR, xrefs: 00007FF78EB16A7D
Incorrect Parameter format, xrefs: 00007FF78EB16990, 00007FF78EB16B81

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: b3b6d2ada6ccf103fe3fbc6ee34d72f9b562082d7f5494f8603740d1ad09ed8b
Instruction ID: 89742966ac1ec9eb9acc687eb0361915d837a5cc7092ac20c07ccc6e50cb576d
Opcode Fuzzy Hash: b3b6d2ada6ccf103fe3fbc6ee34d72f9b562082d7f5494f8603740d1ad09ed8b
Instruction Fuzzy Hash: 2E91BB36B08B5285EB00FFA5E040ABDB7A5FB48B98BA54432DE5E53759DF38E405C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF0EAF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF78EAF0EDB

Part of subcall function 00007FF78EAF0B90: CharUpperBuffW.USER32(?,?,00000001,00007FF78EAF0F61), ref: 00007FF78EAF0C6A

Strings

LAST, xrefs: 00007FF78EAF0F55, 00007FF78EAF0F7E
ACTIVE, xrefs: 00007FF78EAF0FBC, 00007FF78EAF0FCD
HANDLE, xrefs: 00007FF78EAF100B, 00007FF78EAF101C
REGEXPTITLE, xrefs: 00007FF78EAF105A, 00007FF78EAF106F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: BuffCharForegroundUpperWindow
String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
API String ID: 3570115564-1994484594
Opcode ID: 7c257ca8d76c0aa10b9ff23c4fdb9d550ebcebe8798a519d819cbaa0415aa93d
Instruction ID: fb15b57a208f100ec19fcad729c449ef193f9e4f182189eff7cad63349c182fd
Opcode Fuzzy Hash: 7c257ca8d76c0aa10b9ff23c4fdb9d550ebcebe8798a519d819cbaa0415aa93d
Instruction Fuzzy Hash: 0C71B612B0864341FE64BBE5D451AB9E2A1BF64F84FE44033D94D96792EF3CE944C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB9B18 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB9B56

Strings

#, xrefs: 00007FF78EAB9BEB
O, xrefs: 00007FF78EAB9BFD
E, xrefs: 00007FF78EAB9BF7

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: #$E$O
API String ID: 3215553584-248080428
Opcode ID: 475178099990ac0353bf962476b95ad540ed5abada18ffefe6575b5c91291a80
Instruction ID: 2cf6766470e80decf12b4b99d91ec8454f0da475b2f9e929475d193303d2d0e6
Opcode Fuzzy Hash: 475178099990ac0353bf962476b95ad540ed5abada18ffefe6575b5c91291a80
Instruction Fuzzy Hash: 6D41D522A1875188EF51AFA198409BDA7F0BF85F88F684031EE8D17799DF3CD441C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEDF3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF0730: GetClassNameW.USER32 ref: 00007FF78EAF075B

SendMessageW.USER32 ref: 00007FF78EAEDFE3
SendMessageW.USER32 ref: 00007FF78EAEE000
SendMessageW.USER32 ref: 00007FF78EAEE036

Strings

ComboBox, xrefs: 00007FF78EAEDF5F
ListBox, xrefs: 00007FF78EAEDF9C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: ff640e8f0f1b2ddff4678b01bce3fe36037d9840c3b2af55b5fddd693c733b9a
Instruction ID: 9108063d7ea499bd7ad3909fe9ab4a602aa7f7f0e544aca5d34669d2f008216b
Opcode Fuzzy Hash: ff640e8f0f1b2ddff4678b01bce3fe36037d9840c3b2af55b5fddd693c733b9a
Instruction Fuzzy Hash: 72319032A0964282EA20FB91E4419B9F7A0FB85F84FA58131DE5D47B95CF3CE505C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC89B4 Relevance: 7.8, APIs: 5, Instructions: 265COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction ID: 77f6599cca5652ec7b984a8f2fce67fc8997f142be647935e164b03686c18917
Opcode Fuzzy Hash: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
Instruction Fuzzy Hash: 60A1E562A0978246EB61ABE09410BB9A6D1BF40FB4FA54635DA5D077C5DF3CF484C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB145A4 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32 ref: 00007FF78EB14700
#17.WSOCK32 ref: 00007FF78EB14735
WSAGetLastError.WSOCK32 ref: 00007FF78EB14744
inet_ntoa.WSOCK32 ref: 00007FF78EB147E3
htons.WSOCK32 ref: 00007FF78EB14833

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorLasthtonsinet_ntoa
String ID:
API String ID: 2227131780-0
Opcode ID: 7d4f4024c9f60fc6d0c547bc01d771306aecca345db762115638398fb3bdfb40
Instruction ID: ddd5f7d8b33ec7fee5d1d0fd1890e61dae0d35d874d5cc4f1c0ea028d9d86973
Opcode Fuzzy Hash: 7d4f4024c9f60fc6d0c547bc01d771306aecca345db762115638398fb3bdfb40
Instruction Fuzzy Hash: 0CA1D232A0864286DB20FBA6D851ABDEB91BF81FA4FA04531DE1E47795DF3CD500C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1E838 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF78EB1E8EA
OpenProcess.KERNEL32 ref: 00007FF78EB1E8FA
GetProcessIoCounters.KERNEL32 ref: 00007FF78EB1E931
CloseHandle.KERNEL32 ref: 00007FF78EB1EAEE

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: c6c8e3dea7ced7a7265ec6b0fd3e3d9db0199cdbbf202679ca2a1ea85aefeb01
Instruction ID: 4d685eba52fd1859df242d7af0510fbfa549e85557e182cef94cae406b58ebb2
Opcode Fuzzy Hash: c6c8e3dea7ced7a7265ec6b0fd3e3d9db0199cdbbf202679ca2a1ea85aefeb01
Instruction Fuzzy Hash: D0819D22B0869185EB04BFA2C454ABDBBA1BB48FD4FA54035DE1E17B96CF38D401C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB202DC Relevance: 7.7, APIs: 5, Instructions: 159registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EB21110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF78EB1FD7B), ref: 00007FF78EB21143

RegConnectRegistryW.ADVAPI32 ref: 00007FF78EB203E3
RegOpenKeyExW.ADVAPI32 ref: 00007FF78EB2043A
RegEnumValueW.ADVAPI32 ref: 00007FF78EB204A3
RegCloseKey.ADVAPI32 ref: 00007FF78EB204F4
RegCloseKey.ADVAPI32 ref: 00007FF78EB20503

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: 2df9632571d69b756c3699524fa3ecfa34112e0eb2563d100e82bb15e07072f1
Instruction ID: 4c8fabd84dd9450d910eabe8c4546eaa77f2aa874307de4446fa960fe5dbf9b0
Opcode Fuzzy Hash: 2df9632571d69b756c3699524fa3ecfa34112e0eb2563d100e82bb15e07072f1
Instruction Fuzzy Hash: 89715E32B08A9289EB10EFA5D0917BCBB70FF85B88F918131DA0D57A96CF38D505C365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABE67C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000010,-00000090,00007FF78EABEEAF), ref: 00007FF78EABE6D9
WideCharToMultiByte.KERNEL32 ref: 00007FF78EABE7B5
WriteFile.KERNEL32 ref: 00007FF78EABE7DB
WriteFile.KERNEL32 ref: 00007FF78EABE81A
GetLastError.KERNEL32 ref: 00007FF78EABE852

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction ID: 59a9bb0541caaa7f7a32db71e4af26e9288fcb4e8c8abc0d2cade55eb2e496b0
Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction Fuzzy Hash: 1C51D132A14A5189E710DFA5E484BBCBBB0FB88B98F648135DE8E47B98DF38D145C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB20084 Relevance: 7.6, APIs: 5, Instructions: 141registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EB21110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF78EB1FD7B), ref: 00007FF78EB21143

RegConnectRegistryW.ADVAPI32 ref: 00007FF78EB20189
RegOpenKeyExW.ADVAPI32 ref: 00007FF78EB201E6
RegEnumKeyExW.ADVAPI32 ref: 00007FF78EB20250
RegCloseKey.ADVAPI32 ref: 00007FF78EB2028D
RegCloseKey.ADVAPI32 ref: 00007FF78EB2029D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: cd6aad3c3a8c30d4909f65b28e82e2c944414c1da58a4a5d40bd82117204266b
Instruction ID: ae45db939f42bb86eb1874876ddb7ef8d69a30506fdd8c9413efef760889a1bd
Opcode Fuzzy Hash: cd6aad3c3a8c30d4909f65b28e82e2c944414c1da58a4a5d40bd82117204266b
Instruction Fuzzy Hash: 5161B532A08A9685EB10EBA5D4807BDBB70FF85B84FA04132EB4D07A66CF7CD545C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1D0F8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF78EB1C2BF), ref: 00007FF78EB1D176
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF78EB1C2BF), ref: 00007FF78EB1D217
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF78EB1C2BF), ref: 00007FF78EB1D236
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF78EB1C2BF), ref: 00007FF78EB1D281
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF78EB1C2BF), ref: 00007FF78EB1D2A0

Part of subcall function 00007FF78EAA4120: WideCharToMultiByte.KERNEL32 ref: 00007FF78EAA4160
Part of subcall function 00007FF78EAA4120: WideCharToMultiByte.KERNEL32 ref: 00007FF78EAA419C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: ba53198603ea7a1cc2753551fdecf120f81164c0fcf7ca152e94c049322842ea
Instruction ID: 615c3fd5d6ceee5a92048d553def28275daab2617ec93d30ccca7dde77dc7592
Opcode Fuzzy Hash: ba53198603ea7a1cc2753551fdecf120f81164c0fcf7ca152e94c049322842ea
Instruction Fuzzy Hash: 0C515836A04B5685EB00EF96D8809BCB7B4FB88F95BA64032DE5E43755DF38D441C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF670C Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF78EAF674B
VariantClear.OLEAUT32 ref: 00007FF78EAF67C5
VariantClear.OLEAUT32 ref: 00007FF78EAF6826
VariantClear.OLEAUT32 ref: 00007FF78EAF68B4
VariantChangeType.OLEAUT32 ref: 00007FF78EAF68E5

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction ID: bfe75a1cb8ace72796bc5e7c7e04b16fedf56b772f97eaf576d05c408aecd54b
Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction Fuzzy Hash: D7518433625A8492DB10DF15E084BAD73B8FB84F80F928126CB9E43B64EF39E458C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC2998 Relevance: 7.6, APIs: 5, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC29E9

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction ID: 8d88d51974ad4751c472d893f4a3dfdd5d3a845fda3bdf7f617888003225486c
Opcode Fuzzy Hash: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
Instruction Fuzzy Hash: 7D519F32608B8285EA70AF959440979FA95FF44FB0FB45231DA69077D4DF3CE491C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA81CEC Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF78EA81D1B
ScreenToClient.USER32 ref: 00007FF78EA81D3A
GetAsyncKeyState.USER32 ref: 00007FF78EA81D62
GetAsyncKeyState.USER32 ref: 00007FF78EA81D82

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction ID: 9f02dda88f660380ce01a25958d929d1a6b839f74daea994d6c0e634197706e6
Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction Fuzzy Hash: F6512436B142928BE754EF71C450A7AB7A0FF45B54F600231EA9A43BD5CF38E491C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABBA2C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF78EABBB4E

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction ID: 9ad45591bc658d3b883383021f20343f3f13eab1b87b2bfc0d3d822e483c40e4
Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction Fuzzy Hash: 2041C531F0AA4282FE15AF869814AB5E791BF84F90FA94535DD9D4B798DF3CE404C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2FF50 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF78EB2FFE7
EnableWindow.USER32 ref: 00007FF78EB30012
ShowWindow.USER32 ref: 00007FF78EB3007C
ShowWindow.USER32 ref: 00007FF78EB30098
EnableWindow.USER32 ref: 00007FF78EB300C6

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$Show$Enable
String ID:
API String ID: 2939132127-0
Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction ID: c409d4696411d3bd7ec0316188f7d8b2835c2bad6807097d715bb935cb3018fc
Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction Fuzzy Hash: 5E51613690978B82EB54DB99D445A78BBA1FB86B44FB84036CE4D17AA0CF3DE441D320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAED924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF78EAED952
PostMessageW.USER32 ref: 00007FF78EAED9F2
Sleep.KERNEL32(?,?,?,?,?,00007FF78EAED8F3), ref: 00007FF78EAED9FA
PostMessageW.USER32 ref: 00007FF78EAEDA0D
Sleep.KERNEL32(?,?,?,?,?,00007FF78EAED8F3), ref: 00007FF78EAEDA15

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: eede7ce4c4e84a454966b5ad3a71d2882c358ebf9f1b03269eaebc827b2ba57d
Instruction ID: 0f7392a22e03a4ebb03d41894f48fe15bde73c47a03523e4b116549670a03920
Opcode Fuzzy Hash: eede7ce4c4e84a454966b5ad3a71d2882c358ebf9f1b03269eaebc827b2ba57d
Instruction Fuzzy Hash: 1F31D73660864547E710DFA9E844979B791F788FA8F900135EE5D97B94CF3CE845C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF1B34 Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF78EAF1B6A
SendMessageW.USER32 ref: 00007FF78EAF1B93
SendMessageW.USER32 ref: 00007FF78EAF1BD8
CharUpperBuffW.USER32 ref: 00007FF78EAF1BFC
wcsstr.LIBVCRUNTIME ref: 00007FF78EAF1C09

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
String ID:
API String ID: 2655805287-0
Opcode ID: 4791d6a7e049e7ec9e35f4cc7525c8f63c6a15740064a3cb2c7179034048e16a
Instruction ID: 816c681085de67f57acc0dfbad1f8f1e246201cf50693348225f2f899db23643
Opcode Fuzzy Hash: 4791d6a7e049e7ec9e35f4cc7525c8f63c6a15740064a3cb2c7179034048e16a
Instruction Fuzzy Hash: 82210822B0978246EB14EB92A905A75AA90FF88FE0FA44531EE1D57B95DF3CD441C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB12E64 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF78EB12E96
GetForegroundWindow.USER32 ref: 00007FF78EB12EAF
GetDC.USER32 ref: 00007FF78EB12EF2
GetPixel.GDI32 ref: 00007FF78EB12F03
ReleaseDC.USER32 ref: 00007FF78EB12F3B

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction ID: b4d32b2fccc21191bae003aabaeb6b162e9918bb1f5432e449b44a9cf6d9294d
Opcode Fuzzy Hash: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
Instruction Fuzzy Hash: AD219F36B0865182EB04EFA6E88587DE7A1FB88F90BA84035DE0D87B95DF38D841C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA82370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32 ref: 00007FF78EA823FF
SelectObject.GDI32 ref: 00007FF78EA82412
BeginPath.GDI32 ref: 00007FF78EA8242B
SelectObject.GDI32 ref: 00007FF78EA82452

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction ID: 715e64c4446c35e28d752ec03e987eb0cd449d9a5e937d7f0dc43168b2204d06
Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction Fuzzy Hash: 03315832D19B528BE350AB85B844B39FAA1FB86B90FA4013AD94D46B50CF7CE441CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB1F44 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB1F68
CreateThread.KERNEL32 ref: 00007FF78EAB1FA9
GetLastError.KERNEL32 ref: 00007FF78EAB1FB7
CloseHandle.KERNEL32 ref: 00007FF78EAB1FD4
FreeLibrary.KERNEL32 ref: 00007FF78EAB1FE3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction ID: bcb3115e8b2e62f4a10f9a1ade1f9d53e63c9d67b5c449978c4cb07b5444b35f
Opcode Fuzzy Hash: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction Fuzzy Hash: 3B215025A0A78285EE14EFE5945087AE7D0BFD4F80FA84531EA8D43B95DF3CE400C621

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABF9D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF78EABF9FB
_set_statfp.LIBCMT ref: 00007FF78EABFA16
_set_statfp.LIBCMT ref: 00007FF78EABFA32
_set_statfp.LIBCMT ref: 00007FF78EABFA6E

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction ID: ac2a2abb63b751af49d360b9ac2fd4717afe2157016b4a06520795dc0eee3cb1
Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction Fuzzy Hash: 0D11607EE1C60305F65C31A9EC41B7595417FD5BA0FAD4238EAEE466DACF3C6440C222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAECB58 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF78EAECB8A
GetLastError.KERNEL32 ref: 00007FF78EAECB96
GetProcessHeap.KERNEL32 ref: 00007FF78EAECBA3
HeapAlloc.KERNEL32 ref: 00007FF78EAECBB2
GetTokenInformation.ADVAPI32 ref: 00007FF78EAECBD1

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction ID: f5704af6f7f9e41cde00c784b44a261e67e95a065dc8fcb10433b299b3b1d453
Opcode Fuzzy Hash: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
Instruction Fuzzy Hash: DF115E36A04B82C6E710DF92E840969BBB4FB88F80BA54436DF8947B14DF3CE815C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAECAB4 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 00007FF78EAECAE6
GetLastError.KERNEL32 ref: 00007FF78EAECAF2
GetProcessHeap.KERNEL32 ref: 00007FF78EAECAFF
HeapAlloc.KERNEL32 ref: 00007FF78EAECB0E
GetTokenInformation.ADVAPI32 ref: 00007FF78EAECB2D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction ID: d73c86816616dd50c8262453b0ab68fd8c6c2f0ab386f005f4e33a946127ffbb
Opcode Fuzzy Hash: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
Instruction Fuzzy Hash: 4E119A36604B82C6E710DF86E84096ABBB4FB88F80BA54436CF8803B24DF78E415C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF2ED0 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF78EAF2EEC
GetWindowTextW.USER32 ref: 00007FF78EAF2F07
MessageBeep.USER32 ref: 00007FF78EAF2F1C
KillTimer.USER32 ref: 00007FF78EAF2F3F
EndDialog.USER32 ref: 00007FF78EAF2F5F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction ID: 9219e72fa21287b90bf72a6a3ec325a630b596f3feef2845c106f5005a533e76
Opcode Fuzzy Hash: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
Instruction Fuzzy Hash: 9011A532A0894282EB25AFA4F444B79A7A0FF84F48FE48032D94D476D4DF7CD595C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFD7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF78EAFD811
QueryPerformanceFrequency.KERNEL32 ref: 00007FF78EAFD820
Sleep.KERNEL32 ref: 00007FF78EAFD828
QueryPerformanceCounter.KERNEL32 ref: 00007FF78EAFD833
Sleep.KERNEL32 ref: 00007FF78EAFD86E

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction ID: 526de31b972b536d31a8d73c9f630dd75acbde5646567a4ba21e40c625e31b2a
Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction Fuzzy Hash: F501D830A09A0242EB16A7B5E49593DD760BFD5B80FB40236E50F51960DF3CE4C4C660

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB00008 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF78EAE29AD,?,?,?,00007FF78EA92AB2), ref: 00007FF78EB0003C
TerminateThread.KERNEL32(?,?,?,00007FF78EAE29AD,?,?,?,00007FF78EA92AB2), ref: 00007FF78EB00047
WaitForSingleObject.KERNEL32(?,?,?,00007FF78EAE29AD,?,?,?,00007FF78EA92AB2), ref: 00007FF78EB00055
~SyncLockT.VCCORLIB ref: 00007FF78EB0005E

Part of subcall function 00007FF78EAFF7B8: CloseHandle.KERNEL32(?,?,?,00007FF78EB00063,?,?,?,00007FF78EAE29AD,?,?,?,00007FF78EA92AB2), ref: 00007FF78EAFF7C9

LeaveCriticalSection.KERNEL32(?,?,?,00007FF78EAE29AD,?,?,?,00007FF78EA92AB2), ref: 00007FF78EB0006A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
String ID:
API String ID: 3142591903-0
Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction ID: 59d0b555ecbdb3a2cabd6c2c10640d44863ba04c566e19040db0bb1e6d901192
Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction Fuzzy Hash: B101483AA08B4186E710AF95E440629B760FB88B90FA04431DB8E43B69DF3CE892C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA822E8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

EndPath.GDI32 ref: 00007FF78EA82304
StrokeAndFillPath.GDI32 ref: 00007FF78EA8231C
SelectObject.GDI32 ref: 00007FF78EA82331
DeleteObject.GDI32 ref: 00007FF78EA82346
StrokePath.GDI32 ref: 00007FF78EA82366

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction ID: 849dd4bfcaa92a4731c78a64ef24204437be2f57d8af22d69d9ed07d70c30df0
Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction Fuzzy Hash: C4015E31D08A4392F7547B94BD95B34EB62BF1AB91FB84131C82E46AA1CF7DA044C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF03F8 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF78EAF0414
GetCurrentThreadId.KERNEL32 ref: 00007FF78EAF041C
GetWindowThreadProcessId.USER32 ref: 00007FF78EAF042C
GetCurrentThreadId.KERNEL32 ref: 00007FF78EAF0434
AttachThreadInput.USER32(?,?,?,00007FF78EAEE921), ref: 00007FF78EAF0441

Part of subcall function 00007FF78EAF07A4: SendMessageTimeoutW.USER32 ref: 00007FF78EAF07CA

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction ID: cce1b3dc4b1d1b69a1265290c9a5f9ae688bfb45e7eb5d66f2caa5d7efe9d085
Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction Fuzzy Hash: C4F03024F1960282FF2437F668CAA7497917F89B46FE45031CC0A02691DF3D9895C661

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB05F2C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA856D4: GetFullPathNameW.KERNEL32(?,00007FF78EA856C1,?,00007FF78EA87A0C,?,?,?,00007FF78EA8109E), ref: 00007FF78EA856FF

CoInitialize.OLE32 ref: 00007FF78EB060A2
CoCreateInstance.OLE32 ref: 00007FF78EB060C5
CoUninitialize.OLE32 ref: 00007FF78EB060E3

Strings

.lnk, xrefs: 00007FF78EB05F94, 00007FF78EB05FE3, 00007FF78EB06090

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize
String ID: .lnk
API String ID: 3769357847-24824748
Opcode ID: 4fdeb1db9959f65fc74ea48eff23697b1a3a9072be6150b8faa5cdb13eaf19fd
Instruction ID: 4cc704874c1b911c10c20f5bdaaace72e7b871d1c8aa37cfcf4c7335a712dc98
Opcode Fuzzy Hash: 4fdeb1db9959f65fc74ea48eff23697b1a3a9072be6150b8faa5cdb13eaf19fd
Instruction Fuzzy Hash: A7D15A36B04A5685EB10EFA6C090ABD7BB0FB48F88BA44032DE5D47B59DF39E945C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC0040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAC02E4

Strings

UTF-16LEUNICODE, xrefs: 00007FF78EAC028B
ccs, xrefs: 00007FF78EAC0229
UTF-8, xrefs: 00007FF78EAC0268

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 77144706097a283061aa6841737fd5fc45152d0aa2c4d7c8d9b1e627f9bd4a8a
Instruction ID: 676d2a6b85637bd6f5e735a8590b2f951d1f6bf713790a7457e9d4f56ea38ea4
Opcode Fuzzy Hash: 77144706097a283061aa6841737fd5fc45152d0aa2c4d7c8d9b1e627f9bd4a8a
Instruction Fuzzy Hash: E181C072E0C30285FB656F9595C4A7DE6A0BF12F64FA58031CB1E57780DB3DA890D223

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB6148 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF78EAB6202

Strings

acos, xrefs: 00007FF78EAB6215
!, xrefs: 00007FF78EAB6237

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction ID: 4642cd233cee9c758fdbc6562c9747b59f14afa566e3d92513da56d663cf3c9b
Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction Fuzzy Hash: 2D61C931D28F4584E2239BB46811676DB58BFD67D0F618336E95E35D64DF3CE042CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB6408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF78EAB64BA

Strings

asin, xrefs: 00007FF78EAB64CD
!, xrefs: 00007FF78EAB64EF

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _set_statfp
String ID: !$asin
API String ID: 1156100317-2188059690
Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction ID: 675fe4d09db2bebb3309f05106c773c8a048da5ab6018ed325bdb99a519e2224
Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction Fuzzy Hash: 4861A722D28F8185E2539BB46812776DB58BFD63D1F608332E95E35A65DF3CB082CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEEAC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF96AC: WriteProcessMemory.KERNEL32 ref: 00007FF78EAF96F7

SendMessageW.USER32 ref: 00007FF78EAEEB35

Part of subcall function 00007FF78EAF9660: ReadProcessMemory.KERNEL32 ref: 00007FF78EAF969E

Part of subcall function 00007FF78EAF9560: GetWindowThreadProcessId.USER32 ref: 00007FF78EAF95A4
Part of subcall function 00007FF78EAF9560: OpenProcess.KERNEL32(?,?,?,?,00000000,00007FF78EAEE40A), ref: 00007FF78EAF95B6
Part of subcall function 00007FF78EAF9560: VirtualAllocEx.KERNEL32 ref: 00007FF78EAF95DC

SendMessageW.USER32 ref: 00007FF78EAEEBBD
SendMessageW.USER32 ref: 00007FF78EAEEC17

Strings

@, xrefs: 00007FF78EAEEC32

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction ID: 724c8060b49779b66d019384393b3ac974164a0d9d0318df2341915c4ad5c0a9
Opcode Fuzzy Hash: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
Instruction Fuzzy Hash: 1451DF3661868182D720EB92E8819BEFB60F7C8B84F914032EE4D53B49DF7CE505CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFA6BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF78EAFA74D
DeleteMenu.USER32 ref: 00007FF78EAFA799
DeleteMenu.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF78EAFA7E6

Strings

P, xrefs: 00007FF78EAFA722

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: P
API String ID: 135850232-3110715001
Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction ID: 876510b50fa65ead16ab5c4ad2ac642b571f8e91bd1069bd68e9bb5f7bd6961c
Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction Fuzzy Hash: 6E41C232A04A8181EB60EF55C444BF9A7A0FB84FA0FA68232DA6D477D1DF38D542C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABEAA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000010,00000010,00000000,00000010,00007FF78EABEF05), ref: 00007FF78EABEB8E
WriteFile.KERNEL32 ref: 00007FF78EABEBC1
GetLastError.KERNEL32 ref: 00007FF78EABEBE3

Strings

U, xrefs: 00007FF78EABEB6C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction ID: ae2084d099a86e386bcbbb2d5e0cd95619fe6b45d0f07119c27cb7d24f1a7e29
Opcode Fuzzy Hash: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
Instruction Fuzzy Hash: C241D532B19A4582DB209F95E4457BAF7A0FB88B94F908032EE8E87798DF3CD441C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2AB9C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA8932C: CreateWindowExW.USER32 ref: 00007FF78EA893BC
Part of subcall function 00007FF78EA8932C: GetStockObject.GDI32 ref: 00007FF78EA893D9
Part of subcall function 00007FF78EA8932C: SendMessageW.USER32 ref: 00007FF78EA893EC

SendMessageW.USER32 ref: 00007FF78EB2AC80
SetWindowPos.USER32 ref: 00007FF78EB2ACA9
SendMessageW.USER32 ref: 00007FF78EB2ACE0

Strings

SysMonthCal32, xrefs: 00007FF78EB2ABE3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStock
String ID: SysMonthCal32
API String ID: 2671490118-1439706946
Opcode ID: a35748cbb4f7d20bc5763ff5a18e4d80cc8b65d6717278039b9a5fd016896ec3
Instruction ID: 8773a50c89dab64fe96db401f985bba2d5d7e72496b17082b51c5ec50d3d049f
Opcode Fuzzy Hash: a35748cbb4f7d20bc5763ff5a18e4d80cc8b65d6717278039b9a5fd016896ec3
Instruction Fuzzy Hash: 83415E326086C287E770DF55E444B9AFBA1FB88790F504235EA9953A99DF3CD485CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2B798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA8932C: CreateWindowExW.USER32 ref: 00007FF78EA893BC
Part of subcall function 00007FF78EA8932C: GetStockObject.GDI32 ref: 00007FF78EA893D9
Part of subcall function 00007FF78EA8932C: SendMessageW.USER32 ref: 00007FF78EA893EC

SendMessageW.USER32 ref: 00007FF78EB2B8B1
SendMessageW.USER32 ref: 00007FF78EB2B8C9
DestroyWindow.USER32 ref: 00007FF78EB2B8D6

Strings

msctls_updown32, xrefs: 00007FF78EB2B7E3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyObjectStock
String ID: msctls_updown32
API String ID: 1752125012-2298589950
Opcode ID: 3ad8a05af1a04f4639f3558a706eda2379b4f54061b6a2bc35ec0bb5bf7c66ed
Instruction ID: 0cae47505bf994ffcf7aaebe91b57dffd85b707e07034b5cef254ed5fd94e753
Opcode Fuzzy Hash: 3ad8a05af1a04f4639f3558a706eda2379b4f54061b6a2bc35ec0bb5bf7c66ed
Instruction Fuzzy Hash: 8231E532A18B8582EB60DF55E480BAAB760FBC5B91FA08136DA8D47B58CF3CD444CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2A1F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA8932C: CreateWindowExW.USER32 ref: 00007FF78EA893BC
Part of subcall function 00007FF78EA8932C: GetStockObject.GDI32 ref: 00007FF78EA893D9
Part of subcall function 00007FF78EA8932C: SendMessageW.USER32 ref: 00007FF78EA893EC

SendMessageW.USER32 ref: 00007FF78EB2A2E4
SendMessageW.USER32 ref: 00007FF78EB2A2F8
MoveWindow.USER32 ref: 00007FF78EB2A328

Strings

Listbox, xrefs: 00007FF78EB2A23D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$Window$CreateMoveObjectStock
String ID: Listbox
API String ID: 3747482310-2633736733
Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction ID: 4d4bbd4ded95c3db3ba36287ee1e39f43b2fd857e06187bc02ac39d7dfc18d57
Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction Fuzzy Hash: 5D313C366097C186E770DF55B444B5ABBA1F7887A0F608235EAA913B98CB3DD485CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB04DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF78EB04E29
GetVolumeInformationW.KERNEL32 ref: 00007FF78EB04E9F
SetErrorMode.KERNEL32 ref: 00007FF78EB04F0E

Strings

%lu, xrefs: 00007FF78EB04EB0

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 1d2d9ec70042b180fc7aee4065bf2b0cf31a7f0658b1f1c5aeac4af0ce1da44c
Instruction ID: db34cb4e2f8e56fdfedbd2ace9b3a10629b4a0c0a66bed101ecb805f6eca9322
Opcode Fuzzy Hash: 1d2d9ec70042b180fc7aee4065bf2b0cf31a7f0658b1f1c5aeac4af0ce1da44c
Instruction Fuzzy Hash: 87316D72608B8685DB10EB56E48097DB7A1FB89B80FA04031EA8D47B65CF3CD595C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2B104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA8932C: CreateWindowExW.USER32 ref: 00007FF78EA893BC
Part of subcall function 00007FF78EA8932C: GetStockObject.GDI32 ref: 00007FF78EA893D9
Part of subcall function 00007FF78EA8932C: SendMessageW.USER32 ref: 00007FF78EA893EC

SendMessageW.USER32 ref: 00007FF78EB2B1BE
SendMessageW.USER32 ref: 00007FF78EB2B1DA
SendMessageW.USER32 ref: 00007FF78EB2B1EF

Strings

msctls_trackbar32, xrefs: 00007FF78EB2B14B

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: msctls_trackbar32
API String ID: 1025951953-1010561917
Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction ID: 5b6961780f9a13d6f3920a92f95ed9f704e66ba50dc40ae16a11ff8909e5c0ca
Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction Fuzzy Hash: C9313632A1878187E7609F55E444F5ABBA1FB88B90F604239EB9813B58CF3CE841CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAA8782 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAA7130: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF78EAA7134

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF78EAA87AA
RaiseException.KERNEL32 ref: 00007FF78EAA87D3
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF78EAA8834

Strings

csm, xrefs: 00007FF78EAA8807

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction ID: a007474161232c3e688e5445d59a02e4c81dcc2ecc81353514422e99bdb2d47d
Opcode Fuzzy Hash: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction Fuzzy Hash: 9A212F3660874182E670EF52E44497EB7A5F789FA4F900225DE9D03795CF3CE886CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFC110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF78EAFC14F
DeviceIoControl.KERNEL32 ref: 00007FF78EAFC1CB
CloseHandle.KERNEL32 ref: 00007FF78EAFC1D6

Strings

0, xrefs: 00007FF78EAFC1AC

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0
API String ID: 33631002-4108050209
Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction ID: f7fc7f0b94e880df4c7cd909cd254c25c3933a4197f60fb5d961ddfa53696faf
Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction Fuzzy Hash: FF218632618780D6D3209F51E484A9AB7B4F784B94F644236DB9D03F94DF3DD555CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB210C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF78EB1FCA6), ref: 00007FF78EB210DF
GetProcAddress.KERNEL32(?,?,?,00007FF78EB1FCA6), ref: 00007FF78EB210F7

Strings

advapi32.dll, xrefs: 00007FF78EB210D8
RegDeleteKeyExW, xrefs: 00007FF78EB210ED

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction ID: ea49ba3ab1dfd860ae68b34f14c46130f277a3b1dbd3e7df5cfa30bb9fe7c7ad
Opcode Fuzzy Hash: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction Fuzzy Hash: EAE0ED61A06B0681EF14AB90E416768A7E4FF08B55FA40435CD1E86350EF7CD995C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA86D1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF78EA86D33
GetProcAddress.KERNEL32 ref: 00007FF78EA86D4B

Strings

Wow64RevertWow64FsRedirection, xrefs: 00007FF78EA86D41
kernel32.dll, xrefs: 00007FF78EA86D2C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction ID: 6b7b57208b5a345374a04669887c5cdaeeca35e02a1ac588441c3f007a7cde5b
Opcode Fuzzy Hash: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
Instruction Fuzzy Hash: 09E0ED31906F0682EF16AB90E4197B4A7E4FF48B48FA40434C92D46768EFBCD594C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EA86D64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF78EA86490), ref: 00007FF78EA86D7B
GetProcAddress.KERNEL32(?,?,?,00007FF78EA86490), ref: 00007FF78EA86D93

Strings

kernel32.dll, xrefs: 00007FF78EA86D74
Wow64DisableWow64FsRedirection, xrefs: 00007FF78EA86D89

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction ID: 84fcbd7b4ec86efcd8aac550e85fb4bf7dddc0f1786bbe84a7b5110bc3eaf8ed
Opcode Fuzzy Hash: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
Instruction Fuzzy Hash: 6FE0ED31906F0681EF15AB91E415774A7E4FF48B48FA40435C92D46354EF7CE595C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB179D8 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF78EB17A72

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 7524d7e2d52d05920338dceab766341373bac426c68e9c37cb254224bebc0e48
Instruction ID: c8f7d6197321397c82c9133c6173205d3b5ccaac7d88ef5834b8ec121eb666d5
Opcode Fuzzy Hash: 7524d7e2d52d05920338dceab766341373bac426c68e9c37cb254224bebc0e48
Instruction Fuzzy Hash: 63D18976B09B419AEB50EFA5D4805ECB7B1FB44B88B900036DE0D57BA9DF38E519C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB1EB34 Relevance: 6.2, APIs: 4, Instructions: 156processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF78EB1EB92
Process32FirstW.KERNEL32 ref: 00007FF78EB1EBA2
Process32NextW.KERNEL32 ref: 00007FF78EB1EC9D
CloseHandle.KERNEL32 ref: 00007FF78EB1ECAE

Part of subcall function 00007FF78EAA1AD0: CompareStringW.KERNEL32 ref: 00007FF78EAA1B1F

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32
String ID:
API String ID: 2000298826-0
Opcode ID: 46ffc974d03c74fe675a359457ba7bbb3a6c384647595a219b83fce263b46345
Instruction ID: 31a839437bfe41541dc4933a5e3731acbd709352d727205388a4f77f86eb39f8
Opcode Fuzzy Hash: 46ffc974d03c74fe675a359457ba7bbb3a6c384647595a219b83fce263b46345
Instruction Fuzzy Hash: B9718036A18B4186E700EB61E444BAEB7B1FB88B88F904132EE4D07B69DF7CD545C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFBAB8 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF78EAFBB6F
GetLastError.KERNEL32 ref: 00007FF78EAFBB7E
CreateDirectoryW.KERNEL32 ref: 00007FF78EAFBB8E
CreateDirectoryW.KERNEL32 ref: 00007FF78EAFBC27

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 9a50aa74d2559c0d1d2fc8bb5d1523606716f977cfdc5cafbc327c2c6a102045
Instruction ID: 2f6c8d5c8562766919d051fdd1c18f5e2938e2e7387c2246146c354e55ed381b
Opcode Fuzzy Hash: 9a50aa74d2559c0d1d2fc8bb5d1523606716f977cfdc5cafbc327c2c6a102045
Instruction Fuzzy Hash: FA51AE32B05A1185EF50AFA2D8409BDA7B5BB48F94BA44136DE0D57BA8DF3CD942C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB143C8 Relevance: 6.1, APIs: 4, Instructions: 126networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF78EB14414
WSAGetLastError.WSOCK32 ref: 00007FF78EB14423
#21.WSOCK32 ref: 00007FF78EB144AD
WSAGetLastError.WSOCK32 ref: 00007FF78EB144B7

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction ID: ae684e0f13cbc9e9d194713d102874f95e0cc79c41ea64562b2c3675d97c3cd7
Opcode Fuzzy Hash: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction Fuzzy Hash: D241C12170869286DB10BFA2E441A7DEB91BB85FE0FA44534DE2E4BBA6CF3CD001C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB05DA4 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32 ref: 00007FF78EB05E75
GetLastError.KERNEL32 ref: 00007FF78EB05E98
DeleteFileW.KERNEL32 ref: 00007FF78EB05EC1
CreateHardLinkW.KERNEL32 ref: 00007FF78EB05EFA

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 328523951a9f40cbbb3ace38589825012ca206b81047daa6fbc9b46e9d48e72f
Instruction ID: 3257778d803950846ea1a22eea8ef8bee9b0c39c52e19fd66acbb165bf7349ef
Opcode Fuzzy Hash: 328523951a9f40cbbb3ace38589825012ca206b81047daa6fbc9b46e9d48e72f
Instruction Fuzzy Hash: B841D866A04B5681DB14EF66D49186DB7A0FB88FD0B989432DF8E47B66CF3CE440C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2F014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32 ref: 00007FF78EB2F054
GetWindowRect.USER32 ref: 00007FF78EB2F0E3
PtInRect.USER32 ref: 00007FF78EB2F0F3
MessageBeep.USER32(?,?,?,?,00007FF78EB30BC9), ref: 00007FF78EB2F165

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction ID: ee658bfadc04406be9d5ca1eb58d3d3758b6cfe37aee0cffbfdd9c696db59a3b
Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction Fuzzy Hash: D3419232A08B9686EA10AF99D884979BBA0FF44B95FF54136CE1DA3764DF3CE441D310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2AA04 Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF78EB2AAF2
IsMenu.USER32 ref: 00007FF78EB2AB10
InsertMenuItemW.USER32 ref: 00007FF78EB2AB61
DrawMenuBar.USER32 ref: 00007FF78EB2AB76

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID:
API String ID: 3076010158-0
Opcode ID: dc6c68aad8de4ec1ea0eac338f153197ea768d30efaa3fb996dae5153308a6de
Instruction ID: 686c70942652bac1273bdb536475ea617cecc60348c1df23fd7c8bab6ce63126
Opcode Fuzzy Hash: dc6c68aad8de4ec1ea0eac338f153197ea768d30efaa3fb996dae5153308a6de
Instruction Fuzzy Hash: 0341AC36B00B818AEB20DFA6D444AADBBA1FB48B94FA44136CE0D13B54CF39E845C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABC72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EABC77F
WideCharToMultiByte.KERNEL32 ref: 00007FF78EABC851
GetLastError.KERNEL32 ref: 00007FF78EABC874
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EABC8A6

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction ID: 7f8f2778b1a7d9dddd715c6f3c0ba588ed06cd20c439bc5953809782b4772503
Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction Fuzzy Hash: 18418D32A0874256EB61AB919044F79E291BFC0F90FB44530DA8906A95DF3CD881CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF8B38 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF78EAF8B98
SetKeyboardState.USER32 ref: 00007FF78EAF8BB0
PostMessageW.USER32 ref: 00007FF78EAF8C21
SendInput.USER32 ref: 00007FF78EAF8C80

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction ID: 7537667ac629fbfb1f56385c3a7c06ec7b059b4d46ec687fa484a2c685a108ab
Opcode Fuzzy Hash: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
Instruction Fuzzy Hash: CF410AB1A1D68241F730EB61D410E79AAA0FB44F94FF41532EA9A136D5CF3CD582C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2C580 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,?,00007FF78EACDF79), ref: 00007FF78EB2C630
GetWindowLongW.USER32 ref: 00007FF78EB2C658
SetWindowLongPtrW.USER32 ref: 00007FF78EB2C66D
InvalidateRect.USER32(?,00000000,?,00007FF78EACDF79), ref: 00007FF78EB2C6A4

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction ID: 5c3cc9ae131e6727a930d8dfe9e4a57b53aa9f82dbf219216391805545e0a658
Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction Fuzzy Hash: 51418D31A4858696FB65AAD4C401AB8AB60FF84B94FB85132CA0D036D5CF7CEC81CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF8CAC Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF78EAF8D11
SetKeyboardState.USER32 ref: 00007FF78EAF8D29
PostMessageW.USER32 ref: 00007FF78EAF8D89
SendInput.USER32 ref: 00007FF78EAF8DEC

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction ID: 2d77a1caa14456c89f6e656daf16ed19a0fdfc6896d72033382412bdeda1a755
Opcode Fuzzy Hash: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
Instruction Fuzzy Hash: EE31C331A0878146EB70AB659400FB9ABA4FF54F94FA50232DA99137D5CF3CD551C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB0D7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF78EB0D843

Part of subcall function 00007FF78EB0D914: InternetOpenUrlW.WININET ref: 00007FF78EB0D954
Part of subcall function 00007FF78EB0D914: InternetCloseHandle.WININET ref: 00007FF78EB0DA38

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 589cd8c68b57d7423dd74b1edc4dd3949ed0ac3f90bc7328400ab694d8be37aa
Instruction ID: 341bdd84f92e13b9210d4aab19607e11511f86db1f6f415da2dd465913cef205
Opcode Fuzzy Hash: 589cd8c68b57d7423dd74b1edc4dd3949ed0ac3f90bc7328400ab694d8be37aa
Instruction Fuzzy Hash: 2F318036A0978283EB25EB56E050F79AB60FB89B94F644135DA4D07B84DF3CE054CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAC3D98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF78EABA27B,?,?,?,00007FF78EABA236), ref: 00007FF78EAC3DB1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF78EABA27B,?,?,?,00007FF78EABA236), ref: 00007FF78EAC3E13
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF78EABA27B,?,?,?,00007FF78EABA236), ref: 00007FF78EAC3E4D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF78EABA27B,?,?,?,00007FF78EABA236), ref: 00007FF78EAC3E77

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction ID: b5c3f4d941163bb96de59d2e681d7c859ed83d06d5f244c5e77e95593f59eca4
Opcode Fuzzy Hash: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction Fuzzy Hash: 0F21B135B1979181E620AF526400439F6E5FF94FE0BA84174DE8E23B94DF3CE496D311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB3108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82A54: GetWindowLongPtrW.USER32 ref: 00007FF78EA82A71

GetCursorPos.USER32 ref: 00007FF78EB310E1
TrackPopupMenuEx.USER32 ref: 00007FF78EB31105
GetCursorPos.USER32(?,?,00000000,?,?,00007FF78EACAB30,?,?,?,?,?,?,?,?,?,00007FF78EA827AF), ref: 00007FF78EB3114C
DefDlgProcW.USER32(?,?,00000000,?,?,00007FF78EACAB30,?,?,?,?,?,?,?,?,?,00007FF78EA827AF), ref: 00007FF78EB31190

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction ID: e4803aff5fbb5cf4b962ba074c405ec2c67e6f1deab48fbbba379c55b84f42ac
Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction Fuzzy Hash: 41318036A08A4582EB10EF56E455BB9EBA4FB84F94FA40132DA8D43F65CF3CD845C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF50E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF691C: lstrlenW.KERNEL32 ref: 00007FF78EAF6944
Part of subcall function 00007FF78EAF691C: lstrcpyW.KERNEL32 ref: 00007FF78EAF6973
Part of subcall function 00007FF78EAF691C: lstrcmpiW.KERNEL32 ref: 00007FF78EAF69AD

lstrlenW.KERNEL32 ref: 00007FF78EAF5127
lstrcpyW.KERNEL32 ref: 00007FF78EAF515A
lstrcmpiW.KERNEL32 ref: 00007FF78EAF519C

Strings

cdecl, xrefs: 00007FF78EAF5191

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: b1a8f7825b1da29788af026b5061c681ca54c64004f31bc8b54455b05eabb44f
Instruction ID: cd44f5470e06518d4d84f35a2c07034f618044d30d282d644ed291f662adef30
Opcode Fuzzy Hash: b1a8f7825b1da29788af026b5061c681ca54c64004f31bc8b54455b05eabb44f
Instruction Fuzzy Hash: ED21BF2160434285EB14BF92A854678B7A2FF88FD0BA85135EB5E47790EF3DE840C315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB32264 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82A54: GetWindowLongPtrW.USER32 ref: 00007FF78EA82A71

GetClientRect.USER32 ref: 00007FF78EB322C4
GetCursorPos.USER32(?,?,?,?,?,00007FF78EACAA36,?,?,?,?,?,?,?,?,?,00007FF78EA827AF), ref: 00007FF78EB322CF
ScreenToClient.USER32 ref: 00007FF78EB322DD
DefDlgProcW.USER32(?,?,?,?,?,00007FF78EACAA36,?,?,?,?,?,?,?,?,?,00007FF78EA827AF), ref: 00007FF78EB3231F

Part of subcall function 00007FF78EB2E894: LoadCursorW.USER32 ref: 00007FF78EB2E945

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClientCursor$LoadLongProcRectScreenWindow
String ID:
API String ID: 1626762757-0
Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction ID: 5d75dd71e929c081de0a09467232952c40910a7b6140488f317a97211845fb8a
Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction Fuzzy Hash: D2214136A0864286EB24EB85F981969FBA0FB85F84FA44131DB4D47F55CF3CE945C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAB2FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF78EAB2FE5
_ctrlfp.LIBCMT ref: 00007FF78EAB3039
_ctrlfp.LIBCMT ref: 00007FF78EAB304D
_ctrlfp.LIBCMT ref: 00007FF78EAB3071

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _ctrlfp
String ID:
API String ID: 697997973-0
Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction ID: 8572cd5765e64ad36a8c05119a2dc9f61378c711bdd372269c395e9f2e12026f
Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction Fuzzy Hash: 3D11F629D0C54282E210AA78948147BE671FFDBB80FB54230FBC94A6A9DF3DD480CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAFCF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF78EAFCFA7

Part of subcall function 00007FF78EAB1F44: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78EAB1F68

MessageBoxW.USER32 ref: 00007FF78EAFCFEA
WaitForSingleObject.KERNEL32 ref: 00007FF78EAFD004
CloseHandle.KERNEL32 ref: 00007FF78EAFD00D

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
String ID:
API String ID: 2979156933-0
Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction ID: 284a3bc223e7a93f25eba1046cd69d9f9ee9d81c87961c83b93aa8e5d72ae7fd
Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction Fuzzy Hash: 4E213532A0878186E310EFA6BC4166AFAE1FB84BD0F944136EA8D43B64CF3CD445C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2FA78 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF78EB2FAA8
ScreenToClient.USER32 ref: 00007FF78EB2FAC1
ScreenToClient.USER32 ref: 00007FF78EB2FAE6
InvalidateRect.USER32 ref: 00007FF78EB2FB02

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction ID: 5d9f19eed123bebd1c0b01d349b84b4ac67b7e12d1c22a00d85c8f1f94889a5f
Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction Fuzzy Hash: 5F21D8B6A04745DFEB00DFB4E88499C7BF0F748B48B504826EA5893B18DB78D654CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF4B28 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF78EAF4B47
LoadTypeLib.OLEAUT32 ref: 00007FF78EAF4B62
RegisterTypeLib.OLEAUT32 ref: 00007FF78EAF4B77
RegisterTypeLibForUser.OLEAUT32 ref: 00007FF78EAF4B95

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction ID: 585fffee1cf8a04a970940504e05e90d24fad1493686b65bc6c7de33fc1c12e8
Opcode Fuzzy Hash: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
Instruction Fuzzy Hash: 7E11917270864282E720AF64E084B79A7A0FB88F88FE44036CB4D9BA45CF7CD544CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB3072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA82370: ExtCreatePen.GDI32 ref: 00007FF78EA823FF
Part of subcall function 00007FF78EA82370: SelectObject.GDI32 ref: 00007FF78EA82412
Part of subcall function 00007FF78EA82370: BeginPath.GDI32 ref: 00007FF78EA8242B
Part of subcall function 00007FF78EA82370: SelectObject.GDI32 ref: 00007FF78EA82452

MoveToEx.GDI32 ref: 00007FF78EB30771
LineTo.GDI32 ref: 00007FF78EB30783
EndPath.GDI32 ref: 00007FF78EB30795
StrokePath.GDI32 ref: 00007FF78EB307A5

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction ID: 8a8863604c1297b83ad422eaba2f1af7be8a8cf2e3d2bf14114e1d6227045dd9
Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction Fuzzy Hash: 9801B535A2879183E7005B59B80AB29EFA1BF82B94FA80134DF5903FA1CF7DE441CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABCC78 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EABCCDC

Strings

gfffffff, xrefs: 00007FF78EABCF6A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction ID: b967afcdf7a2856da98615aa26b754e546379fe353bcce9906480726b60ffe74
Opcode Fuzzy Hash: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
Instruction Fuzzy Hash: C2917862B0938A86EB21AF659140BB8AB95BBA1FC0F648531DBCD47391DF3CE111C312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAF1D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32 ref: 00007FF78EAF1F50

Strings

Container, xrefs: 00007FF78EAF1E83
AutoIt3GUI, xrefs: 00007FF78EAF1E7C

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 4d86e30d5d9a21d2b6456c95e62a2a573c83de09a7ab637991307d14889fe5ee
Instruction ID: 3064280bb9a007362a4aa29ca0a6a2bd201db8432f44341a99bafb9d9f548795
Opcode Fuzzy Hash: 4d86e30d5d9a21d2b6456c95e62a2a573c83de09a7ab637991307d14889fe5ee
Instruction Fuzzy Hash: 82914932604B4281DB14EF69E480AADB7A5FB88F94FA18136DF8D43715DF39D845C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABD0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EABD0EB

Strings

e+000, xrefs: 00007FF78EABD193
gfff, xrefs: 00007FF78EABD216

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction ID: 03fd365873481c6054fe0b91e3cf1cfc0c54979e5196674b8e291c8fe4dc0bf2
Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction Fuzzy Hash: 7D511462B187C146E7259A75A941B79AA91FB81F90F988231C69987AD6CF3CD040C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABA09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78EABA0C6
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF78EAA529A), ref: 00007FF78EABA0E2

Strings

C:\Users\user\Desktop\ocs-office.exe, xrefs: 00007FF78EABA0D0

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\ocs-office.exe
API String ID: 3307058713-1717753346
Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction ID: eb5874096174e918d15cd2e49593692e0dc5cef1b0629b368d983bddbbd1833f
Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction Fuzzy Hash: E2419032A08B5289E754AFA1E8408B9A7A5FF84BD0BA44431E98E47B55DF3DE481C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB29E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA8932C: CreateWindowExW.USER32 ref: 00007FF78EA893BC
Part of subcall function 00007FF78EA8932C: GetStockObject.GDI32 ref: 00007FF78EA893D9
Part of subcall function 00007FF78EA8932C: SendMessageW.USER32 ref: 00007FF78EA893EC

DestroyWindow.USER32 ref: 00007FF78EB29F43

Strings

static, xrefs: 00007FF78EB29E54

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$CreateDestroyMessageObjectSendStock
String ID: static
API String ID: 3467290483-2160076837
Opcode ID: 51e36b6c54ad91b2f3bc3c79a4a5b84972d833c13ef2b788b84b8940173b306d
Instruction ID: 4878aff99b3b6b6fcec14aef9bad2aa45d299b14f5e923e6ac87ce6c8073bbf5
Opcode Fuzzy Hash: 51e36b6c54ad91b2f3bc3c79a4a5b84972d833c13ef2b788b84b8940173b306d
Instruction Fuzzy Hash: 52410D325086C286D670AF65E440BAFB7A1FB84791F604235EBED03A99DB3CE485CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB15E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EB161CC: WideCharToMultiByte.KERNEL32 ref: 00007FF78EB1620C

inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF78EB137FB), ref: 00007FF78EB15E4D
htons.WSOCK32(?,?,?,?,?,?,?,00007FF78EB137FB), ref: 00007FF78EB15EDB

Strings

255.255.255.255, xrefs: 00007FF78EB15E6A

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 2d101bd9dfb627ac808c5d84433716e1dc37b63231176999d8b08aaa7ca37302
Instruction ID: df5931e7984db776a1964a62dc3044e63283f490ee97fd9ab845fe8df5b15be8
Opcode Fuzzy Hash: 2d101bd9dfb627ac808c5d84433716e1dc37b63231176999d8b08aaa7ca37302
Instruction Fuzzy Hash: AF31DE32A0965281EB10EBA2E841A7CBBA1FF54FA4FA58531DE5E43391DF3CD446C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB103C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF78EB1045A

Strings

AUTOITCALLVARIABLE%d, xrefs: 00007FF78EB1044A
, $, xrefs: 00007FF78EB10495

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3988819677-2584243854
Opcode ID: 9f22cad88255bf2fcf281287ddd6c52f1c7a7d00ac6447b17437cda3d472c94d
Instruction ID: d4ba7ac661b5df7804be68f762c35d7ce099292d406485fac269063678a2d949
Opcode Fuzzy Hash: 9f22cad88255bf2fcf281287ddd6c52f1c7a7d00ac6447b17437cda3d472c94d
Instruction Fuzzy Hash: 72316F76B08B0295EB10EBA1E4919BC7771FB45B84BA14032DE1D57B69CF3CE90AC360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABDC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF78EABDCA2
GetFileType.KERNEL32 ref: 00007FF78EABDCB8

Strings

@, xrefs: 00007FF78EABDCE3

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction ID: b292c93fcb4a3a218555792cf35d4263c648be99ebbdd8e6351dd9976cf92dc0
Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction Fuzzy Hash: AA21C522A18A4281EB649B759490539AA50FFC6B74F781335D6EE077D4CF3CD881D362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2A0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EA8932C: CreateWindowExW.USER32 ref: 00007FF78EA893BC
Part of subcall function 00007FF78EA8932C: GetStockObject.GDI32 ref: 00007FF78EA893D9
Part of subcall function 00007FF78EA8932C: SendMessageW.USER32 ref: 00007FF78EA893EC

GetWindowRect.USER32 ref: 00007FF78EB2A18B
GetSysColor.USER32 ref: 00007FF78EB2A1B2

Strings

static, xrefs: 00007FF78EB2A10B

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction ID: 3b057b6db7256ec384996d7b313d2b8b4f550d9eefb65e17e2e5ba0fbec80d4c
Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction Fuzzy Hash: B5313C32A087C18BD324DF69E440B5ABBA1F788750F504239DB9953B98DB38E441CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB29BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF78EB29CB6
SendMessageW.USER32 ref: 00007FF78EB29CCA

Strings

edit, xrefs: 00007FF78EB29C24

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction ID: 302f123f6065cdd31e0a5e12489c545ae35c654c987fb49160b203950c78ab44
Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction Fuzzy Hash: 12312D36A087C1CAE770DB55E444B5AB7A1FB84790F644235EAAC43B98DB3CD841CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EABFD90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF78EABFEA2

Strings

", xrefs: 00007FF78EABFE7B
pow, xrefs: 00007FF78EABFE91

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction ID: f304219bdd5c5b4574a75506a8747aee2bc3ef15d7aab1bc19a7193c7a8fad40
Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction Fuzzy Hash: 90219C76C1CAC487E370DF50E840A7AEAA0FBDA744F641326F2C946A55CBBDD081CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEDDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF0730: GetClassNameW.USER32 ref: 00007FF78EAF075B

SendMessageW.USER32 ref: 00007FF78EAEDE7F

Strings

ComboBox, xrefs: 00007FF78EAEDE0B
ListBox, xrefs: 00007FF78EAEDE42

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: d7f563d908b7ab0e139775c10ea95422d2fbe172cfe8d6c3fca552207e27f14c
Instruction ID: 40c08bc0812d7592fdba11de8207bb4c57f1f0c8152224c9992d39cacb153b93
Opcode Fuzzy Hash: d7f563d908b7ab0e139775c10ea95422d2fbe172cfe8d6c3fca552207e27f14c
Instruction Fuzzy Hash: 8611D332A08A8291E610EB61D5444F9A3A1FB99FA0FE44271DAAC437DADF3CE505CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEDD48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF0730: GetClassNameW.USER32 ref: 00007FF78EAF075B

SendMessageW.USER32 ref: 00007FF78EAEDDCE

Strings

ComboBox, xrefs: 00007FF78EAEDD5D
ListBox, xrefs: 00007FF78EAEDD92

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 4818382d5386dae1fce8f10ecd247d8033a66d44d18a664d9e28551785c1ee4d
Instruction ID: 517eb8caa56fc1a15cddfce5f6c71454b408713ac16972da0af22f498ed0c745
Opcode Fuzzy Hash: 4818382d5386dae1fce8f10ecd247d8033a66d44d18a664d9e28551785c1ee4d
Instruction Fuzzy Hash: 1511A721E0D68691EE10E750E5909F9A350FF85B84FE44131D98D03B8ADF3CE605CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEDCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF0730: GetClassNameW.USER32 ref: 00007FF78EAF075B

SendMessageW.USER32 ref: 00007FF78EAEDD26

Strings

ComboBox, xrefs: 00007FF78EAEDCB5
ListBox, xrefs: 00007FF78EAEDCEA

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 30c2cbca8ddea967e868705950fd5399c79b102bd344a556156e5ab8739dea70
Instruction ID: ff0df7a965f02d2b0d756c899384734e32fccc72e86a8226e8be5d9dfbbb8714
Opcode Fuzzy Hash: 30c2cbca8ddea967e868705950fd5399c79b102bd344a556156e5ab8739dea70
Instruction Fuzzy Hash: 5011A732E0D68291EA10EB50E5919F9A360FF89B80FE45431E98D43B99DF3CE605CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EB2FEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF78EB2FF29
CloseHandle.KERNEL32 ref: 00007FF78EB2FF3A

Strings

, xrefs: 00007FF78EB2FF01

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-3916222277
Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction ID: 0a59d99189ed4ce913bf8475aad364c2de4262716bc41d1c5a7771d6004b1b68
Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction Fuzzy Hash: 37115131A0C7418AE710AF96F801A6AFBA5FB84780FA48135DA9947E64CF3CD090CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEDEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78EAF0730: GetClassNameW.USER32 ref: 00007FF78EAF075B

SendMessageW.USER32 ref: 00007FF78EAEDF26

Strings

ComboBox, xrefs: 00007FF78EAEDEB5
ListBox, xrefs: 00007FF78EAEDEEA

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 81a3ab15b29573282fc80f9ba309110290a8cda79a0218f0cb3de8ac7bf1c4a3
Instruction ID: c4d813ac5f02c731cdce447510190232ea8f4ff91f67d0bcec9e4a98c9f3e9a7
Opcode Fuzzy Hash: 81a3ab15b29573282fc80f9ba309110290a8cda79a0218f0cb3de8ac7bf1c4a3
Instruction Fuzzy Hash: E601DB21E1C54291EA20F764E5919F9E361FF85784FE04131E98D47ACADF3CE608CB12

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78EAEC59C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF78EAEC5B6

Strings

AutoIt, xrefs: 00007FF78EAEC5A6
Error allocating memory., xrefs: 00007FF78EAEC5AD

Memory Dump Source

Source File: 00000000.00000002.2304521965.00007FF78EA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78EA80000, based on PE: true

Associated: 00000000.00000002.2304499401.00007FF78EA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB35000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304588716.00007FF78EB58000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304652244.00007FF78EB6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB74000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2304681314.00007FF78EB84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ea80000_ocs-office.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 648476b70242862a2c772a7204b94de0f4739c6881b98e5a59267def54d3366a
Instruction ID: f9946c98706bb4f5c504d4f003c260eeb5e086fbf475bf58480a8f690eebf62c
Opcode Fuzzy Hash: 648476b70242862a2c772a7204b94de0f4739c6881b98e5a59267def54d3366a
Instruction Fuzzy Hash: 10F08230B1834641E71877D2B151BB9A651BF88B80FF45431D91947B9ACEBDD481C751

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ocs-office.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\OCS Inventory Agent\ComHTTP.dll

C:\Program Files\OCS Inventory Agent\Download.exe

C:\Program Files\OCS Inventory Agent\OCS-transform.xsl

C:\Program Files\OCS Inventory Agent\OCSInventory Front.dll

C:\Program Files\OCS Inventory Agent\OCSInventory.exe

C:\Program Files\OCS Inventory Agent\OcsNotifyUser.exe

C:\Program Files\OCS Inventory Agent\OcsService.exe

C:\Program Files\OCS Inventory Agent\OcsSystray.exe

C:\Program Files\OCS Inventory Agent\OcsWmi.dll

C:\Program Files\OCS Inventory Agent\Plugins\Saas.ps1

C:\Program Files\OCS Inventory Agent\Plugins\o36516user.vbs

C:\Program Files\OCS Inventory Agent\SysInfo.dll

C:\Program Files\OCS Inventory Agent\ZipArchive.dll

C:\Program Files\OCS Inventory Agent\libcurl.dll

C:\Program Files\OCS Inventory Agent\libeay32.dll

C:\Program Files\OCS Inventory Agent\mfc140.dll

Windows Analysis Report
ocs-office.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre