Edit tour

Windows Analysis Report
5006_2.6.2.exe

Overview

General Information

Sample name:	5006_2.6.2.exe
Analysis ID:	1412313
MD5:	8541da559ecb090cd768bc6f3173ffc4
SHA1:	35c33bb61dcc017903a07ba70d69885c67fee39a
SHA256:	fbe8bba07f8b3c2307339d5aff885e46f8a14a251af04fc0455943c72b8c3ef6
Infos:

Detection

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Deletes itself after installation

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks winsocket function (used for sniffing or altering network traffic)

Install WinpCap (used to filter network traffic)

Installs a global event hook (focus changed)

Installs a global get message hook

Installs new ROOT certificates

Modifies the prolog of user mode functions (user mode inline hooks)

Overwrites Mozilla Firefox settings

Sample is not signed and drops a device driver

Sigma detected: System File Execution Location Anomaly

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables debug privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Use Short Name Path in Command Line

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

5006_2.6.2.exe (PID: 6532 cmdline: "C:\Users\user\Desktop\5006_2.6.2.exe" MD5: 8541DA559ECB090CD768BC6F3173FFC4)

antivirus_detector.exe (PID: 3808 cmdline: "antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning|| MD5: 7BCC1F1DEB45BF58C7C559DFE3240E08)

main_installer.exe (PID: 1864 cmdline: "C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1 MD5: 2F61BD2AC7DC2252AD5743093CEB09DC)

post_install.exe (PID: 3304 cmdline: "post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0 MD5: 52A76696B447635922D8EC87D0DA7FEE)

svcAppUpdate.exe (PID: 4332 cmdline: "C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe" MD5: E53E0020D7FE34B1E8F75AF444E64C72)

svcAppInit.exe (PID: 6556 cmdline: "C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe" MD5: 3135A7FEE1AD484104A1309104312D9E)

rundll32.exe (PID: 6056 cmdline: rundll32.exe "C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll",ProcessDll s=hidedialog MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3220 cmdline: C:\Windows\sysnative\rundll32.exe "C:\Program Files (x86)\Windows Provisioning\windows_hook_64.dll",ProcessDllStub MD5: EF3179D498793BF4234F708D3BE28633)

svcAppLookup.exe (PID: 2924 cmdline: "C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe" MD5: 794122A33A390FF07CA891B568110D10)

nt_system_service.exe (PID: 7060 cmdline: "C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe" MD5: 64F8F960D535AA6200E620C1DEF292FB)

certutil.exe (PID: 6224 cmdline: nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile MD5: 3337B8D5AAB06D9072E3D4A72E0F9D26)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll	Windows_Ransomware_Hellokitty_d9391a1a	unknown	unknown	0x58255b:$a1: 83 6D 08 01 75 DF 89 47 FC 8B 45 F8 5F 5E 5B 8B E5 5D C3 89
C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll	Windows_Ransomware_Hellokitty_d9391a1a	unknown	unknown	0x58255b:$a1: 83 6D 08 01 75 DF 89 47 FC 8B 45 F8 5F 5E 5B 8B E5 5D C3 89

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.4464326614.000000006AAB1000.00000020.00000001.01000000.0000001B.sdmp	Windows_Ransomware_Hellokitty_d9391a1a	unknown	unknown	0x58215b:$a1: 83 6D 08 01 75 DF 89 47 FC 8B 45 F8 5F 5E 5B 8B E5 5D C3 89

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.rundll32.exe.6aab0000.4.unpack	Windows_Ransomware_Hellokitty_d9391a1a	unknown	unknown	0x58255b:$a1: 83 6D 08 01 75 DF 89 47 FC 8B 45 F8 5F 5E 5B 8B E5 5D C3 89

Sigma Signatures

System Summary

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile, CommandLine: nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile, CommandLine|base64offset|contains: , Image: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe, NewProcessName: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe, OriginalFileName: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe, ParentCommandLine: "C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe", ParentImage: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe, ParentProcessId: 7060, ParentProcessName: nt_system_service.exe, ProcessCommandLine: nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile, ProcessId: 6224, ProcessName: certutil.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile, CommandLine: nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile, CommandLine|base64offset|contains: , Image: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe, NewProcessName: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe, OriginalFileName: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe, ParentCommandLine: "C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe", ParentImage: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe, ParentProcessId: 7060, ParentProcessName: nt_system_service.exe, ProcessCommandLine: nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile, ProcessId: 6224, ProcessName: certutil.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: 5006_2.6.2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Window detected: Software InstallationI agree to install this software only on computers that I own. I also agree to inform anyone who uses those computers that their computer usage may be monitored.Please read the following License Agreement. Press the PAGE DOWN key to see the rest of the agreement.Do you accept all the terms of the preceeding License Agreement? If you choose No Setup will close. To Install this software you must accept this agreement.SOFTWARE END USER LICENSE AGREEMENTPLEASE CAREFULLY READ THIS END USER LICENSE AGREEMENT (LICENSE) PRIOR TO USING THE SOFTWARE (SOFTWARE). BY USING THE SOFTWARE YOU AGREE TO ADHERE TO THE TERMS OF THIS LICENSE. IF YOU DO NOT ACCEPT THE TERMS OF THIS LICENSE DO NOT INSTALL OR USE THE SOFTWARE AND DELETE THE SOFTWARE AND ALL OF ITS RELATED FILES FROM YOUR DEVICE. THIS END USER LICENSE AGREEMENT (EULA) IS A LEGAL AGREEMENT BETWEEN YOU (THE USER) AND APPLICATION PROVIDER FOR USE OF THE SOFTWARE. BY DOWNLOADING INSTALLING OR OTHERWISE USING THE SOFTWARE YOU AGREE TO BE BOUND BY THE TERMS OF THIS EULA. IF YOU DO NOT AGREE TO THE TERMS OF THIS EULA YOU MAY NOT DOWNLOAD INSTALL OR USE THE SOFTWARE.BY ACCEPTING THIS AGREEMENT YOU AGREE TO INSTALL THIS SOFTWARE ONLY ON A DEVICE OR DEVICES OWNED BY TO USE IT ONLY IN CONNECTION WITH AN ACCOUNT APPLICATION OR PROGRAM YOU HAVE THE LEGAL RIGHT TO ACCESS. YOU ALSO AGREE TO INFORM ANY PERSON(S) WHO USE(S) A DEVICE WITH THE SOFTWARE INSTALLED AND ANY OTHER PERSON WITH THE RIGHT TO ACCESS A MONITORED ACCOUNT OF THE PRESENCE OF THE SOFTWARE. FAILURE TO COMPLY MAY RESULT IN YOU BREAKING STATE AND FEDERAL LAWS. YOU UNDERSTAND AND AGREE THAT YOU SHALL BE RESPONSIBLE FOR ANY LEGAL COSTS INCURRED BY APPLICATION PROVIDER RESULTING FROM YOUR IMPROPER OR ILLEGAL USE OF THE SOFTWARE. User agrees that the installation and use of the Software will be in accordance with all local state and federal laws governing the monitoring of device account application or program activity and usage. User acknowledges that it is prohibited and against the terms of this Agreement NOT to inform any third party that User is monitoring the device account application or program with the Software and that their usage is subject to monitoring and recording.The application software that is subject to this license is referred to in this license as the Licensed Software. The Licensed Software and any other products offered on this website are licensed not sold to You. Vendor (further referred to in this license as Application Provider) reserves all rights not expressly granted to You.a. Scope of License: Application Provider grants You a non-exclusive non-transferable End-User license right to install the Licensed Software on one computer that You own or control. Nothing in this license should be interpreted as permitting installation of the Licensed Software on any device You do not own or control or which You do not have the legal right to monitor or to monitor any account application or program You do not have the

Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe

File created: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49753 version: TLS 1.2

Source: 5006_2.6.2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\tools\vcpkg\buildtrees\protobuf\x86-windows-v140-rel\libprotobuf-lite.pdb??! source: rundll32.exe, 0000000A.00000002.4464191235.000000006A9CD000.00000002.00000001.01000000.0000001D.sdmp, libprotobuf-lite.dll0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\post_install.pdbWW source: post_install.exe, 00000004.00000000.2119366297.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp, post_install.exe, 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\antivirus_detector.pdbOO source: antivirus_detector.exe, 00000002.00000000.1990976682.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp, antivirus_detector.exe, 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\build\openssl-develop\packages\openssl-1.1.0\libssl.pdb source: svcAppLookup.exe, 00000008.00000002.4462687887.000000006BDA3000.00000002.00000001.01000000.00000015.sdmp, rundll32.exe, 0000000A.00000002.4466303204.000000006BDA3000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\uninstall.pdbXX source: uninstall.exe0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppUpdate.pdbCC source: svcAppUpdate.exe, 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmp, svcAppUpdate.exe, 00000005.00000000.2149789521.00000000006B0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\windows_hook_64.pdb source: rundll32.exe, 0000000B.00000002.4459240973.00007FF8A9325000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\uninstall.pdb source: uninstall.exe0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\post_install.pdb source: post_install.exe, 00000004.00000000.2119366297.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp, post_install.exe, 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppInit.pdb source: svcAppInit.exe, 00000007.00000000.2189559977.0000000000818000.00000002.00000001.01000000.0000000D.sdmp, svcAppInit.exe, 00000007.00000002.4458028771.0000000000818000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\nt_system_service.pdbuu+4GCTL source: nt_system_service.exe, 00000009.00000002.4458728112.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, nt_system_service.exe, 00000009.00000000.2191105493.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\releases\winpcap_4_1_3\winpcap\packetNtx\Dll\Project\Release No NetMon\x86\Packet.pdb source: rundll32.exe, 0000000A.00000002.4459330719.000000000434F000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppUpdate.pdb source: svcAppUpdate.exe, 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmp, svcAppUpdate.exe, 00000005.00000000.2149789521.00000000006B0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\nt_system_service.pdb source: nt_system_service.exe, 00000009.00000002.4458728112.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, nt_system_service.exe, 00000009.00000000.2191105493.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\build\openssl-develop\packages\openssl-1.1.0\libcrypto.pdb source: svcAppLookup.exe, 00000008.00000002.4461735294.000000006BC6F000.00000002.00000001.01000000.00000018.sdmp, rundll32.exe, 0000000A.00000002.4465825694.000000006BC6F000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppInit.pdbNN source: svcAppInit.exe, 00000007.00000000.2189559977.0000000000818000.00000002.00000001.01000000.0000000D.sdmp, svcAppInit.exe, 00000007.00000002.4458028771.0000000000818000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\tools\vcpkg\buildtrees\protobuf\x86-windows-v140-rel\libprotobuf-lite.pdb source: rundll32.exe, 0000000A.00000002.4464191235.000000006A9CD000.00000002.00000001.01000000.0000001D.sdmp, libprotobuf-lite.dll0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\windows_hook.pdb source: antivirus_detector.exe, 00000002.00000002.4460746995.000000006A5EB000.00000002.00000001.01000000.0000002A.sdmp, svcAppLookup.exe, 00000008.00000003.2191222252.000000000123E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4463926030.000000006A5EB000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\build\release_static_ssl\win32\protocolfilters.pdb source: nt_system_service.exe, 00000009.00000002.4463173082.000000006C90B000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppLookup.pdbnn92GCTL source: svcAppLookup.exe, 00000008.00000000.2190159565.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe, 00000008.00000002.4458238469.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppLookup.pdb source: svcAppLookup.exe, 00000008.00000000.2190159565.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe, 00000008.00000002.4458238469.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe0.3.dr
Source:	Binary string: c:\releases\winpcap_4_1_3\winpcap\packetntx\driver\bin\amd64\npf.pdb source: main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\svcAppLookup.pdb source: svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\build\openssl-develop\packages\openssl-1.1.0\libssl.pdb== source: svcAppLookup.exe, 00000008.00000002.4462687887.000000006BDA3000.00000002.00000001.01000000.00000015.sdmp, rundll32.exe, 0000000A.00000002.4466303204.000000006BDA3000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: c:\releases\winpcap_4_1_3\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb source: rundll32.exe, 0000000A.00000002.4463801692.0000000010029000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: e:\PTHREADS\pthreads\pthreadVC.pdb source: pthreadVC.dll.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\svcAppInit.pdb source: rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, svcAppInit.dll0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\antivirus_detector.pdb source: antivirus_detector.exe, 00000002.00000000.1990976682.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp, antivirus_detector.exe, 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\svcAppLookup.pdbn source: svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp

Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_00406313 FindFirstFileA,FindClose,	0_2_00406313
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_00402765 FindFirstFileA,	0_2_00402765
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_004057D8 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004057D8
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: 2_2_009FD380 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetLastError,	2_2_009FD380
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_00406313 FindFirstFileA,FindClose,	3_2_00406313
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_004057D8 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	3_2_004057D8
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_00402765 FindFirstFileA,	3_2_00402765
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005C6A90 GetLastError,WTSQueryUserToken,SHGetFolderPathW,CloseHandle,GetLastError,SHGetSpecialFolderPathW,FindFirstFileW,_stat64i32,FindNextFileW,GetLastError,FindClose,GetLastError,	4_2_005C6A90
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005BAA30 GetFileAttributesA,FindFirstFileA,FindNextFileA,remove,FindNextFileA,FindClose,GetLastError,	4_2_005BAA30
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005BA790 Sleep,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetLastError,	4_2_005BA790
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C687A00 FindFirstFileW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,	9_2_6C687A00
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C655780 _memset,Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,	9_2_6C655780
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C655ED0 _memset,Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception,ExpandEnvironmentStringsW,Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception,FindFirstFileW,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,FindClose,EnterCriticalSection,LeaveCriticalSection,	9_2_6C655ED0

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 119.8.47.97 443

Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: nBGeczvijzupKaYAUSH4RA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: VZePNLUYezwqL5AtQJhrXg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: K06wdEYcvgB+fcNv0a6mOQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: d3uAPPyZNgZMaYsxjzOdHQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 46xSSJDLTXcqnjdLJO/7FQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: RVKJB9qTozfjyIZpU2jteA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: gU9dZVRrU0S384gBzBZzJQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: D7WQUDGO1FMmNFlXiHEsfw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: EGL7SsaWqH3VO95A5yYQDw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: oY4aLcRoOTHFmKQvdTb6Ew==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: axusKlgQIQCd1L1tHavMSg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: zRffd4tou1bFsuBcvjgGSg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: GpQWHSA2bQg5Tth8GFqfeA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: KviYWWfoRxp63PoxyhdeWg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: tQ9ERyidHSiMxwJwv5aubA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: xDA8Tf3dtThMnYE/Wy9yRg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: +nx2ZhhyzmmBVlYjWtO3Dg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 2VQ5IS4IEXxEq1ILCPHLdA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: AKX0GlLjTUnejKRQwtQCPw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: FW8RC3SavSmzTKt7Ct3dJA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: bA8rED+SgjX6Uolww2uuDQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: M/0dZgAmK2bbc4EhfjMHEA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qzPdUq9BpTNFaSdmFqlGJA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 45j3WK3v00YIQtxIR4wVAQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 3N+OWOC7QVBYyZxJTa95dg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: w+coMVxmqTHBeYxLkCWxaA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: uG8rQ8WHDRKy1uJwIegFIg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: YClmIY75KzN1bTQcf+bcJg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: +yf5IUkAU3MZ9EhxqRkdSQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: mkyZFH/MkXu0wmR8kAh4EA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: SSvbBKsfTCgKzR0PoKC+NQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: m01UNCzrLHDF9bAo7l38Kw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: beJlBoaEBnWpfthTDuBmNw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: DZcBL4vzvTm+DZE9+xTdTQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: x7G4OczQ+yNPPNYJ6kOCXA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 9IS/FLMNKB63WpA5rAhtNw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: dKkrZez1mjrnXJluXooFCA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: EVQFTYM/XUMj8y127qJCRw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: BYg5cUonXixA8AxSrtjCJQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: WHSlChQsUEDWLbIK9lZ6cA==

Source: Joe Sandbox View

ASN Name: HWCLOUDS-AS-APHUAWEICLOUDSHK HWCLOUDS-AS-APHUAWEICLOUDSHK

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe

Code function: 9_2_008F8180 InternetOpenW,InternetConnectA,InternetCloseHandle,HttpOpenRequestA,InternetCloseHandle,HttpAddRequestHeadersA,HttpSendRequestW,memset,HttpQueryInfoW,HttpQueryInfoA,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,fopen_s,InternetReadFile,fwrite,fclose,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

9_2_008F8180

Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: nBGeczvijzupKaYAUSH4RA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: VZePNLUYezwqL5AtQJhrXg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: K06wdEYcvgB+fcNv0a6mOQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: d3uAPPyZNgZMaYsxjzOdHQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 46xSSJDLTXcqnjdLJO/7FQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: RVKJB9qTozfjyIZpU2jteA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: gU9dZVRrU0S384gBzBZzJQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: D7WQUDGO1FMmNFlXiHEsfw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: EGL7SsaWqH3VO95A5yYQDw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: oY4aLcRoOTHFmKQvdTb6Ew==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: axusKlgQIQCd1L1tHavMSg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: zRffd4tou1bFsuBcvjgGSg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: GpQWHSA2bQg5Tth8GFqfeA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: KviYWWfoRxp63PoxyhdeWg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: tQ9ERyidHSiMxwJwv5aubA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: xDA8Tf3dtThMnYE/Wy9yRg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: +nx2ZhhyzmmBVlYjWtO3Dg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 2VQ5IS4IEXxEq1ILCPHLdA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: AKX0GlLjTUnejKRQwtQCPw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: FW8RC3SavSmzTKt7Ct3dJA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: bA8rED+SgjX6Uolww2uuDQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: M/0dZgAmK2bbc4EhfjMHEA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: qzPdUq9BpTNFaSdmFqlGJA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 45j3WK3v00YIQtxIR4wVAQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 3N+OWOC7QVBYyZxJTa95dg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: w+coMVxmqTHBeYxLkCWxaA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: uG8rQ8WHDRKy1uJwIegFIg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: YClmIY75KzN1bTQcf+bcJg==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: +yf5IUkAU3MZ9EhxqRkdSQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: mkyZFH/MkXu0wmR8kAh4EA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: SSvbBKsfTCgKzR0PoKC+NQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: m01UNCzrLHDF9bAo7l38Kw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: beJlBoaEBnWpfthTDuBmNw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: DZcBL4vzvTm+DZE9+xTdTQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: x7G4OczQ+yNPPNYJ6kOCXA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: 9IS/FLMNKB63WpA5rAhtNw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: dKkrZez1mjrnXJluXooFCA==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: EVQFTYM/XUMj8y127qJCRw==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1Connection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: BYg5cUonXixA8AxSrtjCJQ==
Source: global traffic	HTTP traffic detected: GET /?encoding=utf8 HTTP/1.1Host: push.mobilefonex.comOrigin: https://push.mobilefonex.comdeviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdogConnection: UpgradeUpgrade: websocketSec-WebSocket-Version: 13Sec-WebSocket-Key: WHSlChQsUEDWLbIK9lZ6cA==

Source: unknown

DNS traffic detected: queries for: push.mobilefonex.com

Source: nt_system_service.exe, 00000009.00000002.4463173082.000000006C90B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.css
Source: nt_system_service.exe, 00000009.00000002.4463173082.000000006C90B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.jpg
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: rundll32.exe, 0000000A.00000002.4459759875.000000000488A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://client.mobilefonex.com/gateway
Source: rundll32.exe, 0000000A.00000002.4459759875.000000000488A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://client.mobilefonex.com/gateway/unstructured
Source: rundll32.exe, 0000000A.00000002.4459759875.000000000488A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://client.mobilefonex.com/gateway/unstructureda
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://client.mobilefonex.com/gateway/unstructuredy
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://client.mobilefonex.com/gatewayV
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: nt_system_service.exe, 00000009.00000002.4463173082.000000006C90B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: svcAppInit.dll0.3.dr	String found in binary or memory: http://maps.google.com/?q=
Source: main_installer.exe, main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp, main_installer.exe, 00000003.00000000.2085500259.000000000040A000.00000008.00000001.01000000.00000008.sdmp, 5006_2.6.2.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 5006_2.6.2.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://www.appinf.com/features/enable-partial-reads
Source: svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://www.appinf.com/features/enable-partial-readsCannot
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.appinf.com/features/enable-partial-readsent-contentJ
Source: PocoXML.dll0.3.dr	String found in binary or memory: http://www.appinf.com/features/no-whitespace-in-element-content
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.appinf.com/features/no-whitespace-in-element-contentS
Source: certutil.exe, 0000000C.00000002.2206821485.000000006A819000.00000002.00000001.01000000.00000024.sdmp, libnspr4.dll.3.dr	String found in binary or memory: http://www.mozilla.org/MPL/
Source: certutil.exe, 0000000C.00000002.2206489227.000000006A7CB000.00000002.00000001.01000000.00000026.sdmp, libnspr4.dll.3.dr	String found in binary or memory: http://www.mozilla.org/MPL/NSPR_FD_CACHE_SIZE_LOWNSPR_FD_CACHE_SIZE_HIGH;
Source: svcAppLookup.exe, 00000008.00000002.4462048125.000000006BCB7000.00000002.00000001.01000000.00000018.sdmp, svcAppLookup.exe, 00000008.00000002.4462749493.000000006BDBD000.00000002.00000001.01000000.00000015.sdmp, rundll32.exe, 0000000A.00000002.4465966699.000000006BCB7000.00000002.00000001.01000000.00000018.sdmp, rundll32.exe, 0000000A.00000002.4466342443.000000006BDBD000.00000002.00000001.01000000.00000015.sdmp, libeay32.dll0.3.dr	String found in binary or memory: http://www.openssl.org/V
Source: libeay32.dll0.3.dr, libeay32.dll.3.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: libeay32.dll0.3.dr, libeay32.dll.3.dr	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEprng
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/external-general-entitiesn
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes3
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixesx
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces&
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://xml.org/sax/features/string-interning
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interningG
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://xml.org/sax/features/validation
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/features/validationX
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handlerQ
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.nXnm
Source: post_install.exe, post_install.exe, 00000004.00000002.2192666922.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxV
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxVE
Source: antivirus_detector.exe, 00000002.00000002.4459215588.000000000123E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxe.dll
Source: antivirus_detector.exe, 00000002.00000002.4459215588.000000000123E000.00000004.00000020.00020000.00000000.sdmp, post_install.exe, 00000004.00000002.2192666922.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxll.dll
Source: antivirus_detector.exe, 00000002.00000000.1990976682.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp, antivirus_detector.exe, 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp, post_install.exe, 00000004.00000000.2119366297.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp, post_install.exe, 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp, rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, uninstall.exe0.3.dr, svcAppInit.dll0.3.dr	String found in binary or memory: https://clients2.google.com/service/update2/crxmbiemjlmncjcojkndbdmpjnaafjobifl;https://clients2.goo
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: rundll32.exe, 0000000A.00000002.4464252813.000000006AA02000.00000002.00000001.01000000.0000001D.sdmp, libprotobuf-lite.dll0.3.dr	String found in binary or memory: https://developers.google.com/protocol-buffers/
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIX
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs
Source: antivirus_detector.exe	String found in binary or memory: https://portal.mobilebackup.biz/help/en/install/pc/common-anti-virus-program-instructions-for-adding
Source: antivirus_detector.exe	String found in binary or memory: https://portal.mobilebackup.biz/help/en/install/pc/configure-exclusions-for-windows.html
Source: antivirus_detector.exe, 00000002.00000000.1990976682.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp, antivirus_detector.exe, 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://portal.mobilebackup.biz/help/en/install/pc/configure-exclusions-for-windows.htmlhttps://port
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4459759875.0000000004845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push.mobilefonex.com
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push.mobilefonex.comc
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&re
Source: rundll32.exe, 0000000A.00000002.4465825694.000000006BC6F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.openssl.org/docs/faq.html

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 119.8.47.97:443 -> 192.168.2.5:49753 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global event hook (focus changed)

Source: C:\Windows\SysWOW64\rundll32.exe

Windows user hook set: Path: unknown Event Start:focus Event End: focus Module: NULL

Source: C:\Users\user\Desktop\5006_2.6.2.exe

Code function: 0_2_00405275 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405275

E-Banking Fraud

Hooks winsocket function (used for sniffing or altering network traffic)

Source: explorer.exe

File created: function: sendto

Install WinpCap (used to filter network traffic)

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe

File created: C:\Program Files (x86)\Windows Provisioning\libs\Packet.dll

Jump to behavior

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe

File created: C:\Program Files (x86)\Windows Provisioning\app_data\de_netfilter\SSL\DigiCert SHA2 Extended Validation Server CA 3.cer

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Install WinpCap (used to filter network traffic)

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe

File created: C:\Program Files (x86)\Windows Provisioning\libs\Packet.dll

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.rundll32.exe.6aab0000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Hellokitty_d9391a1a Author: unknown
Source: 0000000A.00000002.4464326614.000000006AAB1000.00000020.00000001.01000000.0000001B.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Hellokitty_d9391a1a Author: unknown
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll, type: DROPPED	Matched rule: Windows_Ransomware_Hellokitty_d9391a1a Author: unknown
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll, type: DROPPED	Matched rule: Windows_Ransomware_Hellokitty_d9391a1a Author: unknown

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Memory allocated: 76960000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76960000 page execute and read and write

Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CA980 memset,NtWow64QueryInformationProcess64,NtWow64QueryInformationProcess64,	4_2_005CA980
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CAA20 memset,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,	4_2_005CAA20
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CAAA0 NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,	4_2_005CAAA0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CBBF0 memset,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,	4_2_005CBBF0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CBC70 memset,NtWow64ReadVirtualMemory64,NtWow64ReadVirtualMemory64,	4_2_005CBC70

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe

Code function: 9_2_009831F0: DeviceIoControl,

9_2_009831F0

Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe

Code function: 4_2_005C2100 Sleep,OpenSCManagerW,OpenServiceA,ChangeServiceConfig2W,DeleteService,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,

4_2_005C2100

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Code function: 2_2_009FBB30 memset,CreateEnvironmentBlock,CreateProcessAsUserW,DestroyEnvironmentBlock,CloseHandle,CloseHandle,CloseHandle,

2_2_009FBB30

Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_0040326B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040326B
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_0040326B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_0040326B

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe

File created: C:\Program Files (x86)\Windows Provisioning\libs\npf.sys

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe

File created: C:\Windows\system32\drivers\npf.sys

Jump to behavior

Source: C:\Users\user\Desktop\5006_2.6.2.exe	File created: C:\Windows\SysWOW64\msvcr110.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoCrypto.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoFoundation.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoJSON.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoNet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoNetSSL.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoUtil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoXML.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\libeay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\ssleay32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\libcrypto.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\libssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\Packet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\wpcap.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\pthreadVC.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\system32\Packet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\system32\wpcap.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\system32\drivers\npf.sys	Jump to behavior

Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_00406FC4	0_2_00406FC4
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_004067ED	0_2_004067ED
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: 2_2_009F2E60	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: 2_2_009F9B90	2_2_009F9B90
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_00406FC4	3_2_00406FC4
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_004067ED	3_2_004067ED
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005B26B0	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CC870	4_2_005CC870
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005B26B0	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: 7_2_00812B30	7_2_00812B30
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006B6450	8_2_006B6450
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006A2BE0	8_2_006A2BE0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006AAF60	8_2_006AAF60
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006DC070	8_2_006DC070
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006A3030	8_2_006A3030
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006B20E0	8_2_006B20E0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006EE0A0	8_2_006EE0A0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006E20A0	8_2_006E20A0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006AE220	8_2_006AE220
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006B4220	8_2_006B4220
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006AC210	8_2_006AC210
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006982F0	8_2_006982F0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006A92A0	8_2_006A92A0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006DB350	8_2_006DB350
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006E8350	8_2_006E8350
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006A7460	8_2_006A7460
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006F7430	8_2_006F7430
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006C1400	8_2_006C1400
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006EE4F0	8_2_006EE4F0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006AC550	8_2_006AC550
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006ED500	8_2_006ED500
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006BC58D	8_2_006BC58D
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_00697600	8_2_00697600
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_0069A710	8_2_0069A710
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006EF7F0	8_2_006EF7F0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006AF810	8_2_006AF810
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006C4810	8_2_006C4810
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006AC8C0	8_2_006AC8C0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006B1920	8_2_006B1920
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006D8920	8_2_006D8920
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006EA920	8_2_006EA920
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006AE990	8_2_006AE990
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006F0B80	8_2_006F0B80
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006E4C20	8_2_006E4C20
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006E3CF0	8_2_006E3CF0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006B2CA0	8_2_006B2CA0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006D9CA0	8_2_006D9CA0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_0069BE20	8_2_0069BE20
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006D6F30	8_2_006D6F30
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_0069CFC0	8_2_0069CFC0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006D3FA0	8_2_006D3FA0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA17120	8_2_6BA17120
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA5F3C0	8_2_6BA5F3C0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00948570	9_2_00948570
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00912AA0	9_2_00912AA0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0091ACD0	9_2_0091ACD0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_009494A0	9_2_009494A0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00907450	9_2_00907450
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0090F7D0	9_2_0090F7D0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0097DF80	9_2_0097DF80
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00914090	9_2_00914090
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008B8050	9_2_008B8050
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00954070	9_2_00954070
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_009161A0	9_2_009161A0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E41D0	9_2_008E41D0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008A6100	9_2_008A6100
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00960150	9_2_00960150
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008CC2B0	9_2_008CC2B0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008F2240	9_2_008F2240
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008CC3C0	9_2_008CC3C0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008CC340	9_2_008CC340
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008EE4E0	9_2_008EE4E0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0093E520	9_2_0093E520
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008D8550	9_2_008D8550
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00900670	9_2_00900670
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_009408F0	9_2_009408F0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00938820	9_2_00938820
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008F09A0	9_2_008F09A0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00946920	9_2_00946920
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00952920	9_2_00952920
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00916960	9_2_00916960
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00910A80	9_2_00910A80
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00918AA0	9_2_00918AA0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E8A60	9_2_008E8A60
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0094CBD0	9_2_0094CBD0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008FCB50	9_2_008FCB50
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008BCC60	9_2_008BCC60
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008D8DB0	9_2_008D8DB0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00910DC0	9_2_00910DC0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E2D10	9_2_008E2D10
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008EED50	9_2_008EED50
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00952D70	9_2_00952D70
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008FEF60	9_2_008FEF60
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00929090	9_2_00929090
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008F10C0	9_2_008F10C0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0093D1A0	9_2_0093D1A0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0094F1A0	9_2_0094F1A0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00911130	9_2_00911130
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00913210	9_2_00913210
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E3210	9_2_008E3210
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00955400	9_2_00955400
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00917520	9_2_00917520
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E3540	9_2_008E3540
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008F3540	9_2_008F3540
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008F16C0	9_2_008F16C0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008B7650	9_2_008B7650
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0093B7B0	9_2_0093B7B0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_009078A0	9_2_009078A0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E98F0	9_2_008E98F0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00901810	9_2_00901810
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E3860	9_2_008E3860
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E3B80	9_2_008E3B80
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0093FBD0	9_2_0093FBD0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0090DB10	9_2_0090DB10
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00925C80	9_2_00925C80
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0090BCD0	9_2_0090BCD0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0095BCC0	9_2_0095BCC0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008B1CE0	9_2_008B1CE0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E7CE0	9_2_008E7CE0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00951D80	9_2_00951D80
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E3EA0	9_2_008E3EA0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008EFEF0	9_2_008EFEF0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008FBE60	9_2_008FBE60
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008E9FB0	9_2_008E9FB0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C6D92C1	9_2_6C6D92C1
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C656C10	9_2_6C656C10
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C754CB0	9_2_6C754CB0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C6A4DE0	9_2_6C6A4DE0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C690EF0	9_2_6C690EF0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C754AA0	9_2_6C754AA0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C7B6760	9_2_6C7B6760
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C754740	9_2_6C754740
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C756070	9_2_6C756070
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C672020	9_2_6C672020
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C756340	9_2_6C756340
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C7403D0	9_2_6C7403D0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C657D20	9_2_6C657D20
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C73FEC0	9_2_6C73FEC0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C657F59	9_2_6C657F59

Source: C:\Windows\SysWOW64\rundll32.exe

Process token adjusted: Security

Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: String function: 005B2590 appears 104 times
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: String function: 005B2620 appears 171 times
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: String function: 005B50B0 appears 59 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: String function: 00801AA0 appears 49 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: String function: 00801B30 appears 109 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: String function: 00805E30 appears 31 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: String function: 00682590 appears 119 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: String function: 0069B9B0 appears 45 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: String function: 0069C540 appears 162 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: String function: 6BA1A2B9 appears 42 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: String function: 006839E0 appears 65 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: String function: 0069BC00 appears 137 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: String function: 0069C640 appears 40 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: String function: 6BA02A30 appears 48 times
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: String function: 00682500 appears 41 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 6C651140 appears 37 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 6C6CD86D appears 55 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 00900450 appears 103 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 00900200 appears 44 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 008A52B0 appears 72 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 6C6C7F55 appears 79 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 00900D90 appears 140 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 008B9F10 appears 45 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 008A5220 appears 61 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 00900E90 appears 40 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 008EB730 appears 102 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 6C73EB30 appears 41 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 6C73E8A0 appears 180 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 6C7664B0 appears 301 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 008A7240 appears 317 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 008B6EA0 appears 103 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 008A8560 appears 431 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 6C6AD8DB appears 43 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 6C6CCCF0 appears 123 times
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: String function: 0097F478 appears 308 times
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: String function: 009F27D0 appears 40 times
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: String function: 009F5460 appears 39 times
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: String function: 009F2740 appears 31 times
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: String function: 009F6660 appears 65 times

Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: concrt140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: poconetssl.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: pocofoundation.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: pocoutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: poconet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: pocofoundation.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: poconet.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: libcrypto.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: libssl.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: pococrypto.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: pocoutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: libcrypto.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: libcrypto.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: pocoxml.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: pocojson.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: msvcp140.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: protocolfilters.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: vcruntime140.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: nssutil3.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: smime3.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: nss3.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libplc4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libplds4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libnspr4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libplc4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libplds4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libnspr4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: nss3.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libplc4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libplds4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libnspr4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libplc4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libplds4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libnspr4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libnspr4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: libnspr4.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: sqlite3.dll
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Section loaded: cryptbase.dll

Source: 5006_2.6.2.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 10.2.rundll32.exe.6aab0000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Hellokitty_d9391a1a reference_sample = 10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768, os = windows, severity = x86, creation_date = 2021-05-03, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Hellokitty, fingerprint = 4b9c96561163f925df6b2300c9e34c9572c1fe14ec3a55da4d4876ce467f6d6e, id = d9391a1a-78d3-4ae6-8e45-630ceec8bade, last_modified = 2021-08-23
Source: 0000000A.00000002.4464326614.000000006AAB1000.00000020.00000001.01000000.0000001B.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Hellokitty_d9391a1a reference_sample = 10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768, os = windows, severity = x86, creation_date = 2021-05-03, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Hellokitty, fingerprint = 4b9c96561163f925df6b2300c9e34c9572c1fe14ec3a55da4d4876ce467f6d6e, id = d9391a1a-78d3-4ae6-8e45-630ceec8bade, last_modified = 2021-08-23
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll, type: DROPPED	Matched rule: Windows_Ransomware_Hellokitty_d9391a1a reference_sample = 10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768, os = windows, severity = x86, creation_date = 2021-05-03, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Hellokitty, fingerprint = 4b9c96561163f925df6b2300c9e34c9572c1fe14ec3a55da4d4876ce467f6d6e, id = d9391a1a-78d3-4ae6-8e45-630ceec8bade, last_modified = 2021-08-23
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll, type: DROPPED	Matched rule: Windows_Ransomware_Hellokitty_d9391a1a reference_sample = 10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768, os = windows, severity = x86, creation_date = 2021-05-03, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Hellokitty, fingerprint = 4b9c96561163f925df6b2300c9e34c9572c1fe14ec3a55da4d4876ce467f6d6e, id = d9391a1a-78d3-4ae6-8e45-630ceec8bade, last_modified = 2021-08-23

Source: classification engine

Classification label: mal54.phis.bank.adwa.spyw.evad.winEXE@17/121@1/1

Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_0040326B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	0_2_0040326B
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: 2_2_00A056F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,	2_2_00A056F0
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_0040326B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	3_2_0040326B
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CADA0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,	4_2_005CADA0
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: 7_2_00804890 memset,OpenProcess,GetLastError,_CxxThrowException,OpenProcessToken,GetLastError,_CxxThrowException,LookupPrivilegeValueW,GetLastError,_CxxThrowException,DuplicateTokenEx,GetLastError,_CxxThrowException,SetTokenInformation,AdjustTokenPrivileges,GetLastError,GetLastError,CreateEnvironmentBlock,GetLastError,_CxxThrowException,wcscpy_s,CreateProcessAsUserW,GetLastError,_CxxThrowException,wcscpy_s,CreateProcessAsUserW,GetLastError,TerminateProcess,_CxxThrowException,CloseHandle,WaitForMultipleObjects,TerminateProcess,CreateEventW,SetEvent,CloseHandle,TerminateProcess,CloseHandle,CloseHandle,MsgWaitForMultipleObjects,PeekMessageW,DispatchMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,MsgWaitForMultipleObjects,CloseHandle,DestroyEnvironmentBlock,GetExitCodeProcess,Sleep,GetLastError,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	7_2_00804890
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00982F00 ?_Throw_C_error@std@@YAXH@Z,GetCurrentProcessId,OpenProcess,OpenProcessToken,CloseHandle,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,CloseHandle,CloseHandle,	9_2_00982F00

Source: C:\Users\user\Desktop\5006_2.6.2.exe

Code function: 0_2_00404530 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404530

Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: OpenSCManagerW,CreateServiceA,GetLastError,CloseServiceHandle,_CxxThrowException,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,	4_2_005C1820
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: OpenSCManagerW,GetLastError,_CxxThrowException,CreateServiceA,GetLastError,CloseServiceHandle,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,	4_2_005C1160
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: OpenSCManagerW,GetLastError,_CxxThrowException,CreateServiceA,GetLastError,CloseServiceHandle,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,	4_2_005C0B50
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: _stat64i32,OpenSCManagerW,CreateServiceA,GetLastError,CloseServiceHandle,_CxxThrowException,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,	4_2_005C1E20
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Code function: OpenSCManagerW,CreateServiceA,GetLastError,CloseServiceHandle,_CxxThrowException,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,	5_2_006AB940
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Code function: OpenSCManagerW,GetLastError,_CxxThrowException,CreateServiceA,GetLastError,CloseServiceHandle,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,	5_2_006AB670

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Code function: 2_2_00A046B0 memset,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_00A046B0

Source: C:\Users\user\Desktop\5006_2.6.2.exe

Code function: 0_2_00402138 CoCreateInstance,MultiByteToWideChar,

0_2_00402138

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Code function: 2_2_009F69A0 CreateCompatibleDC,SelectObject,GetObjectW,BitBlt,SelectObject,DeleteDC,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,SendMessageW,GetDlgItem,DefWindowProcW,GetClientRect,RedrawWindow,SetWindowLongW,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,SetTextColor,SetBkMode,GetStockObject,FindResourceW,FindResourceW,LoadResource,DialogBoxIndirectParamW,KiUserCallbackDispatcher,FindResourceW,LoadResource,DialogBoxIndirectParamW,FindResourceW,LoadResource,DialogBoxIndirectParamW,EndDialog,GetWindowLongW,SetWindowLongW,SetWindowTextW,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,SetDlgItemTextW,GetWindowLongW,SetWindowLongW,GetDesktopWindow,GetWindowRect,GetWindowRect,GetWindowRect,MoveWindow,

2_2_009F69A0

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Code function: 2_2_00A02B50 _stat64i32,OpenSCManagerW,OpenServiceA,ChangeServiceConfig2W,GetTickCount,GetTickCount,QueryServiceStatusEx,Sleep,QueryServiceStatusEx,GetTickCount,ControlService,Sleep,Sleep,QueryServiceStatusEx,GetTickCount,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,GetLastError,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,GetLastError,

2_2_00A02B50

Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Code function: 5_2_006A2E40 memset,wcscpy_s,StartServiceCtrlDispatcherW,GetLastError,	5_2_006A2E40
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: 7_2_00805F50 wcscpy_s,StartServiceCtrlDispatcherW,GetLastError,	7_2_00805F50
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006839F0 memset,wcscpy_s,StartServiceCtrlDispatcherW,GetLastError,	8_2_006839F0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_008AA280 StartServiceCtrlDispatcherW,GetLastError,	9_2_008AA280

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe

File created: C:\Program Files (x86)\Windows Provisioning

Jump to behavior

Source: C:\Users\user\Desktop\5006_2.6.2.exe

File created: C:\Users\user\AppData\Roaming\Windows Provisioning

Jump to behavior

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Mutant created: NULL
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Mutant created: \BaseNamedObjects\Global\Session_BDB1BEC9-DFE1-4FE7-9956-5D90508D03A8}
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Mutant created: \BaseNamedObjects\Global\APP_7a176276-e800-4daa-b5e8-7febbd3efc4a
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\GLOBAL_FILE_EVENT_MUTEX_563666373
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\FX_MUTEX_13FF2604_36CB_4ED4_A338_74BBD556055_RESPONSE
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\GLOBAL_HIDE_MUTEX_452555262
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Mutant created: \BaseNamedObjects\Global\KNIT_WMST_TMP_A2FA6D83-517F-41C2-A8D6-647E41231D92
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\APP_5491c4d3-0a5f-4898-bec4-cd906998e306
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\GLOBAL_KEYLOG_SETTINGS_MUTEX_452555262
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Mutant created: \BaseNamedObjects\Global\KNIT_WM_IPC6F69A0FF-B7BD-4ED1-B123-6ADFC7CE5340_MUTEX
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Stub_5491c4d3-0a5f-4898-bec4-cd906998e306
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\GLOBAL_MUTEX_231444252
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\FX_MUTEX_13FF2604_36CB_4ED4_A338_74BBD556055_REQUEST
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\FX_MUTEX_13FF2604_36CB_4ED4_A338_74BBD556055_

Source: C:\Users\user\Desktop\5006_2.6.2.exe

File created: C:\Users\user\AppData\Local\Temp\nsuBA52.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: license.txt	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: log.csv	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: LIC	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: LIC	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: Status	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: Status	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: -s=%d	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: version.txt	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: -s=1	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: \version.txt	2_2_009F2E60
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Command line argument: \version.txt	2_2_009F2E60
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: exe=	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: inst=	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: shutdown.dat	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: shutdown.dat	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: inst.dat	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: stealth_manager	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: uninstall_util	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: uninstall_util	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: lic.dat	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: exe=	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: inst=	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: shutdown.dat	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: shutdown.dat	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: inst.dat	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: stealth_manager	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: uninstall_util	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: uninstall_util	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: lic.dat	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Command line argument: post_install	4_2_005B26B0

Source: 5006_2.6.2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\5006_2.6.2.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\5006_2.6.2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll",ProcessDll s=hidedialog

Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;RG
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;Rg%uR
Source: svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;rol,UES ;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_thumbnail SET event_time=?,event_type=?,media_id=?,media_type=?,actual_size=?,actual_duration=?,full_path=?,event_time_zone=? WHERE event_id=?;V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_app_usage SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,got_focus=?,lost_focus=?,duration=?,owner_domain=?,owner_username=?,elevated=?,event_time_zone=? WHERE event_id=?;
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;,privilege_
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);V}
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_im_message;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;e,pv4,&
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;RW
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_email;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;k*
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);VH
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS virtual_payload (BASE_ID INTEGER PRIMARY KEY AUTOINCREMENT, csid INTEGER, event_attributes BLOB, event_file_path TEXT, event_file_md5 BLOB );
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000000.2190159565.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458238469.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe0.3.dr, svcAppInit.dll0.3.dr	Binary or memory string: SELECT * FROM fx_session_store WHERE session_type=? AND session_user=? AND date_time=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);_network_traffic_id)m
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;lX
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);VP
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);VQ
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_panic_image SET event_time=?,latitude=?,longitude=?,altitude=?,coordinate_acc=?,network_name=?,network_id=?,cell_name=?,cell_id=?,country_code=?,area_code=?,media_type=?,image_path=?,event_time_zone=? WHERE event_id=?;ound_size,i
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_file_activity;#
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;p_id=?,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_app_life_cycle(event_time,state,type,app_id,app_name,version,app_size,icon_type,full_name,icon,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?);f
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_peripheral SET event_time=?,event_time_zone=?,user_logon=?,app_id=?,app_name=?,app_title=?,action=?,peripheral_type=?,serial_number=?,product_id=?,vendor_id=?,description=?manufacturer=?friendly_name=? WHERE event_id=?;file_att=?,updated_file_path=?,updated_file_name=?,updated_file_size=?,updated_file_att=?,event_time_zone=? WHERE Y
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM installed_app_from_running_app WHERE app_id=? AND location=?;tR7
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_setting_elem(parent_id,setting_id,value) VALUES (?,?,?);
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_mms WHERE direction=2;,sender_address
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);w
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_peripheral SET event_time=?,event_time_zone=?,user_logon=?,app_id=?,app_name=?,app_title=?,action=?,peripheral_type=?,serial_number=?,product_id=?,vendor_id=?,description=?manufacturer=?friendly_name=? WHERE event_id=?;file_att=?,updated_file_path=?,updated_file_name=?,updated_file_size=?,updated_file_att=?,event_time_zone=? WHERE
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_sms SET event_time=?,direction=?,conversation_id=?,sender_number=?,sender_contact_name=?,subject=?,message=?,event_time_zone=? WHERE event_id=?;,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);) VALUES V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;y=?
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ready_flag, payload_path, protocol_version, product_id, product_version, config_id, device_id, activate_code, language, phone_number, mcc, mnc, imsi, host_url, encrypt_code, compress_code, payload_size, payload_crc, public_key, ssid, has_virtual_payload, virtual_payload_attributes, aes_key, connection_timeout FROM phoenix_session WHERE csid=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;6,host_name,pv4,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);_network_traffic_id)Q-
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_log_on(event_time,user_logon,app_id,app_name,app_title,action,domain_name,event_time_zone) VALUES (?,?,?,?,?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);VE
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;l#
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);V
Source: svcAppLookup.exe, 00000008.00000002.4460147545.0000000001FCF000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200101408.0000000001FAF000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3124446339.0000000001FCF000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3575228733.0000000001FCF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_protected_resource_audit_log(event_time,user_logon,app_id,app_name,app_title,employee_id,app_credential_name,well_known_name,accessed_url,status_message,event_time_zone,log_in_result) VALUES (?,?,?,?,?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_network_traffic;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);ct_name=?,subject=?,message=?,9
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;e,pv4,T
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_desktop_email WHERE direction=1 AND user_logon=? ;Y
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;) VALUES
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);,privilege_read_execute,4
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);,privilege_read_execute,5
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);?,app_name=?,app_title=?uleE{/~
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);_network_traffic_id)'
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_app_screenshot SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,app_category=?,url=?,snapshot_type=?,snapshot_path=?,event_time_zone=?,screen_category=? WHERE event_id=?;7
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);V#
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_pin_message WHERE direction=?;
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_location SET event_time=?,calling_module=?,method=?,provider=?,latitude=?,longitude=?,altitude=?,horizontal_acc=?,vertical_acc=?,speed=?,heading=?,network_id=?,network_name=?,cell_name=?,cell_id=?,area_code=?,country_code=?,event_time_zone=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);t=?,date_time_end=?,event_time_zone=? WHERE N
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);=?,sender_email=?,sender_contact_name=?,subjecte,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);V
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_im_contact(event_time,service_id,owner_id,contact_id,display_name,status_message,picture_profile,event_time_zone) VALUES (?,?,?,?,?,?,?,?);E
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);rk_traffic_id,OU
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_thumbnail SET event_time=?,event_type=?,media_id=?,media_type=?,actual_size=?,actual_duration=?,full_path=?,event_time_zone=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_email SET event_time=?,direction=?,sender_email=?,sender_contact_name=?,subject=?,message=?,html_text=?,event_time_zone=? WHERE event_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);,msg_type,msg_id) VALUES V
Source: svcAppLookup.exe, 00000008.00000003.2210025540.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200187887.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4460147545.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3575305638.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3124518059.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_key;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);W
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_file_transfer(event_time,user_logon,app_id,app_name,app_title,direction,transfer_type,source,destination,filename,filesize,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);crosoftedge
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_pin_message SET event_time=?,direction=?,sender_name=?,sender_contact_name=?,subject=?,message=?,event_time_zone=? WHERE event_id=?;E
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_network_connection;Y
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);0=
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO installed_app_from_running_app (app_id, app_name, version, location, icon_path, date_time, size) VALUES (?,?,?,?,?,?,?);"
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_im_conversation;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_call_tag(media_id,direction,duration,number,contact_name) VALUES (?,?,?,?,?);e_zone=?.
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);g
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_im_conversation;,id,x1
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);,msg_type,msg_id) VALUES e_zone)V
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT MAX(latest_csid) from csid_generator; z
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);>
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);s8
Source: svcAppLookup.exe, 00000008.00000003.2210025540.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200187887.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp, svcAppLookup.exe, 00000008.00000002.4460147545.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3575305638.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3124518059.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, svcAppInit.dll0.3.dr	Binary or memory string: SELECT * FROM installed_app_from_running_app;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_panic_status(event_time,status,event_time_zone) VALUES (?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;p_id=?,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_panic_status;?,statuswG@~
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;V-R
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_log_on SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,action=?,domain_name=?,event_time_zone=? WHERE event_id=?;tal_acc,
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);name=?,adapter_des=?,tate,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);ethod=?,provider=?,latitude=?,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_pin_message;?,st_id
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);write,privilege_list_folder,R
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;W*J}Y
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;pe,_id
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_email;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_app_life_cycle SET event_time=?,state=?,type=?,app_id=?,app_name=?,version=?,app_size=?,icon_type=?,full_name=?,icon=?,event_time_zone=? WHERE event_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_browser_url(event_time,title,url,visit_time,is_blocked,owning_app,event_time_zone) VALUES (?,?,?,?,?,?,?);Vs
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_usb SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,action=?,device_type=?,name=?,event_time_zone=? WHERE event_id=?;V
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_email(event_time,user_logon,app_id,app_name,app_title,direction,service_type,sender_email,sender_contact_name,subject,body,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?);Rg
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);*
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);'
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);ource,destination,filename,filesize,
Source: certutil.exe, 0000000C.00000002.2206120578.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203974030.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203856321.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203203715.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202802777.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2204537899.00000000011D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM nssPublic WHERE a1=$DATA0 AND a0=$DATA1 AND a81=$DATA2 AND a82=$DATA3;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000000.2190159565.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458238469.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe0.3.dr, svcAppInit.dll0.3.dr	Binary or memory string: INSERT INTO fx_session_store (session_type, session_user, session_domain, date_time) VALUES (?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_file_permission(username,privilege_full_control,privilege_modify,privilege_read_execute,privilege_read,privilege_write,privilege_list_folder,file_id,file_info_type) VALUES (?,?,?,?,?,?,?,?,?);l_name,cell_id,area_code,country;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_im_account(event_time,service_id,owner_id,display_name,status_message,picture_profile,event_time_zone) VALUES (?,?,?,?,?,?,?);shot_path=?,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;"
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;&
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;+
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);sj
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;.
Source: svcAppInit.dll0.3.dr	Binary or memory string: SELECT name FROM sqlite_master WHERE type='table' AND name=?;PRAGMA table_info('');Component %d, Error %d, %s
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);w_data=?,formatted_data=?,snapshot_type=?,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_email SET event_time=?,direction=?,sender_email=?,sender_contact_name=?,subject=?,message=?,html_text=?,event_time_zone=? WHERE event_id=?;W
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;6,host_name,G
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;6,host_name,name,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;l_ipv4,9
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);pe,msg_id) VALUES _id)
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_panic_image(event_time,latitude,longitude,altitude,coordinate_acc,network_name,network_id,cell_name,cell_id,country_code,area_code,media_type,image_path,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_app_life_cycle SET event_time=?,state=?,type=?,app_id=?,app_name=?,version=?,app_size=?,icon_type=?,full_name=?,icon=?,event_time_zone=? WHERE event_id=?;R
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_email WHERE direction=2;
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_key SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,raw_data=?,formatted_data=?,url=?,snapshot_type=?,snapshot_path=?,event_time_zone=? WHERE event_id=?;'
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_sms SET event_time=?,direction=?,conversation_id=?,sender_number=?,sender_contact_name=?,subject=?,message=?,event_time_zone=? WHERE event_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_location SET event_time=?,calling_module=?,method=?,provider=?,latitude=?,longitude=?,altitude=?,horizontal_acc=?,vertical_acc=?,speed=?,heading=?,network_id=?,network_name=?,cell_name=?,cell_id=?,area_code=?,country_code=?,event_time_zone=? WHERE event_id=?;ege_full_control,privilege_modify,privilege_read_execute,privilege_read,privilege_write,pr<
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;l_ipv4,,
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_key(event_time,user_logon,app_id,app_name,app_title,raw_data,formatted_data,url,snapshot_type,snapshot_path,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?);vR'
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);msg_id) VALUES V
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);2i
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;gon=?,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_im_message WHERE direction=1;W
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_panic_image;$G
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS fx_log_file_log(event_id INTEGER PRIMARY KEY AUTOINCREMENT,event_time TEXT,event_time_zone TEXT,log_category INTEGER,log_message TEXT,log_zip_file_path TEXT);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_panic_status SET event_time=?,status=?,event_time_zone=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_src_record;id
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);ivilege_read_execute,V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);,coordinate_acc=?,network_name=?,ider
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);_name,submitted_time,total_pagesVE
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_email WHERE direction=1;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);ivilege_read_execute,d
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);v8
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);1
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);0
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_im_contact(event_time,service_id,owner_id,contact_id,display_name,status_message,picture_profile,event_time_zone) VALUES (?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);type=?,snapshot_path=?,R't
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);6
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO virtual_payload (csid,event_attributes,event_file_path,event_file_md5) VALUES ( ?,?,?,? );onV
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);=
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;pR'QpR
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;5g
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);G
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);F
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_im_message WHERE direction=2;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(event_type) FROM fx_media WHERE event_type=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_remote_camera_image;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);,msg_type,msg_id) VALUES hod,provider,
Source: certutil.exe, 0000000C.00000003.2202535216.0000000001204000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000002.2206197737.0000000001204000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202346992.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202391788.00000000011F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO nssPublic (id,ace536360,a0,ace53635a,ace5363b4,a81,a1,ace53635b,ace5363b5,a2,a82,a3,a170,ace536358,ace536359) VALUES($ID,$VALUE0,$VALUE1,$VALUE2,$VALUE3,$VALUE4,$VALUE5,$VALUE6,$VALUE7,$VALUE8,$VALUE9,$VALUE10,$VALUE11,$VALUE12,$VALUE13);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);ivilege_read_execute,(
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_system WHERE direction=?;e,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_im_message SET event_time=?,direction=?,service_id=?,conversation_id=?,originator_id=?,text_representation=?,data=?,event_time_zone=? WHERE event_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;6,host_name,V
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_location(event_time,calling_module,method,provider,latitude,longitude,altitude,horizontal_acc,vertical_acc,speed,heading,network_id,network_name,cell_name,cell_id,area_code,country_code,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);wR
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_event_setting(event_time,event_time_zone) VALUES (?,?);
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_audio_call_recording SET event_time=?,media_type=?,filename=?,full_path=?,event_time_zone=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);QqRwPqR'PqR
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);itle,direction,service_type,)iZ
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;[08
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);,privilege_read_execute,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);ipv6,event_network_traffic_id)
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(event_type) FROM fx_thumbnail WHERE event_type=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);*
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_im_conversation(event_time,service_id,owner_id,conversation_id,conversation_name,picture_profile,status_message,event_time_zone) VALUES (?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_im_account;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_file_activity(event_time,user_logon,app_id,app_name,app_title,activity_type,file_type,activity_owner,date_created,date_modified,date_accessed,org_file_path,org_file_name,org_file_size,org_file_att,updated_file_path,updated_file_name,updated_file_size,updated_file_att,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);V
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_file_activity(event_time,user_logon,app_id,app_name,app_title,activity_type,file_type,activity_owner,date_created,date_modified,date_accessed,org_file_path,org_file_name,org_file_size,org_file_att,updated_file_path,updated_file_name,updated_file_size,updated_file_att,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);Y
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);5j
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_im(event_time,user_logon,app_id,app_name,app_title,service_id,conv_name,raw_data,formatted_data,snapshot_type,snapshot_path,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?);V}
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_remote_camera_image SET event_time=?,media_type=?,filename=?,full_path=?,event_time_zone=? WHERE event_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);fic_id,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);ApR
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_session_store WHERE session_type=? AND session_user=? AND date_time=?;_>g
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_log_file_log;id,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_location;?,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_file_transfer;
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_print_job SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,job_id=?,owner_user_name=?,printer_name=?,document_name=?,submitted_time=?,total_pages=?,total_bytes=?,mime_type=?,print_data_filename=?,event_time_zone=? WHERE event_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS rmt_cmd_data (id INTEGER PRIMARY KEY AUTOINCREMENT, cmd_code TEXT, is_reply_msg INTEGER, sender TEXT, rmt_cmd_type INTEGER, arguments BLOB, retry_count INTEGER, tagging TEXT);K
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);JMY
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_location;t_id
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_mms SET event_time=?,direction=?,conversation_id=?,sender_address=?,sender_contact_name=?,subject=?,message=?,event_time_zone=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_im_account(event_time,service_id,owner_id,display_name,status_message,picture_profile,event_time_zone) VALUES (?,?,?,?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);pe,msg_id) VALUES _id)"
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);nt_time_zone=? WHERE event_idVj
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);Y
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);t_type,snapshot_path,event_time_zone,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);s_message=?,event_time_zone=?V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_sms;R
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;l_ipv4,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;#l
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_network_connection(event_time,user_logon,app_id,app_name,app_title,uid,network_type,adapter_name,adapter_des,mac_address,conn_state,network_name,ipv4_address,ipv6_address,subnet_mask,default_gateway,dhcp_server,dhcp_enabled,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_im_account;'
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);msg_id) VALUES _id)Rg-R
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_im_message WHERE direction=1;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT event_id,event_time,event_time_zone,log_category,log_message,log_zip_file_path FROM fx_log_file_log WHERE event_id=?;
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);msg_id) VALUES gems
Source: rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, svcAppInit.dll0.3.dr	Binary or memory string: INSERT INTO rmt_cmd_data (cmd_code, is_reply_msg, sender, rmt_cmd_type, arguments, retry_count, tagging) VALUES (?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp, svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, svcAppInit.dll0.3.dr	Binary or memory string: INSERT INTO installed_app_from_running_app (app_id, app_name, version, location, icon_path, date_time, size) VALUES (?,?,?,?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;,E
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;pe,_title
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);{
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);msg_id) VALUES _id)=
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_key SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,raw_data=?,formatted_data=?,url=?,snapshot_type=?,snapshot_path=?,event_time_zone=? WHERE event_id=?;V
Source: svcAppLookup.exe, 00000008.00000003.2210025540.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200187887.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4460147545.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3575305638.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3124518059.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_call_log;rotocol_type,T7#~"
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_email WHERE user_logon=? ;<
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_session_store LIMIT 0,1;ramS3~i
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_im_message WHERE direction=1;,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_browser;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);n
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_location(event_time,calling_module,method,provider,latitude,longitude,altitude,horizontal_acc,vertical_acc,speed,heading,network_id,network_name,cell_name,cell_id,area_code,country_code,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);Z
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);msg_id) VALUES .{
Source: certutil.exe, 0000000C.00000002.2206120578.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203974030.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203856321.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203203715.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202802777.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2204537899.00000000011D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL a0 FROM nssPublic WHERE id=$ID;ddo
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);o
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_audio_call_recording(event_time,media_type,filename,full_path,event_time_zone) VALUES (?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_mms(event_time,direction,conversation_id,sender_address,sender_contact_name,subject,message,event_time_zone) VALUES (?,?,?,?,?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);le=?,action=?,p_title=?,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);RW'
Source: svcAppLookup.exe, 00000008.00000002.4460147545.0000000001FCF000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200101408.0000000001FAF000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3124446339.0000000001FCF000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3575228733.0000000001FCF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_protected_resource_audit_log SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,employee_id=?,app_credential_name=?,well_known_name=?,accessed_url=?,status_message=?,event_time_zone=?log_in_result=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_log_file_log;
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp, svcAppLookup.exe, 00000008.00000000.2190159565.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe, 00000008.00000002.4458238469.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, nt_system_service.exe, nt_system_service.exe, 00000009.00000002.4458728112.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, nt_system_service.exe, 00000009.00000000.2191105493.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, svcAppLookup.exe0.3.dr, svcAppInit.dll0.3.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);re_profile=?,status_message=?,event_time_zone=?w
Source: svcAppLookup.exe, 00000008.00000003.2210025540.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200187887.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4460147545.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3575305638.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3124518059.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_print_job;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_audio_ambient_recording SET event_time=?,media_type=?,filename=?,full_path=?,duration=?,event_time_zone=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_peripheral SET event_time=?,event_time_zone=?,user_logon=?,app_id=?,app_name=?,app_title=?,action=?,peripheral_type=?,serial_number=?,product_id=?,vendor_id=?,description=?manufacturer=?friendly_name=? WHERE event_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_panic_image;_id,VT
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);p_id=?,app_name=?,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_panic_status(event_time,status,event_time_zone) VALUES (?,?,?);ent_network_traffic_id)
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(event_type) FROM fx_thumbnail WHERE event_type=?;OO_
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);TY`~
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;6,host_name,ALUES
Source: certutil.exe, 0000000C.00000002.2206120578.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203974030.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203856321.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203203715.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202802777.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2204537899.00000000011D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL a3 FROM nssPublic WHERE id=$ID;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_thumbnail;itude,type,
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;qR
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_network_connection(event_time,user_logon,app_id,app_name,app_title,uid,network_type,adapter_name,adapter_des,mac_address,conn_state,network_name,ipv4_address,ipv6_address,subnet_mask,default_gateway,dhcp_server,dhcp_enabled,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);rRW
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_email SET event_time=?,direction=?,sender_email=?,sender_contact_name=?,subject=?,message=?,html_text=?,event_time_zone=? WHERE event_id=?;older,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE ddm SET caller_id=1, priority_request=?, delivery_request_type=?, ready_to_resume=?, retry_count=?, max_retry_count=?, data_provider_type=?, is_require_encryption=?, is_require_compression=?, delay_time=? WHERE csId=?;unt INTEGER, max_retry_count INTEGER, data_provider_type INTEGER,
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);?
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);5
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);E3
Source: rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;pe,ysM
Source: rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, svcAppInit.dll0.3.dr	Binary or memory string: SELECT * FROM rmt_cmd_data ORDER BY id ASC;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_system;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);2
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_im;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_media SET event_time=?,event_type=?,media_type=?,filename=?,full_path=?,has_thumbnail=?,thumbnail_delivered=?,event_time_zone=? WHERE event_id=?;*
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp, svcAppLookup.exe, 00000008.00000000.2190159565.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe, 00000008.00000002.4458238469.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, nt_system_service.exe, nt_system_service.exe, 00000009.00000002.4458728112.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, nt_system_service.exe, 00000009.00000000.2191105493.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, svcAppLookup.exe0.3.dr, svcAppInit.dll0.3.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);ivilege_read_execute,
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;'
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);b
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_app_screenshot SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,app_category=?,url=?,snapshot_type=?,snapshot_path=?,event_time_zone=?,screen_category=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_file_activity(event_time,user_logon,app_id,app_name,app_title,activity_type,file_type,activity_owner,date_created,date_modified,date_accessed,org_file_path,org_file_name,org_file_size,org_file_att,updated_file_path,updated_file_name,updated_file_size,updated_file_att,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_im_message(event_time,direction,service_id,conversation_id,originator_id,text_representation,data,event_time_zone) VALUES (?,?,?,?,?,?,?,?);RW
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;9
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;me)
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);_network_traffic_id)rovider,t{
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);M
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_file_permission(username,privilege_full_control,privilege_modify,privilege_read_execute,privilege_read,privilege_write,privilege_list_folder,file_id,file_info_type) VALUES (?,?,?,?,?,?,?,?,?);vR70vR
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);Eo
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);P
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;-
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_log_on(event_time,user_logon,app_id,app_name,app_title,action,domain_name,event_time_zone) VALUES (?,?,?,?,?,?,?,?);r=?,latitude=?}
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS fx_web_mail_2 (id INTEGER PRIMARY KEY AUTOINCREMENT, email_provider INTEGER, email_id TEXT, email_direction INTEGER, date_time TEXT);protocol_type,t
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;'
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);ce_id,conv_name,raw_data,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_call_tag(media_id,direction,duration,number,contact_name) VALUES (?,?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);rk_traffic_id,tivity_type,,V2$
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);pe,msg_id) VALUES V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_panic_image SET event_time=?,latitude=?,longitude=?,altitude=?,coordinate_acc=?,network_name=?,network_id=?,cell_name=?,cell_id=?,country_code=?,area_code=?,media_type=?,image_path=?,event_time_zone=? WHERE event_id=?;
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;2
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;7
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_file_permission(username,privilege_full_control,privilege_modify,privilege_read_execute,privilege_read,privilege_write,privilege_list_folder,file_id,file_info_type) VALUES (?,?,?,?,?,?,?,?,?);me_zone) VALUES
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);)
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO csid_generator (latest_csid) VALUES ( ? );
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);(
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_browser;,Z
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_im_contact SET event_time=?,service_id=?,owner_id=?,contact_id=?,display_name=?,status_message=?,picture_profile=?,event_time_zone=? WHERE event_id=?;
Source: nt_system_service.exe, 00000009.00000002.4458728112.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000000.2191105493.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS fx_web_mail_2 (id INTEGER PRIMARY KEY AUTOINCREMENT, email_provider INTEGER, email_id TEXT, email_direction INTEGER, date_time TEXT);
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;rR
Source: nt_system_service.exe, 00000009.00000002.4458728112.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000000.2191105493.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: INSERT INTO fx_web_mail_2 (email_provider, email_id, email_direction, date_time) VALUES (?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS fx_desktop_location(event_id INTEGER PRIMARY KEY AUTOINCREMENT,event_time TEXT,event_time_zone TEXT,user_logon TEXT,app_id TEXT,app_name TEXT,app_title TEXT,calling_module INTEGER,method INTEGER,provider INTEGER,latitude REAL,longitude REAL,altitude REAL,horizontal_acc REAL,vertical_acc REAL,speed REAL,heading REAL,network_id TEXT,network_name TEXT,cell_name TEXT,cell_id INTEGER,area_code INTEGER,country_code TEXT);RY KEY AUT
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);VW'
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;%
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);ge_read,privilege_write,privilege_list_folder,Rw.
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;m
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_network_traffic SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,date_time_start=?,date_time_end=?,event_time_zone=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;g
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);msg_id) VALUES ork_id,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_email(event_time,direction,sender_email,sender_contact_name,subject,message,html_text,event_time_zone) VALUES (?,?,?,?,?,?,?,?);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_panic_image(event_time,latitude,longitude,altitude,coordinate_acc,network_name,network_id,cell_name,cell_id,country_code,area_code,media_type,image_path,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);Jm
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);KZA
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;w
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_browser_url SET event_time=?,title=?,url=?,visit_time=?,is_blocked=?,owning_app=?,event_time_zone=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;rol,
Source: softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_mms;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?); KEY AUTOINCREMENT,event_time TEXT
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_app_screenshot(event_time,user_logon,app_id,app_name,app_title,app_category,url,snapshot_type,snapshot_path,event_time_zone,screen_category) VALUES (?,?,?,?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);redential_name=?,st_folder,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);d=?,app_name=?,action,V[T
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_app_life_cycle;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;E
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;G
Source: svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;I
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_src_record SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,calling_module=?,frame_strip=?,snapshot_type=?,snapshot_path=?,event_time_zone=? WHERE event_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);on_id,conversation_name,ecute,U
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);sfer_type=?,source=?,destination=?,filename=?,Rwa
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_panic_image;
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;_full_control,rR
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;W
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_app_screenshot;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);_modify,privilege_read_execute,m
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE ddm SET ready_to_resume=1 WHERE csId=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);_name=?,app_title=?,uid=?,'A
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_log_on;? AND sC
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);,R
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_thumbnail;te_host_id
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);ame_strip=?,snapshot_type=?,snapshot_path=?,,R
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);V`8
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);e=?,document_name=?,folder,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_location;sg_type=?}
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_browser_url(event_time,title,url,visit_time,is_blocked,owning_app,event_time_zone) VALUES (?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_email WHERE direction=2;R
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_print_job;t_id
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_sms WHERE direction=2;7
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_remote_camera_image SET event_time=?,media_type=?,filename=?,full_path=?,event_time_zone=? WHERE event_id=?;ime=?,stop_time=?,duration=? WHERE H%
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);UZc
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_desktop_file_transfer WHERE direction=?;code
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;e,V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_network_traffic(event_time,user_logon,app_id,app_name,app_title,date_time_start,date_time_end,event_time_zone) VALUES (?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);type,snapshot_path,_folder,R7
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_email;=? AND
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_mms WHERE direction=2;,sender_addressW
Source: certutil.exe, 0000000C.00000002.2206120578.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203974030.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203856321.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203203715.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202802777.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2204537899.00000000011D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL a3 FROM nssPublic WHERE id=$ID;vdq
Source: svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;me)}
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;isplay_name,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);pe,msg_id) VALUES Vs
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);M
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);Q
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);full_name=?,icon=?,event_time_zone=? WHERE r,R
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_audio_call_recording SET event_time=?,media_type=?,filename=?,full_path=?,event_time_zone=? WHERE event_id=?;@
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);nate_acc,network_name,network_id,V
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);E
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);ge_write,privilege_list_folder,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);H
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);]Mb
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);^
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);\
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_peripheral(event_time,event_time_zone,user_logon,app_id,app_name,app_title,action,peripheral_type,serial_number,product_id,vendor_id,description,manufacturer,friendly_name) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);[YQ~
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);tatus_message,
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_mms WHERE direction=2;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);_id,ge_read_execute,
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);Z
Source: svcAppLookup.exe, 00000008.00000003.2210025540.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200187887.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4460147545.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3575305638.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3124518059.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_location;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);#%
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_audio_ambient_recording(event_time,media_type,filename,full_path,duration,event_time_zone) VALUES (?,?,?,?,?,?);write,privilege_list_folder,
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);o
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);m
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);,calling_module,method,providerj{r~
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_app_life_cycle;st_id
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_browser SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,url=?,event_time_zone=?,start_time=?,stop_time=?,duration=? WHERE event_id=?;Vg
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);f
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);e,event_time_zone) VALUES
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);h
Source: svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp, svcAppLookup.exe, 00000008.00000000.2190159565.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe, 00000008.00000002.4458238469.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, nt_system_service.exe, nt_system_service.exe, 00000009.00000002.4458728112.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, nt_system_service.exe, 00000009.00000000.2191105493.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, svcAppLookup.exe0.3.dr, svcAppInit.dll0.3.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);le,action,device_type,name,d)
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);}
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_browser_url;E file_id
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);w
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;me)*
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_file_transfer(event_time,user_logon,app_id,app_name,app_title,direction,transfer_type,source,destination,filename,filesize,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?,?,?,?);Rg
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);,latitude,longitude,altitude,horizontal_acc,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;Q+
Source: svcAppLookup.exe, 00000008.00000003.2210025540.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200187887.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4460147545.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3575305638.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3124518059.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_audio_call_recording;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;,&
Source: svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_audio_ambient_recording;,media_type,filename,?
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO phoenix_session (csid,ready_flag, payload_path, protocol_version, product_id, product_version, config_id, device_id, activate_code, language, phone_number, mcc, mnc, imsi, host_url, encrypt_code, compress_code, connection_timeout) VALUES (?,0,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?) ;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;9[u
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_call_log(event_time,direction,duration,number,contact_name,event_time_zone) VALUES (?,?,?,?,?,?);
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_desktop_email WHERE direction=2 AND user_logon=? ;\
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_network_connection SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,uid=?,network_type=?,adapter_name=?,adapter_des=?,mac_address=?,conn_state=?,network_name=?,ipv4_address=?,ipv6_address=?,subnet_mask=?,default_gateway=?,dhcp_server=?,dhcp_enabled=?,event_time_zone=? WHERE event_id=?;V
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_email;g_type,c#
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;pe,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;) VALUES R
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);}&
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_im_contact SET event_time=?,service_id=?,owner_id=?,contact_id=?,display_name=?,status_message=?,picture_profile=?,event_time_zone=? WHERE event_id=?;R
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);,app_name=?,app_title=?,ecute,;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);vent_time_zone) VALUES 4
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);_name=?,app_title=?,uid=?,V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);ge_write,privilege_list_folder,R
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE phoenix_session SET ready_flag=1, payload_size=?, payload_crc=?, public_key=?, ssid=?, encrypt_code=?, compress_code=?, has_virtual_payload=?, virtual_payload_attributes=?, aes_key=? WHERE csid=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_desktop_email WHERE direction=2;R
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_recipient WHERE msg_type=? AND msg_id=?;G@
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);}6
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);full_name=?,icon=?,event_time_zone=? WHERE V
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);,msg_type,msg_id) VALUES le,Vg5
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;_No~
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_app_usage SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,got_focus=?,lost_focus=?,duration=?,owner_domain=?,owner_username=?,elevated=?,event_time_zone=? WHERE event_id=?;Rg
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_network_connection SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,uid=?,network_type=?,adapter_name=?,adapter_des=?,mac_address=?,conn_state=?,network_name=?,ipv4_address=?,ipv6_address=?,subnet_mask=?,default_gateway=?,dhcp_server=?,dhcp_enabled=?,event_time_zone=? WHERE event_id=?;w
Source: certutil.exe, 0000000C.00000002.2206120578.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203974030.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203856321.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203203715.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202802777.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2204537899.00000000011D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM nssPublic WHERE a1=$DATA0 AND a0=$DATA1 AND a81=$DATA2 AND a82=$DATA3;H
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_mms WHERE direction=1;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;pe,_titlef
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);,msg_type,msg_id) VALUES l_name,Vj
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);<7
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);_id,d) VALUES V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;) VALUES }(
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);=?,sender_email=?,sender_contact_name=?,subjectaf<
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_file_permission(username,privilege_full_control,privilege_modify,privilege_read_execute,privilege_read,privilege_write,privilege_list_folder,file_id,file_info_type) VALUES (?,?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_call_log(event_time,direction,duration,number,contact_name,event_time_zone) VALUES (?,?,?,?,?,?);]m
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_file_permission WHERE file_id=? AND file_info_type=?;c!2}
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS csid_generator (BASE_ID INTEGER PRIMARY KEY AUTOINCREMENT,latest_csid INTEGER);
Source: svcAppLookup.exe, 00000008.00000003.2210025540.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200187887.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4460147545.0000000001FAD000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3575305638.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.3124518059.0000000001FAB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_call_log;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_thumbnail(event_time,event_type,media_id,media_type,actual_size,actual_duration,full_path,event_time_zone) VALUES (?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;uR
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);rk_traffic_id,d) VALUES
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;j7
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_mms SET event_time=?,direction=?,conversation_id=?,sender_address=?,sender_contact_name=?,subject=?,message=?,event_time_zone=? WHERE event_id=?;R
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);ge_write,privilege_list_folder,oo
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_desktop_usb(event_time,user_logon,app_id,app_name,app_title,action,device_type,name,event_time_zone) VALUES (?,?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_media;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);V"I
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;ll_path) VALUES S
Source: certutil.exe, 0000000C.00000002.2206120578.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203974030.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203856321.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203203715.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202802777.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2204537899.00000000011D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL a0 FROM nssPublic WHERE id=$ID;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_remote_host(remote_ipv4,remote_ipv6,host_name,event_network_traffic_id,network_interface_id) VALUES (?,?,?,?,?);ner_domain=?,owner_username
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);9>
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_traffic WHERE remote_host_id=?;,}
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;me)tRW
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_event_setting SET event_time=?,event_time_zone=? WHERE event_id=?;R7*
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_protected_resource_audit_log SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,employee_id=?,app_credential_name=?,well_known_name=?,accessed_url=?,status_message=?,event_time_zone=?log_in_result=? WHERE event_id=?;V
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);Mi
Source: rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, svcAppInit.dll0.3.dr	Binary or memory string: UPDATE rmt_cmd_data SET retry_count=? WHERE cmd_code=? AND is_reply_msg=? AND sender=? AND rmt_cmd_type=? AND tagging=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);tation=?,data=?,event_time_zone=? WHERE +
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_media SET thumbnail_delivered=? WHERE event_id=?;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);ge_write,privilege_list_folder,tic
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_mms WHERE direction=1;AsR
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_system SET event_time=?,category=?,direction=?,message=?,event_time_zone=? WHERE event_id=?;zZ
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;3A
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_video_thumb_data(media_id,image_full_path) VALUES (?,?);]j
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);msg_id) VALUES cute,
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;E
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;B
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;A
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);ge_write,privilege_list_folder,1.
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);le=?,action=?,device_typeR
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_file_permission(username,privilege_full_control,privilege_modify,privilege_read_execute,privilege_read,privilege_write,privilege_list_folder,file_id,file_info_type) VALUES (?,?,?,?,?,?,?,?,?);nt_data_filename=?,erver,
Source: certutil.exe, 0000000C.00000002.2206120578.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203974030.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203856321.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203203715.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202802777.00000000011C4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2204537899.00000000011D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL a3 FROM nssPublic WHERE id=$ID;;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;[
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_desktop_email WHERE direction=1;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);ent_network_traffic_id)-#
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_attachment2(full_path,msg_type,msg_id,file_name) VALUES (?,?,?,?);bject,message,ecute,3
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;d=?,%
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);y2
Source: svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, svcAppInit.dll0.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS installed_app_from_running_app (id INTEGER PRIMARY KEY AUTOINCREMENT, app_id TEXT, app_name TEXT, version TEXT, location TEXT, icon_path TEXT, date_time TEXT, size INTEGER);
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);,
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_desktop_usb SET event_time=?,user_logon=?,app_id=?,app_name=?,app_title=?,action=?,device_type=?,name=?,event_time_zone=? WHERE event_id=?;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);-
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT event_attributes, event_file_path, event_file_md5 FROM virtual_payload WHERE csid=?;ALUES }h
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_im_contact;
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);3
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_im_message(event_time,direction,service_id,conversation_id,originator_id,text_representation,data,event_time_zone) VALUES (?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_attachment2 WHERE msg_type=? AND msg_id=?;5)
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(*) FROM fx_desktop_app_usage;t_idM
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);*
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_geo_tag(media_id,latitude,longitude,altitude) VALUES (?,?,?,?);pe,msg_id) VALUES
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);ge_write,privilege_list_folder,e,i
Source: svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;_
Source: svcAppLookup.exe, 00000008.00000003.2200286967.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_traffic(app_layer_protocol_type,tran_layer_protocol_type,port_number,inbound_size,outbound_size,inbound_packet,outbound_packet,event_network_traffic_id,remote_host_id) VALUES (?,?,?,?,?,?,?,?,?);>
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;}
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);&M
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_remote_host WHERE network_interface_id=?;ALUES V5
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_network_interface(type,name,description,local_ipv4,local_ipv6,event_network_traffic_id) VALUES (?,?,?,?,?,?);gm
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(direction) FROM fx_desktop_email WHERE direction=2;
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM fx_network_interface WHERE event_network_traffic_id=?;,app_id,V
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_im_account(event_time,service_id,owner_id,display_name,status_message,picture_profile,event_time_zone) VALUES (?,?,?,?,?,?,?);W,
Source: certutil.exe, 0000000C.00000003.2202535216.0000000001204000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000002.2206197737.0000000001204000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202346992.00000000011F4000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2202391788.00000000011F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO nssPublic (id,ace536360,a0,ace53635a,ace5363b4,a81,a1,ace53635b,ace5363b5,a2,a82,a3,a170,ace536358,ace536359) VALUES($ID,$VALUE0,$VALUE1,$VALUE2,$VALUE3,$VALUE4,$VALUE5,$VALUE6,$VALUE7,$VALUE8,$VALUE9,$VALUE10,$VALUE11,$VALUE12,$VALUE13);z
Source: certutil.exe, 0000000C.00000002.2205820364.0000000001172000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2205101694.0000000001171000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2205048101.0000000001167000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT ALL id FROM nssPublic WHERE a0=$DATA0 AND a3=$DATA1;
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_sms(event_time,direction,conversation_id,sender_number,sender_contact_name,subject,message,event_time_zone) VALUES (?,?,?,?,?,?,?,?);
Source: svcAppLookup.exe, 00000008.00000003.2200403958.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4458821210.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000003.2200286967.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO fx_recipient(recipient_type,recipient,recipient_contact_name,msg_type,msg_id) VALUES (?,?,?,?,?);5n
Source: svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE fx_media SET event_time=?,event_type=?,media_type=?,filename=?,full_path=?,has_thumbnail=?,thumbnail_delivered=?,event_time_zone=? WHERE event_id=?;

Source: antivirus_detector.exe	String found in binary or memory: self re-launch: fail !!!
Source: antivirus_detector.exe	String found in binary or memory: https://portal.mobilebackup.biz/help/en/install/pc/common-anti-virus-program-instructions-for-adding-exclusions.html
Source: antivirus_detector.exe	String found in binary or memory: https://portal.mobilebackup.biz/help/en/install/pc/common-anti-virus-program-instructions-for-adding-exclusions.html
Source: antivirus_detector.exe	String found in binary or memory: https://portal.mobilebackup.biz/help/en/install/pc/configure-exclusions-for-windows.html
Source: antivirus_detector.exe	String found in binary or memory: self re-launch: success !!!

Source: C:\Users\user\Desktop\5006_2.6.2.exe

File read: C:\Users\user\Desktop\5006_2.6.2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5006_2.6.2.exe "C:\Users\user\Desktop\5006_2.6.2.exe"
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Process created: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe "antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe\|C:\Users\user\AppData\Roaming\Windows Provisioning\|\|
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Process created: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe "C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Process created: C:\Program Files (x86)\Windows Provisioning\post_install.exe "post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe\|inst=C:\Program Files (x86)\Windows Provisioning\|s=1\|k=\|p=\|r=0
Source: unknown	Process created: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe "C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe "C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe "C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe "C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe"
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll",ProcessDll s=hidedialog
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\sysnative\rundll32.exe "C:\Program Files (x86)\Windows Provisioning\windows_hook_64.dll",ProcessDllStub
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Process created: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Process created: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe "antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe\|C:\Users\user\AppData\Roaming\Windows Provisioning\|\|	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Process created: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe "C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Process created: C:\Program Files (x86)\Windows Provisioning\post_install.exe "post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe\|inst=C:\Program Files (x86)\Windows Provisioning\|s=1\|k=\|p=\|r=0	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll",ProcessDll s=hidedialog	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\sysnative\rundll32.exe "C:\Program Files (x86)\Windows Provisioning\windows_hook_64.dll",ProcessDllStub	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Process created: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile

Source: C:\Users\user\Desktop\5006_2.6.2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Automated click: I agree to install this software only on computers that I own. I also agree to inform anyone who uses those computers that their computer usage may be monitored.
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Source: 5006_2.6.2.exe

Static file information: File size 17131434 > 1048576

Source: 5006_2.6.2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\tools\vcpkg\buildtrees\protobuf\x86-windows-v140-rel\libprotobuf-lite.pdb??! source: rundll32.exe, 0000000A.00000002.4464191235.000000006A9CD000.00000002.00000001.01000000.0000001D.sdmp, libprotobuf-lite.dll0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\post_install.pdbWW source: post_install.exe, 00000004.00000000.2119366297.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp, post_install.exe, 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\antivirus_detector.pdbOO source: antivirus_detector.exe, 00000002.00000000.1990976682.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp, antivirus_detector.exe, 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\build\openssl-develop\packages\openssl-1.1.0\libssl.pdb source: svcAppLookup.exe, 00000008.00000002.4462687887.000000006BDA3000.00000002.00000001.01000000.00000015.sdmp, rundll32.exe, 0000000A.00000002.4466303204.000000006BDA3000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\uninstall.pdbXX source: uninstall.exe0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppUpdate.pdbCC source: svcAppUpdate.exe, 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmp, svcAppUpdate.exe, 00000005.00000000.2149789521.00000000006B0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\windows_hook_64.pdb source: rundll32.exe, 0000000B.00000002.4459240973.00007FF8A9325000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\uninstall.pdb source: uninstall.exe0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\post_install.pdb source: post_install.exe, 00000004.00000000.2119366297.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp, post_install.exe, 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppInit.pdb source: svcAppInit.exe, 00000007.00000000.2189559977.0000000000818000.00000002.00000001.01000000.0000000D.sdmp, svcAppInit.exe, 00000007.00000002.4458028771.0000000000818000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\nt_system_service.pdbuu+4GCTL source: nt_system_service.exe, 00000009.00000002.4458728112.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, nt_system_service.exe, 00000009.00000000.2191105493.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: c:\releases\winpcap_4_1_3\winpcap\packetNtx\Dll\Project\Release No NetMon\x86\Packet.pdb source: rundll32.exe, 0000000A.00000002.4459330719.000000000434F000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppUpdate.pdb source: svcAppUpdate.exe, 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmp, svcAppUpdate.exe, 00000005.00000000.2149789521.00000000006B0000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\nt_system_service.pdb source: nt_system_service.exe, 00000009.00000002.4458728112.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp, nt_system_service.exe, 00000009.00000000.2191105493.00000000009B5000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\build\openssl-develop\packages\openssl-1.1.0\libcrypto.pdb source: svcAppLookup.exe, 00000008.00000002.4461735294.000000006BC6F000.00000002.00000001.01000000.00000018.sdmp, rundll32.exe, 0000000A.00000002.4465825694.000000006BC6F000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppInit.pdbNN source: svcAppInit.exe, 00000007.00000000.2189559977.0000000000818000.00000002.00000001.01000000.0000000D.sdmp, svcAppInit.exe, 00000007.00000002.4458028771.0000000000818000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\tools\vcpkg\buildtrees\protobuf\x86-windows-v140-rel\libprotobuf-lite.pdb source: rundll32.exe, 0000000A.00000002.4464191235.000000006A9CD000.00000002.00000001.01000000.0000001D.sdmp, libprotobuf-lite.dll0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\windows_hook.pdb source: antivirus_detector.exe, 00000002.00000002.4460746995.000000006A5EB000.00000002.00000001.01000000.0000002A.sdmp, svcAppLookup.exe, 00000008.00000003.2191222252.000000000123E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4463926030.000000006A5EB000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\build\release_static_ssl\win32\protocolfilters.pdb source: nt_system_service.exe, 00000009.00000002.4463173082.000000006C90B000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppLookup.pdbnn92GCTL source: svcAppLookup.exe, 00000008.00000000.2190159565.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe, 00000008.00000002.4458238469.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\svcAppLookup.pdb source: svcAppLookup.exe, 00000008.00000000.2190159565.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe, 00000008.00000002.4458238469.00000000006FE000.00000002.00000001.01000000.0000000E.sdmp, svcAppLookup.exe0.3.dr
Source:	Binary string: c:\releases\winpcap_4_1_3\winpcap\packetntx\driver\bin\amd64\npf.pdb source: main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\svcAppLookup.pdb source: svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\build\openssl-develop\packages\openssl-1.1.0\libssl.pdb== source: svcAppLookup.exe, 00000008.00000002.4462687887.000000006BDA3000.00000002.00000001.01000000.00000015.sdmp, rundll32.exe, 0000000A.00000002.4466303204.000000006BDA3000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: c:\releases\winpcap_4_1_3\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb source: rundll32.exe, 0000000A.00000002.4463801692.0000000010029000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: e:\PTHREADS\pthreads\pthreadVC.pdb source: pthreadVC.dll.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\svcAppInit.pdb source: rundll32.exe, 0000000A.00000002.4464986715.000000006B282000.00000002.00000001.01000000.0000001B.sdmp, svcAppInit.dll0.3.dr
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\release_fxs_production\antivirus_detector.pdb source: antivirus_detector.exe, 00000002.00000000.1990976682.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp, antivirus_detector.exe, 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: c:\build\workspace\Windows_build_test-Flexispy\codebase\extensions\ws_vs_2015\Release_Fxs_Production\svcAppLookup.pdbn source: svcAppLookup.exe, 00000008.00000002.4464223091.000000006C4F5000.00000002.00000001.01000000.00000011.sdmp

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Code function: 8_2_00682CE0 memset,_stat64i32,_CxxThrowException,new,GetModuleHandleA,GetProcAddress,GetLastError,GetLastError,LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError,

8_2_00682CE0

Source: libcrypto.dll.3.dr	Static PE information: section name: .00cfg
Source: libssl.dll.3.dr	Static PE information: section name: .00cfg
Source: libcrypto.dll0.3.dr	Static PE information: section name: .00cfg
Source: libssl.dll0.3.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: 2_2_00A06876 push ecx; ret	2_2_00A06889
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CED16 push ecx; ret	4_2_005CED29
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Code function: 5_2_006ADF26 push ecx; ret	5_2_006ADF39
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: 7_2_00814DE6 push ecx; ret	7_2_00814DF9
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006F95B6 push ecx; ret	8_2_006F95C9
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA1AF96 push ecx; ret	8_2_6BA1AFA9
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA4FF10 push ecx; mov dword ptr [esp], ecx	8_2_6BA4FF11
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA81E86 push ecx; ret	8_2_6BA81E99
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA59DD0 push ecx; mov dword ptr [esp], 00000000h	8_2_6BA59DD1
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA59D70 push ecx; mov dword ptr [esp], 00000000h	8_2_6BA59D71
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0097FE36 push ecx; ret	9_2_0097FE49
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C6D8105 push ecx; ret	9_2_6C6D8118
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C6CD83B push ecx; ret	9_2_6C6CD84E

Source: msvcr110.dll.0.dr

Static PE information: section name: .text entropy: 6.9113720938783825

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\80C410E174EDD8983D7ED0379677E2550BAF8511 Blob
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\80C410E174EDD8983D7ED0379677E2550BAF8511 Blob

Sample is not signed and drops a device driver

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\npf.sys			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\system32\drivers\npf.sys			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\nt_system_service.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoCrypto.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\pthreadVC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\PocoNetSSL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\Packet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\PocoCrypto.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\5006_2.6.2.exe	File created: C:\Windows\SysWOW64\msvcr110.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoNet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\System32\wpcap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\get_drop_files.exe	Jump to dropped file
Source: C:\Users\user\Desktop\5006_2.6.2.exe	File created: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\Packet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\pthreadVC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\wpcap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\libprotobuf-lite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\x64\wpcap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\certutil.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\ssleay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\PocoUtil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\libnspr4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\PocoNet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\libeay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssutil3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoFoundation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5006_2.6.2.exe	File created: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\PocoFoundation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\x64\Packet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\libnspr4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\nssutil3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoXML.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\smime3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\PocoJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\libssl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\libplc4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\System32\Packet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\ProtocolFilters.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook_64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\libcrypto.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsmE645.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\System32\drivers\npf.sys	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libprotobuf-lite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\smime3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoUtil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\npf.sys	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\windows_hook_64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\Windows Provisioning.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\nss\libplds4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\wpcap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\libcrypto.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\PocoXML.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoNetSSL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\libplc4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\nss\libplds4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\ProtocolFilters.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\ssleay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\svcAppUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\get_drop_files.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Program Files (x86)\Windows Provisioning\libs\libssl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\libeay32.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoCrypto.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoUtil.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoXML.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\libssl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5006_2.6.2.exe	File created: C:\Windows\SysWOW64\msvcr110.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoNet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\System32\wpcap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoNetSSL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\System32\Packet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\libcrypto.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\Packet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\ssleay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\pthreadVC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\PocoFoundation.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\wpcap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\SysWOW64\libeay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	File created: C:\Windows\System32\drivers\npf.sys	Jump to dropped file

Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe

File created: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt

Jump to behavior

Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe

Code function: 4_2_005C1B20 OpenSCManagerW,OpenServiceA,ChangeServiceConfig2W,StartServiceW,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

4_2_005C1B20

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

File deleted: c:\users\user\desktop\5006_2.6.2.exe

Jump to behavior

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtOpenFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: NtOpenFile new code: 0xE9 0x98 0x8B 0xB4 0x43 0x39

Source: C:\Users\user\Desktop\5006_2.6.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\nss\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\libs\pthreadVC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\nss\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\nss\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\msvcr110.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\temp\get_drop_files.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook_64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\pthreadVC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsmE645.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\npf.sys	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\libs\nss\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\nss\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\libs\npf.sys	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\windows_hook_64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\Windows Provisioning.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\libs\nss\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\libs\ssleay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ssleay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\libs\libeay32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Windows Provisioning\get_drop_files.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\libeay32.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-11406

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	API coverage: 4.1 %
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	API coverage: 8.6 %

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_00406313 FindFirstFileA,FindClose,	0_2_00406313
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_00402765 FindFirstFileA,	0_2_00402765
Source: C:\Users\user\Desktop\5006_2.6.2.exe	Code function: 0_2_004057D8 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004057D8
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: 2_2_009FD380 FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetLastError,	2_2_009FD380
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_00406313 FindFirstFileA,FindClose,	3_2_00406313
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_004057D8 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	3_2_004057D8
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	Code function: 3_2_00402765 FindFirstFileA,	3_2_00402765
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005C6A90 GetLastError,WTSQueryUserToken,SHGetFolderPathW,CloseHandle,GetLastError,SHGetSpecialFolderPathW,FindFirstFileW,_stat64i32,FindNextFileW,GetLastError,FindClose,GetLastError,	4_2_005C6A90
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005BAA30 GetFileAttributesA,FindFirstFileA,FindNextFileA,remove,FindNextFileA,FindClose,GetLastError,	4_2_005BAA30
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005BA790 Sleep,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,GetLastError,	4_2_005BA790
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C687A00 FindFirstFileW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,	9_2_6C687A00
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C655780 _memset,Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,	9_2_6C655780
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C655ED0 _memset,Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception,ExpandEnvironmentStringsW,Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception,FindFirstFileW,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,FindClose,EnterCriticalSection,LeaveCriticalSection,	9_2_6C655ED0

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Code function: 8_2_006A0910 GetSystemInfo,

8_2_006A0910

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\

Source: antivirus_detector.exe, 00000002.00000002.4459215588.00000000012A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8Nv
Source: rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX
Source: antivirus_detector.exe, 00000002.00000002.4460394106.000000000484F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: antivirus_detector.exe, 00000002.00000002.4460394106.000000000484F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`
Source: nt_system_service.exe, 00000009.00000002.4460150594.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.4458104055.000001B7C5F68000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2205048101.0000000001167000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\5006_2.6.2.exe	API call chain: ExitProcess graph end node	graph_0-3120
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe	API call chain: ExitProcess graph end node	graph_3-3172
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Code function: 2_2_00A06647 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00A06647

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe

Code function: 9_2_6C6E9F71 EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

9_2_6C6E9F71

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Code function: 8_2_00682CE0 memset,_stat64i32,_CxxThrowException,new,GetModuleHandleA,GetProcAddress,GetLastError,GetLastError,LoadLibraryA,GetProcAddress,FreeLibrary,GetLastError,

8_2_00682CE0

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe

Code function: 9_2_009846E0 GetProcessHeap,HeapFree,

9_2_009846E0

Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: 2_2_00A06154 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00A06154
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: 2_2_00A06647 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00A06647
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Code function: 2_2_00A067D9 SetUnhandledExceptionFilter,	2_2_00A067D9
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CE2E3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_005CE2E3
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CEA95 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_005CEA95
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Code function: 4_2_005CEC27 SetUnhandledExceptionFilter,	4_2_005CEC27
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Code function: 5_2_006ADD27 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_006ADD27
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Code function: 5_2_006ADE86 SetUnhandledExceptionFilter,	5_2_006ADE86
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Code function: 5_2_006AD744 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_006AD744
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: 7_2_00814B9B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00814B9B
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: 7_2_008143F1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_008143F1
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Code function: 7_2_00814CFA SetUnhandledExceptionFilter,	7_2_00814CFA
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006F93B7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_006F93B7
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006F9516 SetUnhandledExceptionFilter,	8_2_006F9516
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_006F8CE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_006F8CE4
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA1B25B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_6BA1B25B
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA1B4D2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6BA1B4D2
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA8239A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6BA8239A
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0097F7E1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0097F7E1
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_0097F9E0 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0097F9E0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_6C6D02C0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_6C6D02C0

Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 119.8.47.97 443

Installs a global get message hook

Source: C:\Windows\SysWOW64\rundll32.exe	Windows user hook set: 0 get message C:\Program Files (x86)\Windows Provisioning\windows_hook.dll
Source: C:\Windows\System32\rundll32.exe	Windows user hook set: 0 get message C:\Program Files (x86)\Windows Provisioning\windows_hook_64.dll

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Process created: C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe "C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1

Jump to behavior

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe

Code function: 9_2_0097E650 CreateEventW,ConvertStringSecurityDescriptorToSecurityDescriptorW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,LocalFree,CloseHandle,

9_2_0097E650

Source: rundll32.exe, 0000000A.00000002.4458563035.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8+kProgram Manager
Source: rundll32.exe, 0000000A.00000002.4459759875.000000000488A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Code function: 2_2_00A0649D cpuid

2_2_00A0649D

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: GetModuleFileNameW,___crtMessageBoxW,GetStdHandle,_strlen,WriteFile,__invoke_watson,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,		9_2_6C6DA4FC
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,		9_2_6C6EA2ED

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Users\user\AppData\Roaming\Windows Provisioning\version.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Users\user\AppData\Roaming\Windows Provisioning\version.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook_64.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\nt_system_service.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\nt_system_service.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook_64.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook_64.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\get_drop_files.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\get_drop_files.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\get_drop_files.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\get_drop_files.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoCrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoCrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoCrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoFoundation.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoFoundation.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoFoundation.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoJSON.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoJSON.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoJSON.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoNet.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoNet.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoNet.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoNetSSL.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoNetSSL.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoNetSSL.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoUtil.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoUtil.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoUtil.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoXML.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoXML.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\PocoXML.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\libcrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\libcrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\libcrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\libssl.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\libssl.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Windows\SysWOW64\libssl.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\ProtocolFilters.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\ProtocolFilters.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\ProtocolFilters.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libprotobuf-lite.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\libprotobuf-lite.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libprotobuf-lite.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\certutil.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\freebl3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\freebl3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\freebl3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libnspr4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\libnspr4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libnspr4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libplc4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\libplc4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libplc4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libplds4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\libplds4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libplds4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nss3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\nss3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nss3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssckbi.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssckbi.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssckbi.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssdbm3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssdbm3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssdbm3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssutil3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssutil3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssutil3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\smime3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\smime3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\smime3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\softokn3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\softokn3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\softokn3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\post_install.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\post_install.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_update_service.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_update_service.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_update_service.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_update_service.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_update_service.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_update_service.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_update_service.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_update_service.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\nt_system_service.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\nt_system_service.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\windows_hook_64.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\Packet.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\wpcap.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\pthreadVC.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\System32\drivers\npf.sys VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\System32\Packet.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\System32\wpcap.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoCrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoCrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoCrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoFoundation.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoFoundation.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoFoundation.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoJSON.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoJSON.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoJSON.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoNet.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoNet.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoNet.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoNetSSL.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoNetSSL.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoNetSSL.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoUtil.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoUtil.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoUtil.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoXML.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\PocoXML.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\PocoXML.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\libcrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\libcrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\libcrypto.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\libssl.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\libssl.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Windows\SysWOW64\libssl.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\configurations.dat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\app_data\configurations.dat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\app_data\configurations.dat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\configurations.dat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\ProtocolFilters.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\ProtocolFilters.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\ProtocolFilters.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libprotobuf-lite.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\libprotobuf-lite.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libprotobuf-lite.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\certutil.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\freebl3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\freebl3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\freebl3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libnspr4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\libnspr4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libnspr4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libplc4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\libplc4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libplc4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libplds4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\libplds4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\libplds4.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nss3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\nss3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nss3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssckbi.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssckbi.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssckbi.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssdbm3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssdbm3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssdbm3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssutil3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\nssutil3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\nssutil3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\smime3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\smime3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\smime3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\softokn3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\softokn3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\softokn3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\libs\nss\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\nss\sqlite3.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\gutype.dat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\gutype.dat VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\windows_hook_64.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_proc_mon.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_proc_mon.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_proc_mon.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_proc_mon.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_proc_mon.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_proc_mon.txt VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Queries volume information: C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe

Code function: 9_2_0097E650 CreateEventW,ConvertStringSecurityDescriptorToSecurityDescriptorW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,LocalFree,CloseHandle,

9_2_0097E650

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Code function: 2_2_00A0688B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_00A0688B

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Code function: 8_2_0068A2B0 GetUserNameW,

8_2_0068A2B0

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe

Code function: 9_2_008B2C30 GetTimeZoneInformation,memset,memset,

9_2_008B2C30

Source: C:\Users\user\Desktop\5006_2.6.2.exe

Code function: 0_2_0040326B EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040326B

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db-journal
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db-journal
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db-journal
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db

Source: antivirus_detector.exe, 00000002.00000003.2056640258.000000000128F000.00000004.00000020.00020000.00000000.sdmp, antivirus_detector.exe, 00000002.00000002.4459215588.0000000001262000.00000004.00000020.00020000.00000000.sdmp, antivirus_detector.exe, 00000002.00000003.2056668872.0000000004866000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF\key4.db-journal
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF\cert9.db
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF\pkcs11.txt
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF\cert9.db-journal
Source: C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF\key4.db

Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA53980 ?removeEventListener@EventDispatcher@XML@Poco@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAVEventListener@23@_N@Z,	8_2_6BA53980
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA46F80 ?removeEventListener@AbstractNode@XML@Poco@@UAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAVEventListener@23@_N@Z,?removeEventListener@EventDispatcher@XML@Poco@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAVEventListener@23@_N@Z,	8_2_6BA46F80
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA53C70 ??1EventListener@XML@Poco@@MAE@XZ,	8_2_6BA53C70
Source: C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe	Code function: 8_2_6BA533F0 ??0EventListener@XML@Poco@@QAE@ABV012@@Z,	8_2_6BA533F0
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00972F20 bind,WSAGetLastError,connect,	9_2_00972F20
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00971380 WSASocketW,setsockopt,htonl,bind,getsockname,htonl,htonl,htonl,listen,WSASocketW,connect,ioctlsocket,setsockopt,ioctlsocket,setsockopt,	9_2_00971380
Source: C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe	Code function: 9_2_00977990 setsockopt,bind,listen,	9_2_00977990

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	31 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	2 Network Sniffing	1 Account Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	24 Windows Service	11 Access Token Manipulation	3 Obfuscated Files or Information	31 Credential API Hooking	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	Login Hook	24 Windows Service	1 Install Root Certificate	NTDS	2 Network Sniffing	Distributed Component Object Model	31 Credential API Hooking	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	113 Process Injection	1 Software Packing	LSA Secrets	47 System Information Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	61 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Rootkit	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	32 Masquerading	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Valid Accounts	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	113 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood
Identify Business Tempo	Botnet	Hardware Additions	Python	Hypervisor	Process Injection	1 Rundll32	Credential API Hooking	Domain Groups	Exploitation of Remote Services	Remote Email Collection	External Proxy	Transfer Data to Cloud Account	Reflection Amplification

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
C:\Program Files (x86)\Windows Provisioning\ProtocolFilters.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\ProtocolFilters.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libprotobuf-lite.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libprotobuf-lite.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\Packet.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\Packet.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\PocoCrypto.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\PocoCrypto.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\PocoFoundation.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\PocoFoundation.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\PocoJSON.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\PocoJSON.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\PocoNet.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\PocoNet.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\PocoNetSSL.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\PocoNetSSL.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\PocoUtil.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\PocoUtil.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\PocoXML.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\PocoXML.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\ProtocolFilters.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\ProtocolFilters.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\libcrypto.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\libcrypto.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\libeay32.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\libeay32.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\libprotobuf-lite.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\libprotobuf-lite.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\libssl.dll	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\libssl.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Windows Provisioning\libs\npf.sys	0%	ReversingLabs
C:\Program Files (x86)\Windows Provisioning\libs\npf.sys	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
push.mobilefonex.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://push.mobilefonex.comc	0%	Avira URL Cloud	safe
https://portal.mobilebackup.biz/help/en/install/pc/configure-exclusions-for-windows.htmlhttps://port	0%	Avira URL Cloud	safe
https://bridge.sfo1.ap01.nXnm	0%	Avira URL Cloud	safe
http://www.appinf.com/features/enable-partial-reads	0%	Avira URL Cloud	safe
https://portal.mobilebackup.biz/help/en/install/pc/common-anti-virus-program-instructions-for-adding	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
http://client.mobilefonex.com/gateway	0%	Avira URL Cloud	safe
http://client.mobilefonex.com/gateway/unstructureda	0%	Avira URL Cloud	safe
https://portal.mobilebackup.biz/help/en/install/pc/configure-exclusions-for-windows.htmlhttps://port	2%	Virustotal		Browse
http://www.appinf.com/features/enable-partial-readsCannot	0%	Avira URL Cloud	safe
http://www.appinf.com/features/enable-partial-readsent-contentJ	0%	Avira URL Cloud	safe
http://www.appinf.com/features/enable-partial-reads	0%	Virustotal		Browse
http://.jpg	0%	Avira URL Cloud	safe
http://client.mobilefonex.com/gateway/unstructured	0%	Avira URL Cloud	safe
http://www.appinf.com/features/no-whitespace-in-element-content	0%	Avira URL Cloud	safe
https://push.mobilefonex.com/?encoding=utf8	0%	Avira URL Cloud	safe
http://www.appinf.com/features/enable-partial-readsCannot	0%	Virustotal		Browse
http://www.appinf.com/features/enable-partial-readsent-contentJ	0%	Virustotal		Browse
https://imp.mt48.net/static?id=7RHzfOIX	0%	Avira URL Cloud	safe
http://client.mobilefonex.com/gateway/unstructuredy	0%	Avira URL Cloud	safe
http://client.mobilefonex.com/gateway	0%	Virustotal		Browse
http://client.mobilefonex.com/gateway/unstructured	0%	Virustotal		Browse
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://push.mobilefonex.com	0%	Avira URL Cloud	safe
http://client.mobilefonex.com/gatewayV	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs	0%	Avira URL Cloud	safe
https://portal.mobilebackup.biz/help/en/install/pc/configure-exclusions-for-windows.html	0%	Avira URL Cloud	safe
http://www.appinf.com/features/no-whitespace-in-element-content	0%	Virustotal		Browse
http://www.appinf.com/features/no-whitespace-in-element-contentS	0%	Avira URL Cloud	safe
https://push.mobilefonex.com	0%	Virustotal		Browse
http://www.appinf.com/features/no-whitespace-in-element-contentS	0%	Virustotal		Browse
https://portal.mobilebackup.biz/help/en/install/pc/configure-exclusions-for-windows.html	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
push.mobilefonex.com	119.8.47.97	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://push.mobilefonex.com/?encoding=utf8	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://html4/loose.dtd	nt_system_service.exe, 00000009.00000002.4463173082.000000006C90B000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	low
http://www.appinf.com/features/enable-partial-reads	svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://push.mobilefonex.comc	svcAppLookup.exe, 00000008.00000002.4458821210.0000000001285000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://portal.mobilebackup.biz/help/en/install/pc/configure-exclusions-for-windows.htmlhttps://port	antivirus_detector.exe, 00000002.00000000.1990976682.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp, antivirus_detector.exe, 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.nXnm	nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/V	svcAppLookup.exe, 00000008.00000002.4462048125.000000006BCB7000.00000002.00000001.01000000.00000018.sdmp, svcAppLookup.exe, 00000008.00000002.4462749493.000000006BDBD000.00000002.00000001.01000000.00000015.sdmp, rundll32.exe, 0000000A.00000002.4465966699.000000006BCB7000.00000002.00000001.01000000.00000018.sdmp, rundll32.exe, 0000000A.00000002.4466342443.000000006BDBD000.00000002.00000001.01000000.00000015.sdmp, libeay32.dll0.3.dr	false		high
http://xml.org/sax/features/namespaces&	rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://portal.mobilebackup.biz/help/en/install/pc/common-anti-virus-program-instructions-for-adding	antivirus_detector.exe	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEprng	libeay32.dll0.3.dr, libeay32.dll.3.dr	false		high
http://xml.org/sax/features/string-interningG	svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xml.org/sax/features/namespace-prefixes	svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	false		high
http://.css	nt_system_service.exe, 00000009.00000002.4463173082.000000006C90B000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	low
http://xml.org/sax/features/validationX	svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xml.org/sax/features/string-interning	svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	false		high
http://xml.org/sax/features/external-parameter-entities	svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	false		high
http://www.openssl.org/support/faq.html	libeay32.dll0.3.dr, libeay32.dll.3.dr	false		high
http://xml.org/sax/features/namespace-prefixes3	svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://client.mobilefonex.com/gateway	rundll32.exe, 0000000A.00000002.4459759875.000000000488A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp	false		high
http://x1.c.lencr.org/0	certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://client.mobilefonex.com/gateway/unstructureda	rundll32.exe, 0000000A.00000002.4459759875.000000000488A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&re	nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.appinf.com/features/enable-partial-readsCannot	svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, PocoXML.dll0.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.appinf.com/features/enable-partial-readsent-contentJ	rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://.jpg	nt_system_service.exe, 00000009.00000002.4463173082.000000006C90B000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	low
http://client.mobilefonex.com/gateway/unstructured	rundll32.exe, 0000000A.00000002.4459759875.000000000488A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://xml.org/sax/properties/lexical-handlerQ	rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.appinf.com/features/no-whitespace-in-element-content	PocoXML.dll0.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.openssl.org/docs/faq.html	rundll32.exe, 0000000A.00000002.4465825694.000000006BC6F000.00000002.00000001.01000000.00000018.sdmp	false		high
http://xml.org/sax/features/external-general-entities	svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	false		high
http://ocsp.thawte.com0	main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp	false	URL Reputation: safe	unknown
http://xml.org/sax/features/external-general-entitiesn	rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xml.org/sax/features/namespaces	svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIX	nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://client.mobilefonex.com/gateway/unstructuredy	rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://push.mobilefonex.com	rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000A.00000002.4459759875.0000000004845000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	5006_2.6.2.exe	false		high
http://maps.google.com/?q=	svcAppInit.dll0.3.dr	false		high
http://client.mobilefonex.com/gatewayV	rundll32.exe, 0000000A.00000002.4458563035.00000000009AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developers.google.com/protocol-buffers/	rundll32.exe, 0000000A.00000002.4464252813.000000006AA02000.00000002.00000001.01000000.0000001D.sdmp, libprotobuf-lite.dll0.3.dr	false		high
http://nsis.sf.net/NSIS_Error	main_installer.exe, main_installer.exe, 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmp, main_installer.exe, 00000003.00000000.2085500259.000000000040A000.00000008.00000001.01000000.00000008.sdmp, 5006_2.6.2.exe	false		high
http://xml.org/sax/features/namespace-prefixesx	rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xml.org/sax/properties/declaration-handler	svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000121A000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs	nt_system_service.exe, 00000009.00000002.4460150594.00000000013D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	certutil.exe, 0000000C.00000003.2199415266.00000000022DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2201853866.00000000022EB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000003.2203013749.0000000001C9B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://xml.org/sax/features/validation	svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	false		high
https://portal.mobilebackup.biz/help/en/install/pc/configure-exclusions-for-windows.html	antivirus_detector.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.appinf.com/features/no-whitespace-in-element-contentS	rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://xml.org/sax/properties/lexical-handler	svcAppLookup.exe, svcAppLookup.exe, 00000008.00000002.4458821210.000000000126C000.00000004.00000020.00020000.00000000.sdmp, svcAppLookup.exe, 00000008.00000002.4461246118.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4465587996.000000006BA87000.00000002.00000001.01000000.00000019.sdmp, rundll32.exe, 0000000A.00000002.4458563035.000000000097A000.00000004.00000020.00020000.00000000.sdmp, PocoXML.dll0.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
119.8.47.97	push.mobilefonex.com	Singapore		136907	HWCLOUDS-AS-APHUAWEICLOUDSHK	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1412313
Start date and time:	2024-03-20 11:49:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5006_2.6.2.exe
Detection:	MAL
Classification:	mal54.phis.bank.adwa.spyw.evad.winEXE@17/121@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 171 Number of non-executed functions: 193
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:50:16	API Interceptor	1x Sleep call for process: post_install.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
119.8.47.97	android.apk	Get hash	malicious	Unknown	Browse
119.8.47.97	android.apk	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HWCLOUDS-AS-APHUAWEICLOUDSHK	ocs-office.exe	Get hash	malicious	Unknown	Browse	119.8.87.215
	5WTG6N45CH.elf	Get hash	malicious	Mirai	Browse	159.138.222.4
	aA8sPbK4EG.elf	Get hash	malicious	Moobot	Browse	119.8.64.12
	zpIXM3FqqH.elf	Get hash	malicious	Mirai	Browse	119.8.39.77
	huhu.arm5-20240212-0910.elf	Get hash	malicious	Mirai, Okiru	Browse	119.8.40.42
	https://kso.page.link/wps	Get hash	malicious	Unknown	Browse	114.119.189.26
	skyljne.mips.elf	Get hash	malicious	Mirai	Browse	119.8.88.17
	TqA3GrJsfl.elf	Get hash	malicious	Mirai	Browse	119.10.40.126
	https://us.docs.wps.com/module/common/loadplatform?sa=16&st=0t&sid=sicb8ypvckj3kqqy&v=v2	Get hash	malicious	Unknown	Browse	159.138.103.235
	xd.arm.elf	Get hash	malicious	Mirai	Browse	159.139.52.126

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Windows Provisioning\libs\Packet.dll	https://www.winpcap.org/install/default.htm	Get hash	malicious	Unknown	Browse
	Je7wwdubnQ.exe	Get hash	malicious	PrivateLoader	Browse
	https://dl.weintek.com/EBPro/Installer/EBproV60801350.zip	Get hash	malicious	Unknown	Browse
	ywvz5i8kT9.exe	Get hash	malicious	Unknown	Browse
	vcredist_2010.exe	Get hash	malicious	Unknown	Browse
	vcredist_2010(1).exe	Get hash	malicious	Unknown	Browse
	v.exe	Get hash	malicious	Unknown	Browse
	okIQd4f03Z.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Windows Provisioning\ProtocolFilters.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3825664
Entropy (8bit):	6.807627061589882
Encrypted:	false
SSDEEP:	49152:Wh0gMp73LnCRWdDnAdGJS7jgrHls8v9udNgdJ0TDMQtzASPrxqTAqBSXbKUJow:gMt3LnU47A48IrHK8v92NYQ66
MD5:	043AD966D71FA7E4821AAD0597F76575
SHA1:	19B59EF247DFE026074F53AF45B97E3D03106F9A
SHA-256:	3316A4E7CB195346D89369D9B2C6DD17559E09ADA31DB1B40989A4388D4872E3
SHA-512:	9678368E1FF25668C8DAC7175CFB993A63805EC14115D7141659D0D949113FC044A469B764C60BA091318BAE674068009FCAF1035758175E3675A3CAB6DA7472
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.rc~g.0~g.0~g.0~g.0fg.0...0xg.0...0\g.0...06g.0...0.g.0~g.0.g.0...0sg.0]..0\d.0]..0Ug.0...0.g.0...0.g.0...0.g.0Rich~g.0................PE..L......d...........!......+.........R.........+...............................:...........@...........................7.&.....7.......8.p.....................8.,.....+.8...........................P.6.@.............+..............................text....+.......+................. ..`.rdata..6.....+.......+.............@..@.data...`.....7.......7.............@....rsrc...p.....8......h8.............@..@.reloc........8......l8.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\Windows Provisioning.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112128
Entropy (8bit):	5.990046438461227
Encrypted:	false
SSDEEP:	3072:IAtQBF1id2yPE29M3E+05UEl1NotPVEe:IA+82Yed05UEl8FV
MD5:	548036F96AC135024FF7C53F0358C1E8
SHA1:	8ECD85A5372F4AEABA5F2599EB3064EDE1938606
SHA-256:	42BF844B41C70DDFF4BDC0C42164CC5BC730B333444C6232953774FC56136D25
SHA-512:	9BFCD1C6951C3CE1C24C93A14D2A601B489A47E2A810B5E05E9EC458934FBBF5BEE3106626906FC30CB1FB642A5DD32E7D12787D307A9B3F7383816B8D73D196
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I.R.(...(...(...P ..(...v...(...v...(...v...(...v...(....x..(...(...(..Mv...(..HvL..(...($..(..Mv...(..Rich.(..........................PE..L...hZ.e..................................... ....@.......................................@..................................%.......P..`.......................L....!..p............................"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....gfids.. ....@....... ..............@..@.rsrc...`....P......."..............@..@.reloc..L...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\app_data\cfg_tmp.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3914
Entropy (8bit):	4.082468935947237
Encrypted:	false
SSDEEP:	48:3kEGCp3zaGCD3rGCD30Y4MClATKr43it1S6D3v:UETp3zaTD3rTD3lveAG0ie6D3v
MD5:	D5B737AA65B724174DD84D632C253283
SHA1:	EB2A88BB8F4781960BD05357B8D79F1248EC26DC
SHA-256:	8AD57696ED5E5CF422BAF5A21AA3738103FCE8269BAE5C605313CB14FBCCA535
SHA-512:	B5E2E99910E836C7F76F51756FFBB5E9AC406D64974435C038B6FE2270ED6815BEA03495CC8FCC94707E458E37765181393DAB30CBBA583D7F78B590C372760F
Malicious:	false
Reputation:	low
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configurations date="11/10/2023 13:42:14" pid="5006">.. <configuration id="-1">.. <features />.. <remote_commands>.. <cmd id="92">.. <settings>.. <setting id="76" />.. </settings>.. </cmd>.. <cmd id="147" />.. <cmd id="148" />.. <cmd id="149" />.. <cmd id="200" />.. <cmd id="226" />.. <cmd id="400" />.. <cmd id="401" />.. <cmd id="404" />.. <cmd id="14144" />.. <cmd id="14587" />.. </remote_commands>.. </configuration>.. <configuration id="-2">.. <features />.. <remote_commands>.. <cmd id="2" />.. <cmd id="92">.. <settings>.. <setting id="76" />.. </settings>.. </cmd>.. <cmd id="147" />.. <cmd id="148" />.. <cmd id="149" />.. <cmd id="200" />.. <cmd id="226" />.. <cmd id="400" />.. <cmd id="401" />.. <cmd id="404" />.. <cmd id="14142" />.. <cmd id="14587" /

C:\Program Files (x86)\Windows Provisioning\app_data\configurations.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	data
Category:	dropped
Size (bytes):	3920
Entropy (8bit):	7.948224416130811
Encrypted:	false
SSDEEP:	96:C5n4zBDEo17hoeYkmElrYsF7Zf7W+h6d/bDgcYohEWgctH:C5n4FDJhoHAb71C/dYcphbPtH
MD5:	F8927576A49A96D59413C1BC6ED58A33
SHA1:	BF961F9797E3A2D4165F39438858CB896F413A46
SHA-256:	B625A8694B4E4D3E360BD153C30DE8851567187F179E988B077AE6F36D2DF5CC
SHA-512:	2337FDDD87B4F94E2FF265C8EA32ACF9E9103FCF263E4D5F0DFFD08DC5329CEC16332EA93F8E796D29E19DAAF933DF6FAECE73C191D0CB92261FB29B5516CFCB
Malicious:	false
Reputation:	low
Preview:	..H..U.F\|.\..5.\<....0.d...b>..C..P...7Tw...lc.......f_9h\|k..)?...n..H`4....pPti..d..e..Xm......+e....`.ct...rp.,q3.5i.._..c.j....w0..25.:.x.9..E<:D.].Maa.....Bf...n&......J..k...@E.JA.....T..m..K.......2..1.....I0.6r.K...fX.+..g..s......F..B.....p.z$..ru..d....WY.V....\.....G.....j..5S..`.m.u.F.,....k......L....R..\.."..?R..z...._[....L.@+..........g....,.RT0....\|oD..U...e..Ed.>....h.u$...n.-..h.........xU;./g.p.......U.S....-..L...y..O.K..<#._j4U.{x....0T.....gS.......i.L.B.SE.\|.s.......DU-....p.1.3\|jB.e..K._.OG..D.......u\...D...:..J...x-...D...Jl. .im.hz.....L.,.{.(.SG..(.k.}(cZ..z....C.Sf......0..2{4.....3......7..'...0.5,."Woc=`.Y.3..Rn5.S.`..fx..I_d.\|V!w3.u..K..B......0...fT..c.....U...r.....z`.. ..I ...1..Wu2..;..(>..@..f...f.#..)..2........\|.).....3u.d...&........:..X...~...l.(..._.;zf.Y...p...d.Ct....e......].u...5j.?.3..2.y2.Er.Y?....f.i.J..Xo.TA%O.6.}.....7.....&.6]Fy&<....9..O..\..g@_...8u..p...1h.n.....

C:\Program Files (x86)\Windows Provisioning\app_data\ddmstore.db

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3007015, page size 1024, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.5050212272099597
Encrypted:	false
SSDEEP:	12:HLiuWkK2TSFlyoR+7Fx9GgCWRKyqFokqoACh4:riuWR22Z+79GgCWR9Wqg
MD5:	2EEAF9E158F6311631319A26F9C0364B
SHA1:	251AC38DABCEE08D70A7C67C1A7DC70BF09E5D23
SHA-256:	0D9CF6E47F075A17269610364ACEF5F695AC756B29587B98CF4562930A44814B
SHA-512:	4CBEA29E335DAF36F2192D979ABDB2F86DAC7D7E28DA95CC82F107E5A94368DA1D1EEA708051C3450D27E38F6771F7EFAB12100AAF3E96325938B9982A5209FE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .........................................................................-.'......+..}.+...........................................................................................................................................................................................................................................................................................................................................................................................................................................................P...++.Ytablesqlite_sequencesqlite_sequence.CREATE TABLE sqlite_sequence(name,seq).........gtableddmddm.CREATE TABLE ddm (_id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, caller_id INTEGER, cmd_id INTEGER, priority_request INTEGER, delivery_request_type INTEGER, csId INTEGER, ready_to_resume BOOLEAN, retry_count INTEGER, max_retry_count INTEGER, data_provider_type INTEGER, is_require_encryption INTEGER, is_require_compression INTEG

C:\Program Files (x86)\Windows Provisioning\app_data\ddmstore.db-journal

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/eO/Hlxll:7+/l/N
MD5:	7251CD0E49FFAD27B66AD762FA37848D
SHA1:	F96A0508B6DC44F625B699820D59C3DF5E369185
SHA-256:	3C896A2F3224BD103FC69722060D6F668DAD8F32A424F899AA7836383ED390EE
SHA-512:	A7299F297D5F50BFA0A15DB27AC31F6D7712E847444858283D7A764B37C027634B2B026470269BD3EA3023A77C6ED7F20D3FAB08892C087F7E33CDEA568CD3C1
Malicious:	false
Reputation:	low
Preview:	.... .c.......V.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\app_data\de_netfilter\SSL\DigiCert SHA2 Extended Validation Server CA 3.cer

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.4018997881528765
Encrypted:	false
SSDEEP:	24:pEqbCsPw0qbCst7NVM+uAR2CPxAoyG7G4WF:asCWNsCQN2DAR2CPOxIGLF
MD5:	352FAD67617A81520B7E98AAC865F70D
SHA1:	80C410E174EDD8983D7ED0379677E2550BAF8511
SHA-256:	3354D8B378827219893C2E1C9C0D32021BC3ADC494D1D0FE385952F52DEF6A4B
SHA-512:	D57F124D15F7D88F1DB13421418937E525859C998333DEED8A2EE4EBB9FAD5D04710F8FBC536C2F52D33C76AE2C69A7C49E58E25FAE4040CDB6AFB45085820BD
Malicious:	false
Reputation:	low
Preview:	0..:0.."..........&Z....w.=Y..II0....H........0E1.0...U....EN1604..U...-DigiCert SHA2 Extended Validation Server CA 30 ..040325105017Z..20640310105017Z0E1.0...U....EN1604..U...-DigiCert SHA2 Extended Validation Server CA 30.."0....H.............0............q.EN....a.k.,:..H.L.d1".{q.a..Z$^l3'..\....!..4.9..M..d....3V11,.p...&Q1.^T.c/Q..d.p%...7..rX0...W@...`.{l..\|...2r......'X..o.8....B...7.k.K.R.I.7..\SL..u.C.(..,.9..sFK.....s....}[...........w.s...&qrr9.....I..Q......a\|..,.j.....u.!........#0!0...U.......0....0...U...........0....H..............^...T?...5Q..A4.3.A._.8..'..e.....gU...f...b.C.t.l-\|..[. ..f.6$...AC..O.X./,z;.........J1;..[F..B.....`p.D~`r......I~~..=9..Cb.>.k..w............Y.l..N....N..15J..~:.B../.W...L.q.2..N..._...=._...+~.{.'.h0;..E.1.r..}..\.%.\|:....YK7.I..

C:\Program Files (x86)\Windows Provisioning\app_data\de_netfilter\SSL\cert.db

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe
File Type:	Applesoft BASIC program data, first line number 45
Category:	dropped
Size (bytes):	2093
Entropy (8bit):	7.888828784909139
Encrypted:	false
SSDEEP:	24:/Rel4w1bApKvhcRS94F/5UlFAaYhFf9kOEvlNGAmKtSrIXqHFzw+Eie+p+SwuaQz:/8l96pGz94F/5Iwxq9Sr/H9JEiJp+wnz
MD5:	6A9E1E692A2BB6AEEB201564B9360880
SHA1:	CCA9C2F8038777D207809FE722BDE6BE3B03CEF8
SHA-256:	A92D75583EEA6101634E30981870E7C8C56E56AF1F2A7B0BCD704B29983959DF
SHA-512:	53B36B3FB1B21146B370B6032B6782EE45DF430E30A17C38B8CDE8E38AAF8A6C24600B275987083529BFFE2816086305CADF4028E291CC000519F227F2B8C2C6
Malicious:	false
Reputation:	low
Preview:	-.-.>...........digicert sha2 extended validation server ca 3.-..s.Z....$.....s..J..<..}..C...q..o..<....X...T.w../.czX1.6. .D.)p....9z&.u..d....=..y.v.q.G.4$.yw.......tTk.=.n.@.........H.J......I.i......mJM..r{...m..jp.^..$...Q.U..u..&..cgy..>.[...F...h.J.^.t.&..,...oj.%.j..b.6SfLG..{..O.......D....j.....3(.fu.R. .....%..Ot.$.;=.d'.,.V.x.%.N.\..em..\|.qW..;e...K..gC0L.)O...X.<fi.Y..D...$...6..i....a..."...Y5..+.7j.-...\|.@.r.b......k'..B..g...s...+4+.n....%.....\|y.....`.;.+.......v..\..).5.4.5.<.MFP...{m;.gi......#.....c..{..1[......H6R..(`{..m..s.....bA.zD...J.KI\.n.<<.Q..o_3...tF.&......i...r...Q.gX5(...u..SW...X.@..l..ep&.nA..9..'...r:r.Q...0.....X......z!...d...!.b...."PV7s.....-...3K.y..Z-.e.d.7..s..8.w./..iu1..r.W.~U....q..r..@.M.w..Z%.$.\|.n.\.v.x3.U,.'.[..R.C.[d1_.mP.5Y#Q=.0.eEX.Eh.D..7f....?.....o.gx..T7.l...i<.J........NH...w.{5ra.UJ./..."..!>.{.<...$${...=!.$_.....q..........7.........W..8sZ..-.?J.....II......~.P..%,..j[F...}...W.

C:\Program Files (x86)\Windows Provisioning\app_data\phoenix_db.db

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3007015, page size 1024, file counter 3, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	2.4492424966568014
Encrypted:	false
SSDEEP:	48:Qx2BS0AMrXGPTox2BS0AMrXGPTv2DHny3:ZAi2LBAi2L3
MD5:	9798AFE5FA7E3D46472B3E5AAA8AEA11
SHA1:	40F3F986F9ACF936104A06C20F44BBFE3822087B
SHA-256:	45DCD3DF48218D9A953476B780C085D84A0F0CEB384C56EBEBE751B5603F3E7E
SHA-512:	AF66782033789EB5D1101937384419FF0BFF5F8126F34862549FFEEB3E86628C475C43AF3F982B04AC822095B948AD0E259EFAB9EF0AB06C1F612FDABC427EE5
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .........................................................................-.'.................................................................................................................))..Ctablecsid_generatorcsid_generator.CREATE TABLE csid_generator (BASE_ID INTEGER PRIMARY KEY AUTOINCREMENT,latest_csid INTEGER)P...++.Ytablesqlite_sequencesqlite_sequence.CREATE TABLE sqlite_sequence(name,seq).T...++.._tablephoenix_sessionphoenix_session.CREATE TABLE phoenix_session (BASE_ID INTEGER PRIMARY KEY AUTOINCREMENT,csid INTEGER,ready_flag INTEGER, payload_path TEXT, payload_size INTEGER, payload_crc INTEGER, public_key BLOB, ssid INTEGER, aes_key BLOB, protocol_version INTEGER, product_id INTEGER, product_version TEXT, config_id INTEGER, device_id TEXT, activate_code TEXT, language INTEGER, phone_number TEXT, mcc TEXT, mnc TEXT, imsi TEXT, host_url TEXT, encrypt_code INTEGER, compress_code INTEGER, has_virtual_payload INTEGER, virtual_payload_attributes BLOB, conn

C:\Program Files (x86)\Windows Provisioning\app_data\phoenix_db.db-journal

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	1544
Entropy (8bit):	4.014400059384823
Encrypted:	false
SSDEEP:	12:7+t1l/+LCgXc7LEr9XhTSFlyy+WFAVb9XQW2eaNbC3EL8MrRXFLsrPdR4a1Kw3ta:7+t1Z8LcMRXh2lrSbLUAMrXLKP7P1J2F
MD5:	693721DB697E121AD5FFDBB5ADEA39BD
SHA1:	B63CEDA6A7092ABBF00CCFC6013A8D0DDAF7464A
SHA-256:	0D628F06C915CF720484AFF8526274FCEC8AAAD609F0071057721001AED444F6
SHA-512:	08EFA78E4F0224AA82FC5DFF87D220DF9E829F1099B1F982314F201E9F982D8CC23C1E8D60B1E71D0A7C9B281F7C8EE11FC4A13BBBCBF54657FF6D83F7890374
Malicious:	false
Preview:	.... .c......6m.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .........................................................................-.'...........W.....................................................................................................))..Ctablecsid_generatorcsid_generator.CREATE TABLE csid_generator (BASE_ID INTEGER PRIMARY KEY AUTOINCREMENT,latest_csid INTEGER)P...++.Ytablesqlite_sequencesqlite_sequence.CREATE TABLE sqlite_sequence(name,seq).T...++.._tablephoenix_sessionphoenix_session.CREATE TABLE

C:\Program Files (x86)\Windows Provisioning\app_data\rmt_cmd_store.db

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3007015, page size 1024, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.1227230499255765
Encrypted:	false
SSDEEP:	12:HLiuWk7OTSFlyni3RoVFsTf9L7eHjvwJ:riuWH2Ke5Lgjvw
MD5:	64A6263D9211AB255F7D6215D8F7A1F7
SHA1:	95FD726F22DB37D364D4308FCA5A4F4927C8881B
SHA-256:	B62D1108B9A20B63F0CA6DC63ACF14D0DA9D4323C5E055780E32B27A65420B8F
SHA-512:	115F23302530485C93F91DC5A730A194129A4759CBF3F0450EFB9473CFA830C325A426F7346E647058CA9D68EDD3BEBE0B5EFACEBA17E3206BC90ABE2F56199E
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-.'.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................P...++.Ytablesqlite_sequencesqlite_sequence.CREATE TABLE sqlite_sequence(name,seq).`...%%...tablermt_cmd_datarmt_cmd_data.CREATE TABLE rmt_cmd_data (id INTEGER PRIMARY KEY AUTOINCREMENT, cmd_code TEXT, is_reply_msg INTEGER, sender TEXT, rmt_cmd_type INTEGER, arguments BLOB, retry_coun

C:\Program Files (x86)\Windows Provisioning\app_data\rmt_cmd_store.db-journal

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/20Xu//lxll:7+/l/b
MD5:	3077B14B100C4120D6FAC1187681C31E
SHA1:	1EB9F368BD357D2CF16640B780580A39053E0524
SHA-256:	F4A544D227FE6BB207E814FF839C73313441A5BB48BFA248CFB3CD6F506E488F
SHA-512:	353EDF54CF558467E3BBD38B5B8A7517156CC57D900F87B98167E0987F0E2D8BC8B776A353BE065404C1B41970ECDE137FFA04DD1856E06D0A64B8C11ED2D0FF
Malicious:	false
Preview:	.... .c......Q..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\app_data\session_store.db

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe
File Type:	SQLite 3.x database, last written using SQLite version 3007015, page size 1024, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.0219047859655728
Encrypted:	false
SSDEEP:	6:lpbNFlEuWk7IxjvATSFRxtLumV1WkQmLu44wQeL9CNf0An94M:HLiuWk+MTSFlyUWkQH44wXL9WMAnqM
MD5:	240D9CD103432E345E4ECE0F8001E178
SHA1:	B406F7E9F1C8CF28D86A2245A6DBD48404FAA92A
SHA-256:	E70010FBB6E4CDA6825D4C6A8381B3B8B1625953850DE73A2E029B79AD748B1D
SHA-512:	3A81AED6D08B36B3FA5555038B8D62133A81D2CECED3E132D277B02064193E5A2B1EA03A6737A49434A3176CC46DE3FDC9A2FAE61AB29333CBB3483924335036
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-.'.........>..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................P...++.Ytablesqlite_sequencesqlite_sequence.CREATE TABLE sqlite_sequence(name,seq).?...--..1tablefx_session_storefx_session_store.CREATE TABLE fx_session_store (id INTEGER PRIMARY KEY AUTOINCREMENT, session_type INTEGER, session_user TEXT, session_doma

C:\Program Files (x86)\Windows Provisioning\app_data\session_store.db-journal

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/r9/Hlxll:7+/l/r9/
MD5:	4D11D30A7D74FDB160A0D61E63BFEA96
SHA1:	84314F76A6E9E3E67637FA0891AB44F93A7A3B1F
SHA-256:	26D4F3C4A1764F4E49183774AE5BE79663A59A3BEE79AF2D174E75CD4514C15C
SHA-512:	81CB1364C39F841DCEF483BFE028474EAE3673EE571BF204E63D4D43E05C36293C467E6EAC24C83B1F0FC848C1D68244A2E80526C8C7F269D99BF3D020E6D1FF
Malicious:	false
Preview:	.... .c.......+.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\app_data\version.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	1.9182958340544893
Encrypted:	false
SSDEEP:	3:3jF:J
MD5:	DF4F0F1534FAA418D6185F67DAA63A7B
SHA1:	D1501DEAE95507919B30F2ADFA13EE822464CC92
SHA-256:	3CFDEC96C972680CABF7829616A54508CABCFC4FBF80AB160DCAD001322AF69F
SHA-512:	CF5493D53B591941C1123BF347DDDFC123196A94EB6B1685E32D37BF42FBBEAA8619AF5A6F73F0E1216951856C0C73D97F0DF221020EDC3F27E9CCCC424DEE62
Malicious:	false
Preview:	2.6.2

C:\Program Files (x86)\Windows Provisioning\app_data\webmail_store.db

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe
File Type:	SQLite 3.x database, last written using SQLite version 3007015, page size 1024, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.0165276862161985
Encrypted:	false
SSDEEP:	6:lpbNFlEuWk7aEvATSFRxtLumQBbfQhxgLu44ksl9v9Lr6l0u8td94M:HLiuWk27TSFlyjBbfQhH44ka9qMdqM
MD5:	B0C191CBBF25AF57721B05A8A24D2A7D
SHA1:	F9E30EA936FB1FCEA7DC0E224D8ADC624A22AF97
SHA-256:	CD45AB535008EF90AC3200B9F77DE92ED21BFDC8F4B44C9362404C7F33487B0F
SHA-512:	5EE806C86EF292C3869539605C78CB90FCAB0900856499B5DD0D6F25E83C2DCCF71E98363C6D71AFFAFBDEA862222D7879758B5A4D2D3D0FBDA8AA26636E25D6
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-.'.........E.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................P...++.Ytablesqlite_sequencesqlite_sequence.CREATE TABLE sqlite_sequence(name,seq).8...''../tablefx_web_mail_2fx_web_mail_2.CREATE TABLE fx_web_mail_2 (id INTEGER PRIMARY KEY AUTOINCREMENT, email_provider INTEGER, email_id TEXT, email_direction

C:\Program Files (x86)\Windows Provisioning\app_data\webmail_store.db-journal

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28109187076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/Yz1/lxll:7+/l/
MD5:	81A243FD14C0C38850FAE3DB117D5011
SHA1:	6703BAD3E87D121432E1834EE0A4CD5848E36E16
SHA-256:	0E3B9272AFF8BBF6DFDBD265E46F658CC886C1661D529C5FFAA705B57B434DCE
SHA-512:	CEDD7EBB3747892EA812CB18CA909A1DF0BD779F7B2CDC576C645F93857E15072004C9C52D683DC21E39C6AEE3EA124A1D45352A387C55FFC23416E498298C49
Malicious:	false
Preview:	.... .c......c.Y................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\app_data\webmail_store_tmp.db

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe
File Type:	SQLite 3.x database, last written using SQLite version 3007015, page size 1024, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	1.4964238790692588
Encrypted:	false
SSDEEP:	24:r8izDYQGNwaDdktTylX0O2xbLSBU4Dj/OIY6:PYQ+RktTAEO2xWGwOv
MD5:	883E5AD1C04E47B9AD7F0C2D330323EB
SHA1:	5403AC901BF0D5280E0F29A95800FCF003B0C3EA
SHA-256:	72DA484A1E201CB2B1D8CCFEECA877A30BFF9448CDFF815896550306E1C7ADBF
SHA-512:	BA7F2AA110DBD4914E3ACBF44A2D5E09051F7606B32724EF17E4CA48E5ECF0D7FA1CBBE9FB32C3BA3F459809098F1EE66E5932AA6BC59597C139CE621F52C646
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-.'...........n...........................................................................................................................................F...%%..Otablefx_recipientfx_recipient.CREATE TABLE fx_recipient(Id INTEGER PRIMARY KEY AUTOINCREMENT,recipient_type INTEGER,recipient TEXT,recipient_contact_name TEXT,msg_type INTEGER,msg_id INTEGER).(...))...tablefx_attachment2fx_attachment2.CREATE TABLE fx_attachment2(id INTEGER PRIMARY KEY AUTOINCREMENT,full_path TEXT,msg_type INTEGER,msg_id INTEGER,file_name TEXT)P...++.Ytablesqlite_sequencesqlite_sequence.CREATE TABLE sqlite_sequence(name,seq).=...--..-tablefx_desktop_emailfx_desktop_email.CREATE TABLE fx_desktop_email(event_id INTEGER PRIMARY KEY AUTOINCREMENT,event_time TEXT,user_logon TEXT,app_id TEXT,app_name TEXT,app_title TEXT,direction INTEGER,service_type INTEGER,sender_email TEXT,sender_contact_name TEXT,subject TEXT,body TE

C:\Program Files (x86)\Windows Provisioning\app_data\webmail_store_tmp.db-journal

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	1544
Entropy (8bit):	3.2093048920294227
Encrypted:	false
SSDEEP:	12:7+tE+LCUclUmlmF44R9xQ31X0OTSFly0Tr9h44Bd69BJu4JnkP8j/OpCJW6le:7+tE83mktTylX0O2xbLSBU4Dj/OIY60
MD5:	F526DDE2B1FEF72D7BDFE1D786EB7D75
SHA1:	3E88471A535C5DBF5A40156287AD427D05A46099
SHA-256:	4A35FB8F0A4E0D394A6A8249C65A0F20AD1992823C8E4DE235A2F4A50B27EB44
SHA-512:	12E447111681463F6D58E3FF3551683EB55B7B69ADD3B03447352D7D3CF1F9F4A727A25F5D90FD229F47849CA968D97C3F28F3254792A41EC41209C6BF1261C6
Malicious:	false
Preview:	.... .c......Z .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .........................................................................-.'...........n....................................................................................................................................................................................................................................................................................................................................................(...))...tablefx_attachment2fx_a

C:\Program Files (x86)\Windows Provisioning\get_drop_files.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	5.975015207564095
Encrypted:	false
SSDEEP:	384:mKT7wkXtiJRLmal+FI+MprHBjKgfjHkO2kvnpfIvfTYb72f8pevb:xxOJ1BkgfbkYPpAva7M8sT
MD5:	5285E941C30D582AD49228CF7D476464
SHA1:	C428E253EFF240C101655D128B3684828354006A
SHA-256:	C010FA2AAB01EC7DB6830B23A8E542F138BD2D16C6F2C532CEC29DF7C3B31DF4
SHA-512:	BB9F3932E72705BF793161BC28822A9B9A1251E521CD3C1A6018AC68EFC822CA3E2AE5402D46BBB0A27F6DBD2961C71A1A3992FFD59C5DDE1797619E63BB5929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rf..6..W6..W6..W?.OW&..W.Y.V4..W.Y.V7..W.Y.V;..W.Y.V2..W.Y.V...W...W1..W6..W@..W.Y.V2..W.Y#W7..W.Y.V7..WRich6..W........................PE..L...5Z.e....................$.......,.......@....@.......................................@..................................L.......................................C..p...........................pC..@............@..8............................text....)......................... ..`.rdata.......@......................@..@.data...<....`.......D..............@....gfids..T....p.......F..............@..@.rsrc................H..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\gutype.dat

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\post_install.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:/ln:t
MD5:	F2DD0DEDB2C260419ECE4A9E03B2E828
SHA1:	0AAF76F425C6E0F43A36197DE768E67D9E035ABB
SHA-256:	26B25D457597A7B0463F9620F666DD10AA2C4373A505967C7C8D70922A2D6ECE
SHA-512:	FECD7B408089255B3467DC1F7231CC6388C9E1C65DCAA5E50F3B460235D18BC44033B08184018B65AC013FDAE68C0088381644A6302B9D89E468F57FF9A005DD
Malicious:	false
Preview:	....

C:\Program Files (x86)\Windows Provisioning\inst.dat

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\post_install.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:cO1:L
MD5:	E32A9739783BA322193318CFF3C43EE6
SHA1:	40325E25312FA8F1A91F0509505CD73431C75E83
SHA-256:	C9C4A36E5D02ED79C0416ED2DE1EA53240BAAC752256EA03ECDCA6D039D8DCE9
SHA-512:	46E592E42AD6962DBFBD2BD17A9AD8D2AD0F13DB6721C6E29CF578CEB543DEFD9DE34C89986A9F7D8CA4535D92225BA7FEB08F1685FC84F034549A68B6AD50A3
Malicious:	false
Preview:	..Qc....

C:\Program Files (x86)\Windows Provisioning\libprotobuf-lite.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.611218815671407
Encrypted:	false
SSDEEP:	6144:qsTR4+g7wuK4tlpqm8TNwdL3KnL0W9/lNYXDTH3/EtaM+LM/w+pH:qsTR4+g7wur4hwdL3KnLb9HYXMH
MD5:	F909C898520DE19DA84790CF121DB3B6
SHA1:	C4988287C46A8F5AB9B24A95009ACDE0AF4800B9
SHA-256:	24CEEC931DC40D2973BE6F0030DF4FCE5EB337C7E69DF79739493D7235754167
SHA-512:	E20AEE4FF41A060662D453CD894CC8223DC5CAB69753E670FC0225A3BEF518345FC6D2C1FD54499498A2B0DB6B220A7AE49164F4F2CE2C4209DBA0A5AA8A5C3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..-...-...-.....-.......-...(...-...)...-...,...-...,...-...,...-...(...-...-...-......-.../...-.Rich..-.........................PE..L.....xa...........!.........B......g........................................`.......:....@..........................M...k........... .......................0..0%......T...........................(...@............................................text............................... ..`.rdata..............................@..@.data...............................@....tls................................@....gfids..D...........................@..@.rsrc........ ......................@..@.reloc..0%...0...&..................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\Packet.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98040
Entropy (8bit):	6.127745728436191
Encrypted:	false
SSDEEP:	1536:zg6Z54QkC2wpk2c+ZCDHKklh74RTfIEtaYQ0:M6Z54ARcIxk4LIEtaYj
MD5:	86316BE34481C1ED5B792169312673FD
SHA1:	6CCDE3A8C76879E49B34E4ABB3B8DFAF7A9D77B5
SHA-256:	49656C178B17198470AD6906E9EE0865F16F01C1DBBF11C613B55A07246A7918
SHA-512:	3A6E77C39942B89F3F149E9527AB8A9EB39F55AC18A9DB3A3922DFB294BEB0760D10CA12BE0E3A3854FF7DABBE2DF18C52E3696874623A2A9C5DC74B29A860BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: Je7wwdubnQ.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: ywvz5i8kT9.exe, Detection: malicious, Browse Filename: vcredist_2010.exe, Detection: malicious, Browse Filename: vcredist_2010(1).exe, Detection: malicious, Browse Filename: v.exe, Detection: malicious, Browse Filename: okIQd4f03Z.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........H...H...H...oe.Z...oe.j...oe.+......C...H...2...oe..L...oe..I...oe.I...oe..I...RichH...........PE..L...<.0Q...........!.........p......`Q..........................................................................................x....P..T............`.......`..d...................................X...@............................................text...:........................... ..`.rdata...+.......0..................@..@.data....,... ....... ..............@....rsrc...T....P.......0..............@..@.reloc..d....`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\PocoCrypto.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	6.369995603809854
Encrypted:	false
SSDEEP:	3072:FjY8iLiuBSvvB5irGAB3YFOnzIfuKBNJrSmR:FjiLiuBSvp8au3YFOzuuKBNJrSmR
MD5:	359B243D01126EDFCE72FA17A6D17EF2
SHA1:	986209D7BE14AAD4C485A82BAF696F44060C744A
SHA-256:	B96218444F3AE1DBCCB75DC15FA71D558AB3D2BEA45B9BFE1A0AC5EA4BB21DAB
SHA-512:	7FE92B6CD5EAF210ADA8642FCF274B3C89B24E6D284D89191D8754D5043D950C97F78F7297553C3EE0E56C60D88223C1E2DCB67397259E9F0647F959DFA8A19B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|..........................................................................................................Rich....................PE..L...\.Z...........!........................@...............................p............@..............................R...........@.......................P.......V...............................W..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data........ ......................@....gfids..8....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\PocoFoundation.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1224704
Entropy (8bit):	6.619655547971226
Encrypted:	false
SSDEEP:	12288:hwDrxQ3/DeOaPFLxbLpugOgopp2pPgJY/Nom9XeKcmmriYn9UTn/m+GhhsQk3OTT:hwq3/KOohh+M5gQO9i/WHW3OTriG5
MD5:	7CA710161F0986625BDD223D6E8E37E0
SHA1:	FF29F5F454D7AF49C472C12CD03ED039B2833D4D
SHA-256:	8C32BD7E6F0B286C651AF387836718944A6CB2F28BAB0767255E0161B387CCC1
SHA-512:	CF21B9EC7B13156977A2B06845230CC5222E1F9FBBC2AA7A667DF6ECC60A2A6AE7A08B259F683F53A7C99AAA1B7BC4C1CA1B066E7E6ECB0AF069EA78234A1277
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......JM...,.[.,.[.,.[.T.[.,.[5r.Z.,.[5r.Z.,.[5r.Z.,.[5r.Z.,.[,L.Z.,.[.,.[.,.[.r.Z.,.[.r.Z.,.[.r.Z.,.[.rr[.,.[.,.[.,.[.r.Z.,.[Rich.,.[........PE..L.....Z...........!.................<....................................................@......................... ................`.......................p......P...............................p...@............................................text...'........................... ..`.rdata...(.......*..................@..@.data....I.......:..................@....gfids..@....@......................@..@.tls.........P......................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\PocoJSON.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	186368
Entropy (8bit):	6.437052892190694
Encrypted:	false
SSDEEP:	3072:xzKRrdhg6Ie/0EjnStS5g22oqlTPcF6cgWoBcyfYZeoazOrTfbyWwCp:xuRjpIWutyTglrpmoBc/Ze7OrTfbDZ
MD5:	A6F591815772522ABB444C19CBCB8875
SHA1:	52D9280B30A399FDCC98CEA5907B4D6BD4B70E4B
SHA-256:	BBEBACA74FA8F7E5354AE9E6AD14485A73D67AFE4CAC8889F49C6257BAA0A5FA
SHA-512:	5C9A43B86CF476DC9C5D2953EB9B3522A9A1492C664CE7D73CAD19D9DAE80EBFE002BD8AA5FC41D063D810F7E0FA9B5BA37D4D54388E87BFED8042CD5CF2B85F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z...>...>...>...7...4.....=.....+.....5.....:.....=......<...>........3.....?.....f.?.....?...Rich>...................PE..L...$.Z...........!.........................................................0............@......................... +..(J..Hu...................................!..`...................................@............................................text.............................. ..`.rdata..............................@..@.data...p...........................@....tls................................@....gfids..@...........................@..@.rsrc...............................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\PocoNet.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	745472
Entropy (8bit):	6.543320477943913
Encrypted:	false
SSDEEP:	12288:R0Spsa6b8Z42X9sIriWvfEKZWJlsusW2PTb:R0Spsa6bi9HvfEKZWJ/R2PX
MD5:	34271180589EC380E0C973E1EE2B6C7F
SHA1:	3962D796B5F431D72B5AB8FE4F107CA6CCD8E43B
SHA-256:	DA4A1875A3F25E2E94FD50BAC9FDB8CF60261167EE0F10E019C7C8CEEEC0D004
SHA-512:	49AD69EB42005EA17F32F3DDED310595F4922CF138E0989764541A63925F764549A2292A4A0BED641D7154E61B4AC5F73252F59D03600E26C4D3AC509CB97C0B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................y.....................................U......................U......U.......P.......U.......Rich............PE..L...4.Z...........!....."...V......j........@............................................@.........................P.......TT.......0.......................@.............................\|....... ...@............@..D............................text....!.......".................. ..`.rdata...}...@...~...&..............@..@.data....H..........................@....gfids..8...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc......@......................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\PocoNetSSL.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	186368
Entropy (8bit):	6.373003244821189
Encrypted:	false
SSDEEP:	3072:7e9IlWW9P5jzQI+3O7WQAgaCjpAQT5uv:K+4UPVQI+3O7WQ3TT5uv
MD5:	41A34F51CAA20DCFDE91F433C12F5988
SHA1:	5403646C7FA87C0480FC81F8BF98444C2029DDFE
SHA-256:	FC9D294E070C50B3C2BD6BDE1A82E2A5DDF3F19B0374EFA29EEE2A4D6257D60A
SHA-512:	EEC4F96845E96BD9ED733C254862149706FEB37E5AD48439C50F78533512E410BA79DDCEDC925CADAC1D2E6B56BCDBEC531BDD23215610124D9CCC1E358D657F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R..<..<..<......<...?..<...8...<...=...<...9...<.d.=...<...=...<..=..<.d.9..<.d.<..<.a....<.d.>..<.Rich.<.................PE..L.....Z...........!.....P...........1.......`............................... ............@............................. ... T...................................".. }..............................@}..@............`.. ............................text...VN.......P.................. ..`.rdata..pE...`...F...T..............@..@.data...............................@....gfids..@...........................@..@.rsrc...............................@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\PocoUtil.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	315392
Entropy (8bit):	6.468108074574678
Encrypted:	false
SSDEEP:	6144:hZiWbcnCy+zEQP5OQiuvRBC1lkVCH7rRj2SJrCoF4tKhjDMiFrt:XjboMA3ACB7N14tKhjDMwx
MD5:	821B8944BE225058CFA47863949E8330
SHA1:	70A40DBD359567E5AE0E40E209F696DAAAF1A2C8
SHA-256:	6E220A50FF97264B9DE695859F1FF6F46CA32A0118353014FAFCCCAAD1C873BB
SHA-512:	F155121B8DC5C1BAF04714A9AC7E4C77827462B23100AA55DB963898289D3B374B26BC57F7FD41532A0C59606FC0844AC16AAC948C394384FD7757DAB3CC23BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i..]-es.-es.-es.$...%es..;p..es..;v.;es..;w.&es..;r.)es..;r.+es...r.(es.-er..ds..;v.3es..;s.,es..;..,es..;q.,es.Rich-es.........................PE..L...).Z...........!.........H......u`.......................................0............@..........................2...........................................4..........................<...........@............................................text.............................. ..`.rdata..J...........................@..@.data...("...........v..............@....gfids..@...........................@..@.tls................................@....rsrc...............................@..@.reloc...4.......6..................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\PocoXML.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	466432
Entropy (8bit):	6.591031773652152
Encrypted:	false
SSDEEP:	6144:WA58L7DdM7EcKnm+LG0wXuRytGKfvylZSeFe9G/HQXXb1nOFWmlwOsIMBZqlXyUm:D8nD27Am+LGvtGKfk0HYLh9USOZ
MD5:	14A58A611F68D7C6C6A43E869F4A7CA0
SHA1:	8795B5843F449839AC2EB35F2FB9F0BC4200A5E9
SHA-256:	8377C7C9D73EA0C6187ED8AE0D6E016A13CA7B76AEE9212D95E2F72E0E2408A9
SHA-512:	783DEBCFF351171A76142CF2AA49E18F3F15DFF68609F8E2C47C1A8702AC778FC9FDE0B5005AB50AE499D0EA57A5E24C65016F54A4D9C3F1EB4BDB66BA24643A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t....G...G...G..G...G...F...G...F..G...F...G...F...Gk..F...G...F...G...Gv..Gk..F...Gk..F...Gk..F...Gn..G...Gk..F...GRich...G........................PE..L... .Z...........!.....T...................p...............................p............@.........................@!...................................... ..dH..@...............................`...@............p..4............................text....R.......T.................. ..`.rdata...i...p...j...X..............@..@.data...8...........................@....gfids..(...........................@..@.rsrc...............................@..@.reloc..dH... ...J..................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\ProtocolFilters.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3825664
Entropy (8bit):	6.807627061589882
Encrypted:	false
SSDEEP:	49152:Wh0gMp73LnCRWdDnAdGJS7jgrHls8v9udNgdJ0TDMQtzASPrxqTAqBSXbKUJow:gMt3LnU47A48IrHK8v92NYQ66
MD5:	043AD966D71FA7E4821AAD0597F76575
SHA1:	19B59EF247DFE026074F53AF45B97E3D03106F9A
SHA-256:	3316A4E7CB195346D89369D9B2C6DD17559E09ADA31DB1B40989A4388D4872E3
SHA-512:	9678368E1FF25668C8DAC7175CFB993A63805EC14115D7141659D0D949113FC044A469B764C60BA091318BAE674068009FCAF1035758175E3675A3CAB6DA7472
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.rc~g.0~g.0~g.0~g.0fg.0...0xg.0...0\g.0...06g.0...0.g.0~g.0.g.0...0sg.0]..0\d.0]..0Ug.0...0.g.0...0.g.0...0.g.0Rich~g.0................PE..L......d...........!......+.........R.........+...............................:...........@...........................7.&.....7.......8.p.....................8.,.....+.8...........................P.6.@.............+..............................text....+.......+................. ..`.rdata..6.....+.......+.............@..@.data...`.....7.......7.............@....rsrc...p.....8......h8.............@..@.reloc........8......l8.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\libcrypto.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2085888
Entropy (8bit):	6.275502958098816
Encrypted:	false
SSDEEP:	49152:nMIJjR0L3RYAzqxCQhScKFVvHeb0Q1CPwv3uQ2VXoyk:MIJyLySc0leV1CPwv3uQ2
MD5:	14F37CF1955FC31C6AB544B596CC07CA
SHA1:	EFA3B6A5C92CFCE32A1E4DBF2656F9BEBA4DD746
SHA-256:	82B38741E7F28D2C47D23B0D24BD414D58A488CACD50AD3C0F359E33FB4A369D
SHA-512:	F67833DFF8DC50D3959161259B1D0D96D9BD420EF9CBA37F50E1315E6A6E84D9BD2E0858ACDB1BE9C084B80E72FE694C6F164C173CF90A4C3EEB2874512DEC1B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.Z ..4s..4s..4s..s..4s,.5r..4s,.7r..4s,.1r..4s,.0r..4s5.5r..4s..5s..4s..4s..4s..0rY.4s..4r..4s...s..4s..6r..4sRich..4s................PE..L......Z...........!.....N...................`...............................P ...........@.........................`n...-...5..@....p..............................`U..8............................U..@............0...............................text....M.......N.................. ..`.rdata...;...`...<...R..............@..@.data............X..................@....idata.......0......................@..@.gfids..%....P......................@..@.00cfg.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\libeay32.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1023488
Entropy (8bit):	6.829669925678923
Encrypted:	false
SSDEEP:	12288:kLOOiZOSffVbf1xO9QSq8dsTwd9xLAT6O6HBlp8oWt9V+NXaZpnNnU3dFXaizR9F:k+EZd9xLAVgBlCuzR9gopeKll0GV
MD5:	FD8BD6C382FF28D9E119BB0B16DEBF0E
SHA1:	C06DC43A50ED2101DFB18FC17DCEBE6F3122C6AB
SHA-256:	C09226191A49733293D12AF73300B3965438A15A5613E916A9138402812A76A7
SHA-512:	6BB444A5CA7D38F1209E1B51EAF1BBAF373FD840C962E31EB37AAB15DF3E2C0FAC20E0C46D205EE135FA03211B287BAEB85A25CA2A3F2DF7B200823D115257D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N......Z...Z...Z..YZ...Z..ZZ...Z..KZ...Z..\Z...Z...Z...Z..LZ...Z...Z...Z..]Z...Z..[Z...Z..^Z...ZRich...Z........PE..L...3k.T...........!......................... .......................................4...................................m...........0.......................@..........................................@............ ..x............................text............................... ..`.rdata....... ......................@..@.data...$...........................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\libprotobuf-lite.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.611218815671407
Encrypted:	false
SSDEEP:	6144:qsTR4+g7wuK4tlpqm8TNwdL3KnL0W9/lNYXDTH3/EtaM+LM/w+pH:qsTR4+g7wur4hwdL3KnLb9HYXMH
MD5:	F909C898520DE19DA84790CF121DB3B6
SHA1:	C4988287C46A8F5AB9B24A95009ACDE0AF4800B9
SHA-256:	24CEEC931DC40D2973BE6F0030DF4FCE5EB337C7E69DF79739493D7235754167
SHA-512:	E20AEE4FF41A060662D453CD894CC8223DC5CAB69753E670FC0225A3BEF518345FC6D2C1FD54499498A2B0DB6B220A7AE49164F4F2CE2C4209DBA0A5AA8A5C3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..-...-...-.....-.......-...(...-...)...-...,...-...,...-...,...-...(...-...-...-......-.../...-.Rich..-.........................PE..L.....xa...........!.........B......g........................................`.......:....@..........................M...k........... .......................0..0%......T...........................(...@............................................text............................... ..`.rdata..............................@..@.data...............................@....tls................................@....gfids..D...........................@..@.rsrc........ ......................@..@.reloc..0%...0...&..................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\libssl.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	375296
Entropy (8bit):	5.695333832967505
Encrypted:	false
SSDEEP:	6144:4Po/RYitktWHoX7zUMnyPvKpZG4AFuvkzrzDNmGpamA8ND7P46yLqiDoVnjSOOvy:9RYwktWIX7zUMnyPSTG4AFuczrzDNmYD
MD5:	3860A72B4BFC4722CC3AB8C05F27FCCE
SHA1:	8A1B0A2E6072995F0CE9BD087AB6EA35B3D1B338
SHA-256:	D6CD873E147A3FE816AE10F5A7AFD6BD17539102DA6FCC768CE17D388453513F
SHA-512:	B80FF4B4151A3D5DD625630751D9ABE034709B312C41E8D6253A4DAA43DBA494B400B2DEC7EECDCB24E527FDD1001FB721821EE94A9BAA5B2ED4466DE288D5D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q1a.5P..5P..5P..<(..=P......7P...0..7P......6P......>P......>P......6P..5P...Q.......P......4P......4P......4P..Rich5P..........................PE..L......Z...........!.........................0............................................@.........................@...c=...y...................................&......8...............................@............p...............................text............................... ..`.rdata.......0......................@..@.data...\C... ...>..................@....idata...=...p...>...B..............@..@.gfids..%...........................@..@.00cfg..............................@..@.rsrc...............................@..@.reloc...,..........................@..B................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\npf.sys

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36600
Entropy (8bit):	6.293365115285525
Encrypted:	false
SSDEEP:	768:VVRRdUlDRJuOfUhk8ZX2ZeRY4soGLeTZ8wwfKRw:VVRsZREOfUhNK96TZ8wwi6
MD5:	DE7FCC77F4A503AF4CA6A47D49B3713D
SHA1:	8206E2D8374F5E7BF626E47D56D2431EDC939652
SHA-256:	4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6
SHA-512:	FDACE7EE2593FFE5724DB32F4BE62BB13AA1EC89E1E01C713D8C1E9891A5A0975D127450024C3388A987A35E546568ECDBCC60C185DC8F8B08CCEF67A084B20D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}i.}i.}i.}h..}i...}i...}i...}i...}i...}i...}i.Rich.}i.................PE..d.....0Q.........."......V..........................................................9q......................................................d...P....................p...............a...............................................`...............................text....M.......N.................. ..h.rdata.......`.......R..............@..H.data...4....p.......X..............@....pdata...............^..............@..HINIT.................`.............. ....rsrc................h..............@..B.reloc..<............n..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\certutil.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	190464
Entropy (8bit):	6.420117010029419
Encrypted:	false
SSDEEP:	3072:L9wyqr9aNtelu9p7GEpji1wvBtLBdQqaMBHJR5p5PqQre3EuM:Z8r9aNtuuf7NRjBdQqVBJR9Cl3EuM
MD5:	3337B8D5AAB06D9072E3D4A72E0F9D26
SHA1:	2AC8E9CB0F8E3BA05535EE300D49D1DBFCF8C35B
SHA-256:	5CB4335CB4360B0187AB868B7DADC7E4B45913B676786F2AC95D2C9044861646
SHA-512:	C5588770C7BF21F37912FB2616B9831718E74CCA0B7E63A0E95611C2F93E55B180189D700A4A3C50314FF07305EBD1294C5F84EFC38AC50D4F447D144D189F28
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C9..-j..-j..-j...j..-jp_.j..-j.9.j..-j.9.j..-j.9.j..-j...j..-j..,j..-j...j..-j...j..-jRich..-j........PE..L......Z.....................j.......4............@..........................@............@.................................L...................................."..................................@...@............................................text............................... ..`.rdata..............................@..@.data...`E..........................@....reloc.."+.......,..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	438784
Entropy (8bit):	6.663378126075105
Encrypted:	false
SSDEEP:	12288:u29xzXfvpHMCBkm/4ckvK18d7Xm+S9kMNOU2Eq+xqn6lIzn:u29xzXfvpHMCBkm/4ckvK18d7Xm+S9kT
MD5:	124AD66540633CB743122E2EA5D18C71
SHA1:	12635BB0D5BF3B5B3F0ED24F22055B1447778A3F
SHA-256:	1F0011826BD72DF4232F33A02A8697D4444570C06362B1BA8535E4A11279CFB9
SHA-512:	EE184653A4A30401DB5CA5753F93E1FF7914D0838FBFDC7DA880F1BE423B1C953F2A21FCA3224D83B2EE39589EC18A418994D001C7262DF0E11F13FE21138A70
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.v.....................s......s......s.t..........z[.........d...?Z.]...z[.....z[.....z[.....z[.....Rich....................PE..L...I..Z...........!.........................0...............................@............@......................... }..O....r..d.......0........................%...................................o..@............0...............................text............................... ..`.rdata..oM...0...N..................@..@.data....t...........j..............@....rsrc...0...........................@..@.reloc..d-..........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\libnspr4.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	310272
Entropy (8bit):	6.621497206632747
Encrypted:	false
SSDEEP:	6144:TT9KgQ9caedm0soS4mIEoDoh4zbkrTgmXzmphL9rXD5sCiO:TT9KgQPedm0soS4mIEocdrT9XyphL1XZ
MD5:	C954B7E9D500BADF4DD0A512A273F583
SHA1:	92738209568304FAAE048AF9FB2DD69257CAA1DE
SHA-256:	F3C8E39342F16CFCB2EC9ADB39D1CFF274165D1166FDF6917F8693E5C79B2257
SHA-512:	1072AC3AEE0227027C883D1BAD37217B858EF970DBA63D5F92FE9753D7AC26C18FCEA83E7CECACEA6B69A2DFE4C513E5252B96DAA05A88A133D55C10494BB515
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8j..\|..C\|..C\|..C.ZCx..C..RCQ..C..PC`..C..SC...C\|..C...C.\|$Cw..C_.SC4..C..WC}..C..TC}..C..QC}..CRich\|..C........................PE..L......Z...........!.........V...............................................0............@..........................=..P,...-..x...............................,1..........................x'......0'..@...............4............................text............................... ..`.rdata..............................@..@.data....V...p.......`..............@....tls.................z..............@....rsrc................\|..............@..@.reloc..6;.......<..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\libplc4.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	5.9623369659924
Encrypted:	false
SSDEEP:	1536:dW9TO0UhPa0Xqtr+RcCGK/sWjcdEPSCc:dW9L0zGKAEPSCc
MD5:	27B213629FC5B93C819ED03F17D027B5
SHA1:	D411238078DE7D2338395D74346272188DCD7569
SHA-256:	D2ED23112E0BC007319F44C0379513381F1FEEB6E82051588156A1AE18640902
SHA-512:	B3FB9A0D8744ED4C7D9A765FB0427461A805133ACC8D7857CDC358737EB06D2417E0F2FED9675E807597BC715E35CC5197A856BE06537BA54D8C14DA44F03AA7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... ... ... ....d.".......2......./.......w...F'..#... ...v....&......F'..!...F'..!...F'..!...Rich ...........................PE..L......Z...........!.....\|...........1.......................................@............@.........................`...........<............................ ..........................................@...............(............................text....{.......\|.................. ..`.rdata..<L.......N..................@..@.data...4,..........................@....rsrc...............................@..@.reloc..F.... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\libplds4.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	5.864142896774992
Encrypted:	false
SSDEEP:	1536:QK2zRk5CDHri6Q4NgAhcd0sWjcdExNgTzfpK+:6BHW6Q4NW7ExNgTzfpN
MD5:	556C4D654D05A291D144C05A1FF1CD3A
SHA1:	2FB0718A88D93C9547A10CE8923C45EC1DD0550B
SHA-256:	7732A4F4B808DEA0E7FC98740D8FB4FA8EBFA7E2D9EFA693B1CE72981E075DDE
SHA-512:	E0BCC856111E7B60CA802A6226EFB45DBA6195E67D6A1927609C8CCFFF899EDDD4F694D7EFB1C18D175E9575D6080070D8EA750C69508FB7AC451EC6CA7601A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.A;c./hc./hc./h...ha./h...hq./h...hi./h...h4./h.+.h`./hc..h3./h@*.h`./h.+.hb./h.+.hb./h.+.hb./hRichc./h........PE..L......Z...........!.....p..........B%.......................................0............@.........................p...,...D...<.......................................................................@............................................text....o.......p.................. ..`.rdata...I.......J...t..............@..@.data...4,..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\nss3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	915456
Entropy (8bit):	6.409619510793422
Encrypted:	false
SSDEEP:	24576:GDgt3Iu9ER+2r2BCBt/x0Pq4CxFGTInIu4MSg:mgB52HWMSg
MD5:	86CBDC08307EC5A60D5DAE63F1BF7F1D
SHA1:	FE71CB33BB49CB7FEF943367D9ED9B7E7234D6B6
SHA-256:	C50FE83362D84714915A3D429E675F35562F02A0712697B761E57149760898CC
SHA-512:	6200F5766F95AA66FB6C54E2C00841839CFBF911FC716281D09CE283B25645919A83550FD90DA4C4631F424C6F5BDEEA21C7420524E4738B5A95C95A79BDF7A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^I...(...(...(..._ ..(....V.;(....T..(....W.`(..\|.R..(...(..r)..9.W.(..\|.S..(..\|.P..(..\|.U..(..Rich.(..........PE..L......Z...........!.....r...................................................p............@.........................`....i......x................................a..................................p...@...............D............................text....p.......r.................. ..`.rdata..G............v..............@..@.data...`E...........h..............@....rsrc...............................@..@.reloc..8p.......r..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\nssckbi.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	397824
Entropy (8bit):	6.85298728759357
Encrypted:	false
SSDEEP:	6144:SVfDnPf5QwOk8/H1rBHY4FFS5XVpLMTVaHAVIIYI4LBzCsu:SVfDnPhQPrBHY4HSLpqVIIYI4LBzBu
MD5:	659F25DD0FC41F0D756386AB45FA426B
SHA1:	C55246262CC066742C970E360D3661CA24BC62AD
SHA-256:	7957CCC254495C565F26391E0A81A527CED9BC1EB3DD7F1E1D3F99C3DBD18508
SHA-512:	9EC45B2DBDDE3B655B091C254FD9282C781C9D296417BEAF56EF3A3776F99389D3C9A5F5E11FB1E1E90B4463CEF230A0F6008CF3CC413D5664E8246C096CD4E2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......X...X...X..,X...X.hZX...X.hXX...X.h[XV..Xg@^X...X...Xe..X"A[X...Xg@_X...Xg@\X...Xg@YX...XRich...X........PE..L......Z...........!.....@...................P...............................`............@.............................P....x..d............................ ...6...................................u..@............P..`............................text....?.......@.................. ..`.rdata..`1...P...2...D..............@..@.data...Tx.......Z...v..............@....rsrc...............................@..@.reloc...=... ...>..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\nssdbm3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175104
Entropy (8bit):	6.380804511310592
Encrypted:	false
SSDEEP:	3072:uy+ViWjqFwR/IW3gpqCFEak9xXXlj967YuUWXEcKBMydTuoQ3UpqTItre14FodB:us/Q8pqp9xXXlpuqBoc0TQk
MD5:	32DD3C576D236577E9F23EE4D016C467
SHA1:	9A8B2DDAED3DB4E94FF607AD235BBA6698D8F2C7
SHA-256:	8D367AC7A3007789CB2006AA4CFB038BEBFF5D11F4C6F130DCB60B1496AC0BEE
SHA-512:	CB07D3C86C71BB500B612D6A09212B4FE255A27EAEA8E60ACC83CA318B3F9F5BAF608315598AD23B499CE4A900265DF071E7892A10C00FCFC3EC078E871D5B67
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.U.B.U.B.U.B...W.B..P..].B.6..I.B.6..D.B.6../.B.3...R.B.U.C...B.v...C.B.3...T.B.3...T.B.3...T.B.RichU.B.................PE..L...W..Z...........!................"n....... ............................................@.........................`}......,l..d.......8.......................H...................................hg..@............ ...............................text...6........................... ..`.rdata..g^... ...`..................@..@.data...$/...........r..............@....rsrc...8...........................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\nssutil3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217088
Entropy (8bit):	6.551633114866076
Encrypted:	false
SSDEEP:	3072:zW2hMZf9HEyhtRU/U5YZndpTO7QO3dxINXgOwLhw84WxoRxz:qgQlETU5MMQYIHGi
MD5:	30E199190DCD45BA0D122FCD30C274BE
SHA1:	3DCFB388137475AA10C89433EE6BD46F511CDDE4
SHA-256:	50B0ADF97C13E3589B5A765564B05FA580E569DA69E3A9BD55E3B3B61EE46A41
SHA-512:	AF65B9B7128E0DA663D8057B39F11C004314A769C8FC4D75EA1E63544D25D1E08E1E926AB0366C290B4CC8DFC23A906C4EF7ADC2532B91ECF7B228BCAF74BB8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u1x.._+.._+.._+5c.+.._+W..+.._+8.+.._+8.+.._+8.+_._+...+.._+..^+Y._+...+.._+...+.._+...+.._+...+.._+Rich.._+................PE..L...;..Z...........!.........z............................................................@......................... ...8.......d....p..............................................................P...@............................................text...]........................... ..`.rdata..X...........................@..@.data....:...0......................@....rsrc........p.......$..............@..@.reloc..:&.......(...(..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\smime3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149504
Entropy (8bit):	6.209364843209916
Encrypted:	false
SSDEEP:	3072:C56aJqLAr7FkF0MrztzsWb1nnbooLGl4AK3vZUsgBHY3P3f4PlQkDHbzisttdzhh:q6aZkFHtzsWb1nnboWG8vL3P3gPGy9PX
MD5:	022B6FB51D33F9A076329D7A91B40620
SHA1:	11E964F14883D961ED462ED99990AE40D127EC87
SHA-256:	666421A0F6F87DFD72F8D1A68A95417709D7ADB47A3F91907EC3686108A6F38B
SHA-512:	B947DCDD32D0A5AFB0E4F8F9505C4ACDFE16EA7DD6CAE2B9C511F24ED9B88CC1513E39C21FFD454BC42D9CF26B78BFD332D98859C636C242B223D6C6BC1C7D44
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*`>YK.mYK.mYK.m.<.m[K.m...mKK.m...mUK.m...m.K.m?..mRK.mYK.mCJ.mz..m}K.m?..mXK.m?..mXK.m?..mXK.mRichYK.m........................PE..L......Z...........!.....~..........f3....................................................@..........................................`.......................p..........................................@...............8............................text....}.......~.................. ..`.rdata..............................@..@.data...4....0......................@....rsrc........`.......(..............@..@.reloc..>....p.......,..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	219648
Entropy (8bit):	6.348174231200735
Encrypted:	false
SSDEEP:	6144:bBDa8PtdxEWGT1isGfjyxDui2B1dFkYus:bBpPCWG8mxii2zdd
MD5:	485AA9DC1D332EF1A9DC31F19A526F82
SHA1:	FF19B3E0A4B379EA4B39075946DA2148859D8ADE
SHA-256:	BC85490155DAA4C31A2D39447B477A4E442AF47EC83939BD37353857B44C4899
SHA-512:	62699CB8F889F7D05EC36A6E57685C2A66110096BA97A949911441C3F7AC3BD100BF306C840AE96C883CD03970CEA012DBACA884246F8E6778F3664E9CABC2AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u..1..1..1....R.3..',.0...A$.+...A&.:...A%.P..Wi .:..1.....h%."..Wi!.0..Wi".0..Wi'.0..Rich1..........................PE..L...T..Z...........!.................-....................................................@.........................@......T........`..8....................p...!......................................@............................................text.............................. ..`.rdata.............................@..@.data...\/...0......................@....rsrc...8....`.....................@..@.reloc...+...p...,..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\nss\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	617472
Entropy (8bit):	6.659091537520531
Encrypted:	false
SSDEEP:	12288:yyWvcxz3CO9uerS8bf5+yNejUogPr4faWAIhZxsvcI0z+UYOxVJEQU:yyWvQ3CO9uevQvfgPr4fa5cZU/0CO8
MD5:	6AC28CF170907BA16B68BD39EE86BC29
SHA1:	8F528C24F39E7EF708EEDFBFD657B026053711F8
SHA-256:	90645044AFE1C79ECC8877CF9C79414916E1EBD94EBC8714CB68AE34BD89A6A3
SHA-512:	C59EEAC9E5AF7CED0510B9C13131EE4C848283A484104F1681F6264701FDEF2512C2913AFCA68600FF0DC6E9E114BF8DDE50217A6AE0E360BFFF2FC7F81EE4BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................`.X....m......m.,....m./.....!/..... +..... -....Rich....................PE..L...M..Z...........!.........v.......}.......0............................................@.................................t...(............................p..l@......................................@............0...............................text............................... ..`.rdata.......0......................@..@.data....F... ...$..................@....reloc...G...p...H...$..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\pthreadVC.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53299
Entropy (8bit):	3.9943496203596918
Encrypted:	false
SSDEEP:	384:hSvfC8Vv0Vy7ojuq7GQcdWTc4zU+GFronD/yD5rBEe0kiH32Jp9AhOW:wt+TGQcdWYdMG59EeJiH3YzW
MD5:	F04A90F917BA10AE2DCBE859870F4DEA
SHA1:	6668EBE373CE58C33017697C477557653427E626
SHA-256:	99C61ABF41C3AEC38CAB3ED6270ADBCA9A247BBF5F9AA9D29ECB0659A5527F48
SHA-512:	AEC29301B9CE311B27F1590B0E0C4121ACDC183A30B570E087D77B7035684F02A6DFBDEE950C37F3023B32E2EA5A075A5FBE6D18A2804DA9490D4959733BB516
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......EGi..&...&...&..c9...&...&..7&...9...&...9...&..Rich.&..........................PE..L.....g?...........!.....p...P.......d..............................................................................0...^.......P...............................T...................................................................................text...3f.......p.................. ..`.rdata........... ..................@..@.data...............................@....idata..4...........................@....reloc..J...........................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\ssleay32.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217600
Entropy (8bit):	6.502467400971621
Encrypted:	false
SSDEEP:	6144:T+MCLaMRv89FpK5sZ7kwvrH/rhqlq0/HqfkT7UALGicQpgo9u9/JTibcnd//N:TfCrvSpK5sZ7kwvrH/1qlq0/HqfkTDLO
MD5:	85CEB6B1F6EA475E80A068AC1EB2E1D7
SHA1:	9C0FFED6929AC584C9B6CDCADA7BE4C74FAE05E3
SHA-256:	43A4930DC3ED17989AF435C55952D6FFD39035840BBAADEB802F2741EEA92CB1
SHA-512:	E3DAB7ED298C9785CE72941ED93B1D7F1B89D2189878A40839B7088AB267A84CBC31CCA7EAACACB3F9ADE0C59C2899BC0E30B8E37D094DB1FECC79546E30D86E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;K..hK..hK..hB.\|hO..hB.mhI..hB.zhL..hK..h...hB.jhp..hB.{hJ..hB.}hJ..hB.xhJ..hRichK..h........PE..L...@k.T...........!.....z...........................................................O..................................A.......P....P.......................`......................................8...@...............D............................text....x.......z.................. ..`.rdata..............~..............@..@.data....(... ...&..................@....rsrc........P.......*..............@..@.reloc.......`... ...2..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\wpcap.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	282360
Entropy (8bit):	6.604477037348888
Encrypted:	false
SSDEEP:	6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
MD5:	4633B298D57014627831CCAC89A2C50B
SHA1:	E5F449766722C5C25FA02B065D22A854B6A32A5B
SHA-256:	B967E4DCE952F9232592E4C1753516081438702A53424005642700522055DBC9
SHA-512:	29590FA5F72E6A36F2B72FC2A2CCA35EE41554E13C9995198E740608975621142395D4B2E057DB4314EDF95520FD32AAE8DB066444D8D8DB0FD06C391111C6D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%I+&a(Eua(Eua(Eu..;uc(EuF.8uv(EuF.+uC(EuF.(u.(EuF.>uc(Eua(Du.(Eu.'.ud(EuF.4ut(EuF.?u`(EuF.9u`(EuF.=u`(EuRicha(Eu........................PE..L.....0Q...........!................z...............................................8_.............................. ...........P....................0..........8&..p...................................@...............,............................text....z.......................... ..`.rdata..=7.......@..................@..@.data...!........ ..................@....rsrc...............................@..@.reloc..p........0..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\x64\Packet.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107768
Entropy (8bit):	6.207807273671645
Encrypted:	false
SSDEEP:	3072:xpMSqNrAF/ln2800b4U7kByZo6Fsl1LOb:xpMSq0/AN0EG4yZ/
MD5:	899A5BF1669610CDB78D322AC8D9358B
SHA1:	80A2E420B99FFE294A523C6C6D87ED09DFC8D82B
SHA-256:	AB3CCE674F5216895FD26A073771F82B05D4C8B214A89F0F288A59774A06B14B
SHA-512:	41F2459793AC04E433D8471780E770417AFAC499DC3C5413877D4A4499656C9669C069D24E638D0AAF43AF178A763ACB656FFD34D710EB5E3C94682DB1559056
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................5.......5.......5.....n..............5.......5.......5.......5......Rich....................PE..d.....0Q.........." .........t...... l..............................................r................................................\.......P..x.......T.......\....................$............................................... ...............................text...>........................... ..`.rdata...@... ...B..................@..@.data...(7...p.......T..............@....pdata..\............j..............@..@.rsrc...T............\|..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\libs\x64\wpcap.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	370424
Entropy (8bit):	6.481542014421452
Encrypted:	false
SSDEEP:	6144:pH+VjFreKE0V/NGvaX86tWBXZkbTe/CtjgZBwIV8g/wNmJ4eXk:pH+VBeT0V/NBX8k2YTe/QIwIs8k
MD5:	A672F1CF00FA5AC3F4F59577F77D8C86
SHA1:	B68E64401D91C75CAFA810086A35CD0838C61A4B
SHA-256:	35AAB6CAAAF1720A4D888AE0DE9E2A8E19604F3EA0E4DD882C3EEAE4F39AF117
SHA-512:	A566E7571437BE765279C915DD6E13F72203EFF0DC3838A154FC137ED828E05644D650FD8432D1FB4C1E1D84EE00EF9BDE90225C68C3CA8A5DA349065E7EBFD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[...[...[.e.%...[...&...[...5...[...6..[... ...[...Z.d.[.U ...[...*...[...!...[...'...[...#...[.Rich..[.........................PE..d.....0Q.........." ................p........................................P......................................................P4.......'..P....0...........'...........@..X.......................................................X............................text............................... ..`.rdata..mm.......n..................@..@.data........@...&...,..............@....pdata...'.......(...R..............@..@.rsrc........0.......z..............@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_proc_mon.txt

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	11290
Entropy (8bit):	5.389888266607761
Encrypted:	false
SSDEEP:	192:6k2YmSKI4tFpYVmRu0P+PmPQPEPKPPPiP8PnPkPYPIPEPXPxPJP2P6bPWPJ:n2YmSKr8mRnWeo8CX6U/8wgc/phuCbOB
MD5:	8CADB22C4811FDD7E40B51A3C3580EFC
SHA1:	A2BCBB033F6CAE8E6B28489DAA7B4216196964D0
SHA-256:	EB5AE21359178722F0D4271D378659BCE0123B6F912253C4328B3C85EF959751
SHA-512:	A91979A96F1E36F3E2DBDBB15C395CAED0AF4A3725A6BCFF086CA7956378C43B476FABEFADBA026C3137E5804DCC30E6925B0130E76D91E64F42C17FB9206281
Malicious:	false
Preview:	2024-03-20 11:50:16 svcAppLookup.exe [2924] <DEBUG> [ws_process_monitor_service]: ServiceMain: service started..2024-03-20 11:50:16 svcAppLookup.exe [2924] <DEBUG> [processs_monitor]: Windows 8 or newer..2024-03-20 11:50:16 svcAppLookup.exe [2924] <DEBUG> [stealth_manager]: CStealthManager::checkAndUpdateNewBinary enter {..2024-03-20 11:50:16 svcAppLookup.exe [2924] <DEBUG> [stealth_manager]: flag delete : 0..2024-03-20 11:50:16 svcAppLookup.exe [2924] <DEBUG> [stealth_manager]: copy hookDll32 : 1..2024-03-20 11:50:17 svcAppLookup.exe [2924] <DEBUG> [stealth_manager]: copy hookDll64 : 1..2024-03-20 11:50:17 svcAppLookup.exe [2924] <DEBUG> [stealth_manager]: CStealthManager::checkAndUpdateNewBinary exit }..2024-03-20 11:50:17 svcAppLookup.exe [2924] <DEBUG> [ws_process_monitor_service]: ServiceWorkerThread enter {..2024-03-20 11:50:17 svcAppLookup.exe [2924] <DEBUG> [ws_process_monitor_service]: Loading Name Map..2024-03-20 11:50:17 svcAppLookup.exe [2924] <DEBUG> [stealth_manager]: CSt

C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debug_update_service.txt

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	510
Entropy (8bit):	5.07661842671772
Encrypted:	false
SSDEEP:	12:qOKFeQbt/GuOKFeQahOOKFeQXOKFeQavOOKFeQr6mK7:qfXZfxfZf+OfN6mK7
MD5:	0D9F1FFFBDC751C3511433EAD7C05576
SHA1:	79868804E1596BAF59D73E126BD31F013B332512
SHA-256:	5F2E9677E84362C2A520934268AA59A512A12843359C64865B112347A7226C9C
SHA-512:	53A625F48E9282E1220B9668D1BAF81C3784A5649671B161A589D6FDB440E129618D34E2D6B1C39B2C44D6413E107AD0D1C24D1A693C92AAC70C6BFD908DD9A2
Malicious:	false
Preview:	2024-03-20 11:50:13 svcAppUpdate.exe [4332] <DEBUG> [ws_update_service]: ServiceMain: service started..2024-03-20 11:50:13 svcAppUpdate.exe [4332] <DEBUG> [ws_update_service]: ServiceWorkerThread enter {..2024-03-20 11:50:20 svcAppUpdate.exe [4332] <DEBUG> [ws_update_service]: Exit update service..2024-03-20 11:50:20 svcAppUpdate.exe [4332] <DEBUG> [ws_update_service]: ServiceWorkerThread exit }..2024-03-20 11:50:20 svcAppUpdate.exe [4332] <DEBUG> [ws_update_service]: ServiceCtrlHandler : CtrlCode = 0x1..

C:\Program Files (x86)\Windows Provisioning\logs\2024-03\debuglog.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	31882
Entropy (8bit):	5.2964555461120835
Encrypted:	false
SSDEEP:	384:DXgx5h9jenjJ7/k7/V7/+7/n7/Q7/x7/K7/67/h7/s7/jg27/GW3Wz7/gc7/47/8:DQx5zM90l
MD5:	38AC2BED7349F1EE33279051265C2554
SHA1:	F8BB4F77C159147EAC3D0253DF215B0A3406E472
SHA-256:	C484138B4FCDA4F0DECDD5977B39050AC071A38AA39410746C0ABFEF6D65E09D
SHA-512:	3DEACF5280956A6E0237B8EE9B7AA9AF9ACE1E2994C37FC9FB78DEE54952F02DBE969519FB4ADA18EA96B219174972E8CE544EBF7CFC247EAD5BC9BC8A655B96
Malicious:	false
Preview:	2024-03-20 11:50:17 rundll32.exe [6056] <DEBUG> [fx_ws_main]: Last error: 0..2024-03-20 11:50:17 rundll32.exe [6056] <DEBUG> [fx_ws_main]: Show dialog: 0..2024-03-20 11:50:17 rundll32.exe [6056] <DEBUG> [fx_ws_main]: License path: ..2024-03-20 11:50:17 rundll32.exe [6056] <DEBUG> [fx_ws_main]: Status path: ..2024-03-20 11:50:17 rundll32.exe [6056] <DEBUG> [fx_ws_main_form]: CFxWSMainForm::CFxWSMainForm enter {..2024-03-20 11:50:17 rundll32.exe [6056] <DEBUG> [fx_ws_main_form]: Ole init result: 0..2024-03-20 11:50:17 rundll32.exe [6056] <DEBUG> [app_engine]: CAppEngine::initializeCommonComponents enter {..2024-03-20 11:50:18 rundll32.exe [6056] <DEBUG> [app_engine]: Start WPcap service..2024-03-20 11:50:18 rundll32.exe [6056] <DEBUG> [stealth_manager]: Launching NPF service..2024-03-20 11:50:18 rundll32.exe [6056] <ERROR> [stealth_manager]: Failed to start NPF service, error code: 31..2024-03-20 11:50:18 rundll32.exe [6056] <DEBUG> [configuration_manager]: CConfigurationManagerImp::upda

C:\Program Files (x86)\Windows Provisioning\logs\2024-03\nflog.log

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.220245256426672
Encrypted:	false
SSDEEP:	24:nAzcOxzQvzQrxzQvzQrxzQvzQrxCy4Tv4EvCuy:nAQkUvUdUvUdUvUdCyk1Cuy
MD5:	B3DA3AA5B7F0553B7D6C1ADE6060FD38
SHA1:	F83B68BC206833E25CECB6AD384859794A137557
SHA-256:	24B6F804B721A2646FDC02E92002CCEA1A6D1C2CBAFDA9BB281B39C1C405B7C0
SHA-512:	8DD7D3289E5CF9E5A9C37D1C2E6A3EC520C6481B08EDAE52E3F4AF56FBB7E87DDB6C8B8B0BC7DD06636635268FE0C46F36A4BB42F779A654173AC4C93454D0A0
Malicious:	false
Preview:	2024-03-20 11:50:17 nt_system_service.exe [7060] <DEBUG> [ipc_manager_wm]: IPCWebmailServiceManager::IPCWebmailServiceManager enter {..2024-03-20 11:50:17 nt_system_service.exe [7060] <DEBUG> [webmail_store_temp]: Handle : 000002F0, Error : 0..2024-03-20 11:50:17 nt_system_service.exe [7060] <DEBUG> [ipc_manager_wm]: IPCWebmailServiceManager::IPCWebmailServiceManager exit }..2024-03-20 11:50:17 nt_system_service.exe [7060] <DEBUG> [webmail_handler]: WebmailHandler::setWebmailCaptureManager enter {..2024-03-20 11:50:17 nt_system_service.exe [7060] <DEBUG> [webmail_handler]: WebmailHandler::setWebmailCaptureManager exit }..2024-03-20 11:50:17 nt_system_service.exe [7060] <DEBUG> [webmail_handler]: WebmailHandler::setWebmailCaptureManager enter {..2024-03-20 11:50:17 nt_system_service.exe [7060] <DEBUG> [webmail_handler]: WebmailHandler::setWebmailCaptureManager exit }..2024-03-20 11:50:17 nt_system_service.exe [7060] <DEBUG> [webmail_handler]: WebmailHandler::setWebmailCaptureManager ent

C:\Program Files (x86)\Windows Provisioning\logs\2024-03\postinstall.txt

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\post_install.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9381
Entropy (8bit):	5.25413814884236
Encrypted:	false
SSDEEP:	192:H6uVBlbNsvXr86+w8PBhslhclh+l2ui+QkeQUeQmezoPQmIXELizgWLizgEgp/gk:nooQ7u12G+q
MD5:	99253D2FBBB879B7FE3945CBCA0A482F
SHA1:	ABC804680E2B273433EA2D9921E1A61DC75E7B44
SHA-256:	61AEB4AE8816D1F50C9877F6C5369CE9650551768BD6441BE23AAEA573618CD8
SHA-512:	CFE31B62924B99B095F6BDA0CAAFE6D96C7D62480122DC8E4D604F1908694D50139EAD1010E2699F82EFD947BDA5FAA657DBBE1728C32FBB448447886A0829AB
Malicious:	false
Preview:	2024-03-20 11:50:09 post_install.exe [3304] <DEBUG> [post_install]: 0) token exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe..2024-03-20 11:50:12 post_install.exe [3304] <DEBUG> [post_install]: 1) token inst=C:\Program Files (x86)\Windows Provisioning..2024-03-20 11:50:12 post_install.exe [3304] <DEBUG> [post_install]: 2) token s=1..2024-03-20 11:50:12 post_install.exe [3304] <DEBUG> [post_install]: 3) token k=..2024-03-20 11:50:12 post_install.exe [3304] <DEBUG> [post_install]: 4) token p=..2024-03-20 11:50:12 post_install.exe [3304] <DEBUG> [post_install]: 5) token r=0..2024-03-20 11:50:12 post_install.exe [3304] <DEBUG> [post_install]: Ole init result: 0..2024-03-20 11:50:12 post_install.exe [3304] <DEBUG> [post_install]: Install path: C:\Program Files (x86)\Windows Provisioning..2024-03-20 11:50:12 post_install.exe [3304] <DEBUG> [post_install]: Reinstall : 0..2024-03-20 11:50:12 post_install.exe [3304] <DEBUG> [stealth_manager]: CStealthManager::deleteH

C:\Program Files (x86)\Windows Provisioning\logs\2024-03\startuplog.log

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe
File Type:	ASCII text, with very long lines (317), with CRLF line terminators
Category:	dropped
Size (bytes):	2734
Entropy (8bit):	5.448033214268957
Encrypted:	false
SSDEEP:	48:dgpuRgPXWgPOgPxZg5Azg5Vg5HWg5aZTg5aZRg5aqg5Og5aGg5aXg5kg55g5aVg+:e8CPBx5a5A85m5HB5aZc5aZC5a15J5aB
MD5:	762B3E2EFC8E06238DCB2E4B370E1BC3
SHA1:	77EC9406CFFB8D5FD6D1E76BD450D26CCAFC5910
SHA-256:	E72D7EFD1C26E752528119C84E2297662A3C1BF863904A57DBD3C36AAA263C70
SHA-512:	F684E9723FD9E88F9130343CBC08178241A31344CC6CBA37E265E7D49C1775208DECE13447A6C3A699FB0016370D27FA0781C41E96000E78840B51906F159CB1
Malicious:	false
Preview:	2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [processs_monitor]: Windows 8 or newer..2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [StartupAgency]: ServiceMain: service started..2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [StartupAgency]: argc = 4..2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [StartupAgency]: License path = , Status path = ..2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [stealth_manager]: flag delete : 0..2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [stealth_manager]: copy hookDll32 : 1..2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [stealth_manager]: copy hookDll64 : 1..2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [stealth_manager]: CStealthManager::checkAndUpdateWinPcapLibrary enter {..2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [stealth_manager]: CStealthManager::checkAndUpdateWinPcapLibrary exit }..2024-03-20 11:50:16 svcAppInit.exe [6556] <DEBUG> [stealth_manager]: CStealthManager::checkAndUpdatePocoLibrary enter {..2024

C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	190464
Entropy (8bit):	6.420117010029419
Encrypted:	false
SSDEEP:	3072:L9wyqr9aNtelu9p7GEpji1wvBtLBdQqaMBHJR5p5PqQre3EuM:Z8r9aNtuuf7NRjBdQqVBJR9Cl3EuM
MD5:	3337B8D5AAB06D9072E3D4A72E0F9D26
SHA1:	2AC8E9CB0F8E3BA05535EE300D49D1DBFCF8C35B
SHA-256:	5CB4335CB4360B0187AB868B7DADC7E4B45913B676786F2AC95D2C9044861646
SHA-512:	C5588770C7BF21F37912FB2616B9831718E74CCA0B7E63A0E95611C2F93E55B180189D700A4A3C50314FF07305EBD1294C5F84EFC38AC50D4F447D144D189F28
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C9..-j..-j..-j...j..-jp_.j..-j.9.j..-j.9.j..-j.9.j..-j...j..-j..,j..-j...j..-j...j..-jRich..-j........PE..L......Z.....................j.......4............@..........................@............@.................................L...................................."..................................@...@............................................text............................... ..`.rdata..............................@..@.data...`E..........................@....reloc.."+.......,..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	438784
Entropy (8bit):	6.663378126075105
Encrypted:	false
SSDEEP:	12288:u29xzXfvpHMCBkm/4ckvK18d7Xm+S9kMNOU2Eq+xqn6lIzn:u29xzXfvpHMCBkm/4ckvK18d7Xm+S9kT
MD5:	124AD66540633CB743122E2EA5D18C71
SHA1:	12635BB0D5BF3B5B3F0ED24F22055B1447778A3F
SHA-256:	1F0011826BD72DF4232F33A02A8697D4444570C06362B1BA8535E4A11279CFB9
SHA-512:	EE184653A4A30401DB5CA5753F93E1FF7914D0838FBFDC7DA880F1BE423B1C953F2A21FCA3224D83B2EE39589EC18A418994D001C7262DF0E11F13FE21138A70
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.v.....................s......s......s.t..........z[.........d...?Z.]...z[.....z[.....z[.....z[.....Rich....................PE..L...I..Z...........!.........................0...............................@............@......................... }..O....r..d.......0........................%...................................o..@............0...............................text............................... ..`.rdata..oM...0...N..................@..@.data....t...........j..............@....rsrc...0...........................@..@.reloc..d-..........................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\libnspr4.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	310272
Entropy (8bit):	6.621497206632747
Encrypted:	false
SSDEEP:	6144:TT9KgQ9caedm0soS4mIEoDoh4zbkrTgmXzmphL9rXD5sCiO:TT9KgQPedm0soS4mIEocdrT9XyphL1XZ
MD5:	C954B7E9D500BADF4DD0A512A273F583
SHA1:	92738209568304FAAE048AF9FB2DD69257CAA1DE
SHA-256:	F3C8E39342F16CFCB2EC9ADB39D1CFF274165D1166FDF6917F8693E5C79B2257
SHA-512:	1072AC3AEE0227027C883D1BAD37217B858EF970DBA63D5F92FE9753D7AC26C18FCEA83E7CECACEA6B69A2DFE4C513E5252B96DAA05A88A133D55C10494BB515
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8j..\|..C\|..C\|..C.ZCx..C..RCQ..C..PC`..C..SC...C\|..C...C.\|$Cw..C_.SC4..C..WC}..C..TC}..C..QC}..CRich\|..C........................PE..L......Z...........!.........V...............................................0............@..........................=..P,...-..x...............................,1..........................x'......0'..@...............4............................text............................... ..`.rdata..............................@..@.data....V...p.......`..............@....tls.................z..............@....rsrc................\|..............@..@.reloc..6;.......<..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\libplc4.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	5.9623369659924
Encrypted:	false
SSDEEP:	1536:dW9TO0UhPa0Xqtr+RcCGK/sWjcdEPSCc:dW9L0zGKAEPSCc
MD5:	27B213629FC5B93C819ED03F17D027B5
SHA1:	D411238078DE7D2338395D74346272188DCD7569
SHA-256:	D2ED23112E0BC007319F44C0379513381F1FEEB6E82051588156A1AE18640902
SHA-512:	B3FB9A0D8744ED4C7D9A765FB0427461A805133ACC8D7857CDC358737EB06D2417E0F2FED9675E807597BC715E35CC5197A856BE06537BA54D8C14DA44F03AA7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... ... ... ....d.".......2......./.......w...F'..#... ...v....&......F'..!...F'..!...F'..!...Rich ...........................PE..L......Z...........!.....\|...........1.......................................@............@.........................`...........<............................ ..........................................@...............(............................text....{.......\|.................. ..`.rdata..<L.......N..................@..@.data...4,..........................@....rsrc...............................@..@.reloc..F.... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\libplds4.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	5.864142896774992
Encrypted:	false
SSDEEP:	1536:QK2zRk5CDHri6Q4NgAhcd0sWjcdExNgTzfpK+:6BHW6Q4NW7ExNgTzfpN
MD5:	556C4D654D05A291D144C05A1FF1CD3A
SHA1:	2FB0718A88D93C9547A10CE8923C45EC1DD0550B
SHA-256:	7732A4F4B808DEA0E7FC98740D8FB4FA8EBFA7E2D9EFA693B1CE72981E075DDE
SHA-512:	E0BCC856111E7B60CA802A6226EFB45DBA6195E67D6A1927609C8CCFFF899EDDD4F694D7EFB1C18D175E9575D6080070D8EA750C69508FB7AC451EC6CA7601A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.A;c./hc./hc./h...ha./h...hq./h...hi./h...h4./h.+.h`./hc..h3./h@*.h`./h.+.hb./h.+.hb./h.+.hb./hRichc./h........PE..L......Z...........!.....p..........B%.......................................0............@.........................p...,...D...<.......................................................................@............................................text....o.......p.................. ..`.rdata...I.......J...t..............@..@.data...4,..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\nss3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	915456
Entropy (8bit):	6.409619510793422
Encrypted:	false
SSDEEP:	24576:GDgt3Iu9ER+2r2BCBt/x0Pq4CxFGTInIu4MSg:mgB52HWMSg
MD5:	86CBDC08307EC5A60D5DAE63F1BF7F1D
SHA1:	FE71CB33BB49CB7FEF943367D9ED9B7E7234D6B6
SHA-256:	C50FE83362D84714915A3D429E675F35562F02A0712697B761E57149760898CC
SHA-512:	6200F5766F95AA66FB6C54E2C00841839CFBF911FC716281D09CE283B25645919A83550FD90DA4C4631F424C6F5BDEEA21C7420524E4738B5A95C95A79BDF7A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^I...(...(...(..._ ..(....V.;(....T..(....W.`(..\|.R..(...(..r)..9.W.(..\|.S..(..\|.P..(..\|.U..(..Rich.(..........PE..L......Z...........!.....r...................................................p............@.........................`....i......x................................a..................................p...@...............D............................text....p.......r.................. ..`.rdata..G............v..............@..@.data...`E...........h..............@....rsrc...............................@..@.reloc..8p.......r..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\nssckbi.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	397824
Entropy (8bit):	6.85298728759357
Encrypted:	false
SSDEEP:	6144:SVfDnPf5QwOk8/H1rBHY4FFS5XVpLMTVaHAVIIYI4LBzCsu:SVfDnPhQPrBHY4HSLpqVIIYI4LBzBu
MD5:	659F25DD0FC41F0D756386AB45FA426B
SHA1:	C55246262CC066742C970E360D3661CA24BC62AD
SHA-256:	7957CCC254495C565F26391E0A81A527CED9BC1EB3DD7F1E1D3F99C3DBD18508
SHA-512:	9EC45B2DBDDE3B655B091C254FD9282C781C9D296417BEAF56EF3A3776F99389D3C9A5F5E11FB1E1E90B4463CEF230A0F6008CF3CC413D5664E8246C096CD4E2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......X...X...X..,X...X.hZX...X.hXX...X.h[XV..Xg@^X...X...Xe..X"A[X...Xg@_X...Xg@\X...Xg@YX...XRich...X........PE..L......Z...........!.....@...................P...............................`............@.............................P....x..d............................ ...6...................................u..@............P..`............................text....?.......@.................. ..`.rdata..`1...P...2...D..............@..@.data...Tx.......Z...v..............@....rsrc...............................@..@.reloc...=... ...>..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\nssdbm3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175104
Entropy (8bit):	6.380804511310592
Encrypted:	false
SSDEEP:	3072:uy+ViWjqFwR/IW3gpqCFEak9xXXlj967YuUWXEcKBMydTuoQ3UpqTItre14FodB:us/Q8pqp9xXXlpuqBoc0TQk
MD5:	32DD3C576D236577E9F23EE4D016C467
SHA1:	9A8B2DDAED3DB4E94FF607AD235BBA6698D8F2C7
SHA-256:	8D367AC7A3007789CB2006AA4CFB038BEBFF5D11F4C6F130DCB60B1496AC0BEE
SHA-512:	CB07D3C86C71BB500B612D6A09212B4FE255A27EAEA8E60ACC83CA318B3F9F5BAF608315598AD23B499CE4A900265DF071E7892A10C00FCFC3EC078E871D5B67
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.U.B.U.B.U.B...W.B..P..].B.6..I.B.6..D.B.6../.B.3...R.B.U.C...B.v...C.B.3...T.B.3...T.B.3...T.B.RichU.B.................PE..L...W..Z...........!................"n....... ............................................@.........................`}......,l..d.......8.......................H...................................hg..@............ ...............................text...6........................... ..`.rdata..g^... ...`..................@..@.data...$/...........r..............@....rsrc...8...........................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\nssutil3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217088
Entropy (8bit):	6.551633114866076
Encrypted:	false
SSDEEP:	3072:zW2hMZf9HEyhtRU/U5YZndpTO7QO3dxINXgOwLhw84WxoRxz:qgQlETU5MMQYIHGi
MD5:	30E199190DCD45BA0D122FCD30C274BE
SHA1:	3DCFB388137475AA10C89433EE6BD46F511CDDE4
SHA-256:	50B0ADF97C13E3589B5A765564B05FA580E569DA69E3A9BD55E3B3B61EE46A41
SHA-512:	AF65B9B7128E0DA663D8057B39F11C004314A769C8FC4D75EA1E63544D25D1E08E1E926AB0366C290B4CC8DFC23A906C4EF7ADC2532B91ECF7B228BCAF74BB8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u1x.._+.._+.._+5c.+.._+W..+.._+8.+.._+8.+.._+8.+_._+...+.._+..^+Y._+...+.._+...+.._+...+.._+...+.._+Rich.._+................PE..L...;..Z...........!.........z............................................................@......................... ...8.......d....p..............................................................P...@............................................text...]........................... ..`.rdata..X...........................@..@.data....:...0......................@....rsrc........p.......$..............@..@.reloc..:&.......(...(..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\smime3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149504
Entropy (8bit):	6.209364843209916
Encrypted:	false
SSDEEP:	3072:C56aJqLAr7FkF0MrztzsWb1nnbooLGl4AK3vZUsgBHY3P3f4PlQkDHbzisttdzhh:q6aZkFHtzsWb1nnboWG8vL3P3gPGy9PX
MD5:	022B6FB51D33F9A076329D7A91B40620
SHA1:	11E964F14883D961ED462ED99990AE40D127EC87
SHA-256:	666421A0F6F87DFD72F8D1A68A95417709D7ADB47A3F91907EC3686108A6F38B
SHA-512:	B947DCDD32D0A5AFB0E4F8F9505C4ACDFE16EA7DD6CAE2B9C511F24ED9B88CC1513E39C21FFD454BC42D9CF26B78BFD332D98859C636C242B223D6C6BC1C7D44
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*`>YK.mYK.mYK.m.<.m[K.m...mKK.m...mUK.m...m.K.m?..mRK.mYK.mCJ.mz..m}K.m?..mXK.m?..mXK.m?..mXK.mRichYK.m........................PE..L......Z...........!.....~..........f3....................................................@..........................................`.......................p..........................................@...............8............................text....}.......~.................. ..`.rdata..............................@..@.data...4....0......................@....rsrc........`.......(..............@..@.reloc..>....p.......,..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	219648
Entropy (8bit):	6.348174231200735
Encrypted:	false
SSDEEP:	6144:bBDa8PtdxEWGT1isGfjyxDui2B1dFkYus:bBpPCWG8mxii2zdd
MD5:	485AA9DC1D332EF1A9DC31F19A526F82
SHA1:	FF19B3E0A4B379EA4B39075946DA2148859D8ADE
SHA-256:	BC85490155DAA4C31A2D39447B477A4E442AF47EC83939BD37353857B44C4899
SHA-512:	62699CB8F889F7D05EC36A6E57685C2A66110096BA97A949911441C3F7AC3BD100BF306C840AE96C883CD03970CEA012DBACA884246F8E6778F3664E9CABC2AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u..1..1..1....R.3..',.0...A$.+...A&.:...A%.P..Wi .:..1.....h%."..Wi!.0..Wi".0..Wi'.0..Rich1..........................PE..L...T..Z...........!.................-....................................................@.........................@......T........`..8....................p...!......................................@............................................text.............................. ..`.rdata.............................@..@.data...\/...0......................@....rsrc...8....`.....................@..@.reloc...+...p...,..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nss\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	617472
Entropy (8bit):	6.659091537520531
Encrypted:	false
SSDEEP:	12288:yyWvcxz3CO9uerS8bf5+yNejUogPr4faWAIhZxsvcI0z+UYOxVJEQU:yyWvQ3CO9uevQvfgPr4fa5cZU/0CO8
MD5:	6AC28CF170907BA16B68BD39EE86BC29
SHA1:	8F528C24F39E7EF708EEDFBFD657B026053711F8
SHA-256:	90645044AFE1C79ECC8877CF9C79414916E1EBD94EBC8714CB68AE34BD89A6A3
SHA-512:	C59EEAC9E5AF7CED0510B9C13131EE4C848283A484104F1681F6264701FDEF2512C2913AFCA68600FF0DC6E9E114BF8DDE50217A6AE0E360BFFF2FC7F81EE4BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................`.X....m......m.,....m./.....!/..... +..... -....Rich....................PE..L...M..Z...........!.........v.......}.......0............................................@.................................t...(............................p..l@......................................@............0...............................text............................... ..`.rdata.......0......................@..@.data....F... ...$..................@....reloc...G...p...H...$..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1601024
Entropy (8bit):	6.582945039794064
Encrypted:	false
SSDEEP:	49152:aDxD+hCoVj+4naaTcdpb12IhjmEpWp2f:aditVjNnaag/b1Th
MD5:	64F8F960D535AA6200E620C1DEF292FB
SHA1:	5256DCD40F1538BCA829734CA8EBCA461DD95694
SHA-256:	2589E277BB9FA363873ABB842EEE89BC1CBEAE2B2AEECE18FAFEA056103B1745
SHA-512:	521859840737108D9E8C7FAC054D44379695C064B3FC65DD554E3C7D1F6114D0FB3D057260CDA67EEF9EAC80C88AA3C32145CF6E79EA8FA7FE74EB6ACA46A6C4
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........Yq..8..8..8..Ya..8......8..a...8..@..8..+f..8.."...8..f..8..f..8..f..8..f..8..a...8..a...8..8..:..+f..8...f..8..+f..8..Rich.8..........................PE..L....Z.e.................@...................P....@..........................p............@.................................x....................................m...m..p....................n......Pn..@............P..D............................text...P?.......@.................. ..`.rdata..hg...P...h...D..............@..@.data............N..................@....tls................................@....gfids..t...........................@..@.rsrc...............................@..@.reloc...m.......n..................@..B........................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\post_install.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	6.471361326454725
Encrypted:	false
SSDEEP:	3072:e9fer0Fdxwe2aN8PqghdFat9e92H0+naS+v0523c4oGOOWt:B0FdxIqghdFat9e9U0+nOvh3cSOOq
MD5:	52A76696B447635922D8EC87D0DA7FEE
SHA1:	2754B27A4576370C33A3962137E6BFFD7717FEAC
SHA-256:	DA96B594A132F2983494EA66CA8E683FCE4BBC8AFAF46E5F93D79592BCC6CC75
SHA-512:	E2C8E6A1B3D66BD0D98FBC22DAA42DC3EB943C7A0DBCB0F9B4F4144C5DEF06B698B6A9378D886359904D46448A1CA5104C4EBA32EFC2B83D0C6C765BC63EC3DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................y.......................ZL:...ZL!.....................}.........Rich....................PE..L...4].e.....................................0....@..........................`............@.................................(...h............................0...$......p..........................p...@............0...............................text............................... ..`.rdata..R....0......."..............@..@.data...............................@....gfids..t...........................@..@.tls................................@....rsrc...............................@..@.reloc...$...0...&..................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12700672
Entropy (8bit):	6.9672580308000205
Encrypted:	false
SSDEEP:	196608:lwKioTfB+Hlj1bsOkKSt9xZI8wFf112MrobUXzvsIRrl:lBBBCbsOQt9xZI8wFf1Z8tIJl
MD5:	51C85EA158A27F0BE6D020D7524BE8AC
SHA1:	84DFC155635FE83C0C742B3045784C87A89E5F84
SHA-256:	4D2AA7200F4DB66770FCD5D087925F745A6BDF225F1FF55A017DF54AF7140294
SHA-512:	E8F3424E5C1898838CF686B1D917B2B9253B41B176FD5C53E31FE9E0A7C9B4B3583BA2B53C0BEC84FCEA43B17C5B99A509AD472116E1274B729469B03E05A4F9
Malicious:	false
Yara Hits:	Rule: Windows_Ransomware_Hellokitty_d9391a1a, Description: unknown, Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll, Author: unknown Rule: Windows_Ransomware_Hellokitty_d9391a1a, Description: unknown, Source: C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll, Author: unknown
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........\.\.=i..=i..=i.Fdl..=i..E...=i.=....=i..cj..=i..cm..=i..ch..=i......=i.4cm..=i.~...=i..cl..=i.4ch..=i.~...=i.~...=i.~...=i..=h..9i.4c`..?i.4ci..=i.1c...=i..=...=i.4ck..=i.Rich.=i.................PE..L...H\.e...........!......}..$N......\|Z...... }...........................................@.............................L...,..p.... ..`.(......................s...V..p...................\W.......W..@............ }..............................text.....}.......}................. ..`.rdata...R... }..T....}.............@..@.data...du...........^..............@....gfids..h............r..............@..@.tls.................t..............@....rsrc...`.(.. ....(..v..............@..@.reloc...s.......t...X..............@..B................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.59221818170857
Encrypted:	false
SSDEEP:	1536:KBw6F6OpjWpsm9l19z+VZJK0bI1CCd2woq77cBbShJeeOACGsk60aMGGOoTS4Z3x:svFE1l+rJKVDK2ekaQO5uguGho
MD5:	3135A7FEE1AD484104A1309104312D9E
SHA1:	85F7C56D52F6E3EC08BE8F985E682F5F34703ECF
SHA-256:	1286B65FE6590F43875469A4CFD4F4E21768AB87EBE8A3A31FDAD58E73E4A561
SHA-512:	05D113FF8625560EDB355FB93419328A8055ACD8F21CBE56363BEB85A3D3C8A1B3D2686B8A18F8BDF99963F32BBC3E000EE81936CF9DCFF8054D6628D2324B86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.f...5...5...5.im5...5.O.4...5.O.4...5.O.4...5<.05...5.O.4...5<..5...5<.55...5...5...5vO.4...5sO.5...5vO.4...5Rich...5................PE..L...AZ.e.................d...........C............@..........................p............@.....................................T....@.......................P..........p...........................0...@...............d............................text...&b.......d.................. ..`.rdata..:............h..............@..@.data...8...........................@....gfids..p.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\svcAppLookup.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6077952
Entropy (8bit):	6.615630742155116
Encrypted:	false
SSDEEP:	98304:KYjEcSNV5+O7gLGvz+/gO9v/wh34Bm06kv33E5MsyEEKDCOr6AXRQP:KYjED4GL+/gO9v/wh31qMM5EEA
MD5:	77FAD01911F74D654E84C632BCE277BE
SHA1:	C36318140F45AB98AFB17A3AB0E3805C0531AB4F
SHA-256:	811C4E3A77FC525C0E56A64DD587334DEAD86C8F5C7EC9F15639217BF349A381
SHA-512:	CA446F4D469449D57B935970154224373A7FF27CCB6561673919C1A428B962919B2CAC733B9F739B96FB4B5B548479961A405D08341ABCBBDFD03E838B235450
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........t.V.............m#.....CL......1K.......K......8.w......K.......K......{.a.....1K.......K......{.~.....{.`.....{.{.............1K..R...1K......4KO.....1K......Rich....................PE..L...#].e...........!.....:N.........^.5......PN...............................c...........@...........................S.T...d.S.l.....Z.......................Z.@....+Q.p....................+Q.....p+Q.@............PN..............................text...08N......:N................. ..`.rdata...p...PN..r...>N.............@..@.data.........S..T....S.............@....gfids..h.....Z.......T.............@..@.tls..........Z.......T.............@....rsrc.........Z.......T.............@..@.reloc..@.....Z.......T.............@..B................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	610816
Entropy (8bit):	6.741602893603179
Encrypted:	false
SSDEEP:	12288:j6u2Y3jkg7hVtdjBDhiQsZCt4O9UUjS/dKIOb:nLIAV7BDHwCt4OqUju
MD5:	794122A33A390FF07CA891B568110D10
SHA1:	2B9FC5468973B0362AA2E6C564B80E267F96CCA1
SHA-256:	E210AACEC16E781DE0025D052198F8FCB7458E94C4CE3B018FCF9CCDFC42F88C
SHA-512:	9E2E9DDE79BC85C2E06F98E2508FC61EC37F377DFD28A8C97DCEE222EA78EB25C94409B9B307AE98C1AD4D448C38313E3580CEA42098B312085C7916B1695511
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.k....................7.......7.......7.......7...(....d.......d..................0...........................Rich............................PE..L....Z.e.........................................@.......................................@.....................................h....`.......................p..dE......p...................\...........@...............D............................text............................... ..`.rdata...%.......&..................@..@.data.... ..........................@....gfids..t....@......................@..@.tls.........P......................@....rsrc........`......................@..@.reloc..dE...p...F..................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.233845038179117
Encrypted:	false
SSDEEP:	1536:Adh0y/0bo0Tgd42zPUCK6mjsjDBgp7xW9k9vg7GyreZ/MW/qcS:Ag00bo0QPTmg/4WKvIjreqWBS
MD5:	E53E0020D7FE34B1E8F75AF444E64C72
SHA1:	9BDDDA2B776F37A3E685589F7C0212D6974F73DE
SHA-256:	D2B69BD0CAF49DDD0DB51B92990FE88DF8097FC85E22F1DE408B4C905997AED4
SHA-512:	90E4B3B424CF36921069EB112A8A35ECC03995CAE04D49B07E24D218DD1528BB7304A9A2A0334C58B2C28F098F38A278418CB7BB65CA57A3FC4BF6AFB4698681
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..[].}[].}[].}R%.}O].}`..\|R].}`..\|V].}`..\|_].}`..\|.].}..Z}Z].}..A}H].}[].}i\.}...\|J].}..u}Z].}...\|Z].}Rich[].}........PE..L....Z.e.....................b......:.............@.......................................@.................................t2..,....p..............................@...p...............................@............................................text............................... ..`.rdata..r?.......@..................@..@.data........@.......0..............@....gfids..t....P.......4..............@..@.tls.........`.......6..............@....rsrc........p.......8..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\configurations.dat

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	data
Category:	dropped
Size (bytes):	3920
Entropy (8bit):	7.948224416130811
Encrypted:	false
SSDEEP:	96:C5n4zBDEo17hoeYkmElrYsF7Zf7W+h6d/bDgcYohEWgctH:C5n4FDJhoHAb71C/dYcphbPtH
MD5:	F8927576A49A96D59413C1BC6ED58A33
SHA1:	BF961F9797E3A2D4165F39438858CB896F413A46
SHA-256:	B625A8694B4E4D3E360BD153C30DE8851567187F179E988B077AE6F36D2DF5CC
SHA-512:	2337FDDD87B4F94E2FF265C8EA32ACF9E9103FCF263E4D5F0DFFD08DC5329CEC16332EA93F8E796D29E19DAAF933DF6FAECE73C191D0CB92261FB29B5516CFCB
Malicious:	false
Preview:	..H..U.F\|.\..5.\<....0.d...b>..C..P...7Tw...lc.......f_9h\|k..)?...n..H`4....pPti..d..e..Xm......+e....`.ct...rp.,q3.5i.._..c.j....w0..25.:.x.9..E<:D.].Maa.....Bf...n&......J..k...@E.JA.....T..m..K.......2..1.....I0.6r.K...fX.+..g..s......F..B.....p.z$..ru..d....WY.V....\.....G.....j..5S..`.m.u.F.,....k......L....R..\.."..?R..z...._[....L.@+..........g....,.RT0....\|oD..U...e..Ed.>....h.u$...n.-..h.........xU;./g.p.......U.S....-..L...y..O.K..<#._j4U.{x....0T.....gS.......i.L.B.SE.\|.s.......DU-....p.1.3\|jB.e..K._.OG..D.......u\...D...:..J...x-...D...Jl. .im.hz.....L.,.{.(.SG..(.k.}(cZ..z....C.Sf......0..2{4.....3......7..'...0.5,."Woc=`.Y.3..Rn5.S.`..fx..I_d.\|V!w3.u..K..B......0...fT..c.....U...r.....z`.. ..I ...1..Wu2..;..(>..@..f...f.#..)..2........\|.).....3u.d...&........:..X...~...l.(..._.;zf.Y...p...d.Ct....e......].u...5j.?.3..2.y2.Er.Y?....f.i.J..Xo.TA%O.6.}.....7.....&.6]Fy&<....9..O..\..g@_...8u..p...1h.n.....

C:\Program Files (x86)\Windows Provisioning\temp\get_drop_files.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	5.975015207564095
Encrypted:	false
SSDEEP:	384:mKT7wkXtiJRLmal+FI+MprHBjKgfjHkO2kvnpfIvfTYb72f8pevb:xxOJ1BkgfbkYPpAva7M8sT
MD5:	5285E941C30D582AD49228CF7D476464
SHA1:	C428E253EFF240C101655D128B3684828354006A
SHA-256:	C010FA2AAB01EC7DB6830B23A8E542F138BD2D16C6F2C532CEC29DF7C3B31DF4
SHA-512:	BB9F3932E72705BF793161BC28822A9B9A1251E521CD3C1A6018AC68EFC822CA3E2AE5402D46BBB0A27F6DBD2961C71A1A3992FFD59C5DDE1797619E63BB5929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rf..6..W6..W6..W?.OW&..W.Y.V4..W.Y.V7..W.Y.V;..W.Y.V2..W.Y.V...W...W1..W6..W@..W.Y.V2..W.Y#W7..W.Y.V7..WRich6..W........................PE..L...5Z.e....................$.......,.......@....@.......................................@..................................L.......................................C..p...........................pC..@............@..8............................text....)......................... ..`.rdata.......@......................@..@.data...<....`.......D..............@....gfids..T....p.......F..............@..@.rsrc................H..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\nt_system_service.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1601024
Entropy (8bit):	6.582945039794064
Encrypted:	false
SSDEEP:	49152:aDxD+hCoVj+4naaTcdpb12IhjmEpWp2f:aditVjNnaag/b1Th
MD5:	64F8F960D535AA6200E620C1DEF292FB
SHA1:	5256DCD40F1538BCA829734CA8EBCA461DD95694
SHA-256:	2589E277BB9FA363873ABB842EEE89BC1CBEAE2B2AEECE18FAFEA056103B1745
SHA-512:	521859840737108D9E8C7FAC054D44379695C064B3FC65DD554E3C7D1F6114D0FB3D057260CDA67EEF9EAC80C88AA3C32145CF6E79EA8FA7FE74EB6ACA46A6C4
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........Yq..8..8..8..Ya..8......8..a...8..@..8..+f..8.."...8..f..8..f..8..f..8..f..8..a...8..a...8..8..:..+f..8...f..8..+f..8..Rich.8..........................PE..L....Z.e.................@...................P....@..........................p............@.................................x....................................m...m..p....................n......Pn..@............P..D............................text...P?.......@.................. ..`.rdata..hg...P...h...D..............@..@.data............N..................@....tls................................@....gfids..t...........................@..@.rsrc...............................@..@.reloc...m.......n..................@..B........................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12700672
Entropy (8bit):	6.9672580308000205
Encrypted:	false
SSDEEP:	196608:lwKioTfB+Hlj1bsOkKSt9xZI8wFf112MrobUXzvsIRrl:lBBBCbsOQt9xZI8wFf1Z8tIJl
MD5:	51C85EA158A27F0BE6D020D7524BE8AC
SHA1:	84DFC155635FE83C0C742B3045784C87A89E5F84
SHA-256:	4D2AA7200F4DB66770FCD5D087925F745A6BDF225F1FF55A017DF54AF7140294
SHA-512:	E8F3424E5C1898838CF686B1D917B2B9253B41B176FD5C53E31FE9E0A7C9B4B3583BA2B53C0BEC84FCEA43B17C5B99A509AD472116E1274B729469B03E05A4F9
Malicious:	false
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........\.\.=i..=i..=i.Fdl..=i..E...=i.=....=i..cj..=i..cm..=i..ch..=i......=i.4cm..=i.~...=i..cl..=i.4ch..=i.~...=i.~...=i.~...=i..=h..9i.4c`..?i.4ci..=i.1c...=i..=...=i.4ck..=i.Rich.=i.................PE..L...H\.e...........!......}..$N......\|Z...... }...........................................@.............................L...,..p.... ..`.(......................s...V..p...................\W.......W..@............ }..............................text.....}.......}................. ..`.rdata...R... }..T....}.............@..@.data...du...........^..............@....gfids..h............r..............@..@.tls.................t..............@....rsrc...`.(.. ....(..v..............@..@.reloc...s.......t...X..............@..B................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\svcAppInit.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.59221818170857
Encrypted:	false
SSDEEP:	1536:KBw6F6OpjWpsm9l19z+VZJK0bI1CCd2woq77cBbShJeeOACGsk60aMGGOoTS4Z3x:svFE1l+rJKVDK2ekaQO5uguGho
MD5:	3135A7FEE1AD484104A1309104312D9E
SHA1:	85F7C56D52F6E3EC08BE8F985E682F5F34703ECF
SHA-256:	1286B65FE6590F43875469A4CFD4F4E21768AB87EBE8A3A31FDAD58E73E4A561
SHA-512:	05D113FF8625560EDB355FB93419328A8055ACD8F21CBE56363BEB85A3D3C8A1B3D2686B8A18F8BDF99963F32BBC3E000EE81936CF9DCFF8054D6628D2324B86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.f...5...5...5.im5...5.O.4...5.O.4...5.O.4...5<.05...5.O.4...5<..5...5<.55...5...5...5vO.4...5sO.5...5vO.4...5Rich...5................PE..L...AZ.e.................d...........C............@..........................p............@.....................................T....@.......................P..........p...........................0...@...............d............................text...&b.......d.................. ..`.rdata..:............h..............@..@.data...8...........................@....gfids..p.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6077952
Entropy (8bit):	6.615630742155116
Encrypted:	false
SSDEEP:	98304:KYjEcSNV5+O7gLGvz+/gO9v/wh34Bm06kv33E5MsyEEKDCOr6AXRQP:KYjED4GL+/gO9v/wh31qMM5EEA
MD5:	77FAD01911F74D654E84C632BCE277BE
SHA1:	C36318140F45AB98AFB17A3AB0E3805C0531AB4F
SHA-256:	811C4E3A77FC525C0E56A64DD587334DEAD86C8F5C7EC9F15639217BF349A381
SHA-512:	CA446F4D469449D57B935970154224373A7FF27CCB6561673919C1A428B962919B2CAC733B9F739B96FB4B5B548479961A405D08341ABCBBDFD03E838B235450
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........t.V.............m#.....CL......1K.......K......8.w......K.......K......{.a.....1K.......K......{.~.....{.`.....{.{.............1K..R...1K......4KO.....1K......Rich....................PE..L...#].e...........!.....:N.........^.5......PN...............................c...........@...........................S.T...d.S.l.....Z.......................Z.@....+Q.p....................+Q.....p+Q.@............PN..............................text...08N......:N................. ..`.rdata...p...PN..r...>N.............@..@.data.........S..T....S.............@....gfids..h.....Z.......T.............@..@.tls..........Z.......T.............@....rsrc.........Z.......T.............@..@.reloc..@.....Z.......T.............@..B................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\svcAppLookup.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	610816
Entropy (8bit):	6.741602893603179
Encrypted:	false
SSDEEP:	12288:j6u2Y3jkg7hVtdjBDhiQsZCt4O9UUjS/dKIOb:nLIAV7BDHwCt4OqUju
MD5:	794122A33A390FF07CA891B568110D10
SHA1:	2B9FC5468973B0362AA2E6C564B80E267F96CCA1
SHA-256:	E210AACEC16E781DE0025D052198F8FCB7458E94C4CE3B018FCF9CCDFC42F88C
SHA-512:	9E2E9DDE79BC85C2E06F98E2508FC61EC37F377DFD28A8C97DCEE222EA78EB25C94409B9B307AE98C1AD4D448C38313E3580CEA42098B312085C7916B1695511
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.k....................7.......7.......7.......7...(....d.......d..................0...........................Rich............................PE..L....Z.e.........................................@.......................................@.....................................h....`.......................p..dE......p...................\...........@...............D............................text............................... ..`.rdata...%.......&..................@..@.data.... ..........................@....gfids..t....@......................@..@.tls.........P......................@....rsrc........`......................@..@.reloc..dE...p...F..................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\svcAppUpdate.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.233845038179117
Encrypted:	false
SSDEEP:	1536:Adh0y/0bo0Tgd42zPUCK6mjsjDBgp7xW9k9vg7GyreZ/MW/qcS:Ag00bo0QPTmg/4WKvIjreqWBS
MD5:	E53E0020D7FE34B1E8F75AF444E64C72
SHA1:	9BDDDA2B776F37A3E685589F7C0212D6974F73DE
SHA-256:	D2B69BD0CAF49DDD0DB51B92990FE88DF8097FC85E22F1DE408B4C905997AED4
SHA-512:	90E4B3B424CF36921069EB112A8A35ECC03995CAE04D49B07E24D218DD1528BB7304A9A2A0334C58B2C28F098F38A278418CB7BB65CA57A3FC4BF6AFB4698681
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..[].}[].}[].}R%.}O].}`..\|R].}`..\|V].}`..\|_].}`..\|.].}..Z}Z].}..A}H].}[].}i\.}...\|J].}..u}Z].}...\|Z].}Rich[].}........PE..L....Z.e.....................b......:.............@.......................................@.................................t2..,....p..............................@...p...............................@............................................text............................... ..`.rdata..r?.......@..................@..@.data........@.......0..............@....gfids..t....P.......4..............@..@.tls.........`.......6..............@....rsrc........p.......8..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\uninstall.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167424
Entropy (8bit):	6.6317291634787745
Encrypted:	false
SSDEEP:	3072:1ym6xTu/TTpx6mc/ehGKIb4AyNeEhJYK+4Rtqt5pJtltDqF:56xTu/TTFc/ei6eEhJYK9tqJJbA
MD5:	8F6EBE75FC854863F171EA75F99F84BD
SHA1:	75256941E44751A0F54C06ACA825665EBA58299E
SHA-256:	EDBD44A16173A41216AAD9CCD3E31116EA3C9FF90AF68B6D434F932CB86D8E01
SHA-512:	1B057962DF36242983F3D33600E05B886BDB854DCF0ADA3B429D931B4A775984E66DC7082E9AB0B9BA747EE8D9F7C3A83FF398300415B0C134DC6C40C2539A1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G.c.&.0.&.0.&.0.^E0.&.0+..0.&.0.x.1.&.0.x.1.&.0.x.1.&.0h..0.&.0h..0.&.0.&.0.'.0.x.1.&.0h..0.&.0"x.1.&.0'x)0.&.0"x.1.&.0Rich.&.0........................PE..L...eZ.e..........................................@.......................................@..................................d..\|...............................(....8..p....................9......P9..@............................................text............................... ..`.rdata..............................@..@.data...@............f..............@....gfids..p............j..............@..@.tls.................l..............@....rsrc................n..............@..@.reloc..(............p..............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\version.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	1.9182958340544893
Encrypted:	false
SSDEEP:	3:3jF:J
MD5:	DF4F0F1534FAA418D6185F67DAA63A7B
SHA1:	D1501DEAE95507919B30F2ADFA13EE822464CC92
SHA-256:	3CFDEC96C972680CABF7829616A54508CABCFC4FBF80AB160DCAD001322AF69F
SHA-512:	CF5493D53B591941C1123BF347DDDFC123196A94EB6B1685E32D37BF42FBBEAA8619AF5A6F73F0E1216951856C0C73D97F0DF221020EDC3F27E9CCCC424DEE62
Malicious:	false
Preview:	2.6.2

C:\Program Files (x86)\Windows Provisioning\temp\windows_hook.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	544768
Entropy (8bit):	5.394993462138102
Encrypted:	false
SSDEEP:	6144:quo4fjUUZS4GlwkWXyKdynaktvEVAVurQWtjfPG4xxm5GCKIBFmgZOetzs8ww:1ZfjGwkrnakaKluPG4/moPyxZZ2w
MD5:	3888783120F2A5AE2B9C6F5ADD3143A9
SHA1:	7B846A34121A3987E3D50D2E1146374D42B695E7
SHA-256:	5314C3C1570595785D58D93287FCCB77B58D94F90888EFACDB3681934C9262F3
SHA-512:	E4AA3359EBCD1C8B146DDABB07909D945F58F40803C83EA36F8FB3579091644E5C04BEAE928A0E115ED9B1D2D9A9315F6F85E915FE9FDE7FCD6CAAB084252B2A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M..M..M..5G..M......M.%...M.....M.....M.....M.....M......M......M..M.NL.W...M.W...M.R.+..M.W...M.Rich.M.........PE..L....Y.e...........!.................F....................................................@.................................P........@.......................P..pN..`...T...............................@............................................text............................... ..`.rdata..............................@..@.data...Hc.......X..................@....gfids..h.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc..pN...P...P..................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\temp\windows_hook_64.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1059328
Entropy (8bit):	5.653709882921514
Encrypted:	false
SSDEEP:	12288:ZpfNRbih34rFQYU6cSKReEl403Mhxet1/eowkUsbgkw7:5RsKQY7wpl4/hxet1/e9kRI
MD5:	D122FE3F4BCAC3809242188DD46ED421
SHA1:	5DEAFB82E8B321BF5B85EFC7B11646A632E796CF
SHA-256:	51605EBA94DBE992BA119DB2FA026323203EDF3E562FD608FFD41450CBA25DFC
SHA-512:	F59A16DC13854816B8FC0B899CFCBBC5C1E8B3D5421F105A542E28DE145354C59EADA1F5BE0155A02D93C3C44D36722DA29790922A2A25801336CDB76B597683
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......-.."i..qi..qi..q.@.qd..q.@.q...q.@.qr..q.#2qh..q...pk..qR..pa..qR..p...qR..pA..q.#,qm..q.#)qr..qi..q=..q...p9..q...ph..q...qh..q...ph..qRichi..q........................PE..d.../Z.e.........." .....@................................................................`..........................................................p..........................0....1..T....................2..(...02...............P...............................text....>.......@.................. ..`.rdata...e...P...f...D..............@..@.data...h...........................@....pdata...............\|..............@..@.gfids.......P......................@..@.tls.........`......................@....rsrc........p......................@..@.reloc..0...........................@..B........................................................................................................................

C:\Program Files (x86)\Windows Provisioning\uninstall.exe

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167424
Entropy (8bit):	6.6317291634787745
Encrypted:	false
SSDEEP:	3072:1ym6xTu/TTpx6mc/ehGKIb4AyNeEhJYK+4Rtqt5pJtltDqF:56xTu/TTFc/ei6eEhJYK9tqJJbA
MD5:	8F6EBE75FC854863F171EA75F99F84BD
SHA1:	75256941E44751A0F54C06ACA825665EBA58299E
SHA-256:	EDBD44A16173A41216AAD9CCD3E31116EA3C9FF90AF68B6D434F932CB86D8E01
SHA-512:	1B057962DF36242983F3D33600E05B886BDB854DCF0ADA3B429D931B4A775984E66DC7082E9AB0B9BA747EE8D9F7C3A83FF398300415B0C134DC6C40C2539A1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G.c.&.0.&.0.&.0.^E0.&.0+..0.&.0.x.1.&.0.x.1.&.0.x.1.&.0h..0.&.0h..0.&.0.&.0.'.0.x.1.&.0h..0.&.0"x.1.&.0'x)0.&.0"x.1.&.0Rich.&.0........................PE..L...eZ.e..........................................@.......................................@..................................d..\|...............................(....8..p....................9......P9..@............................................text............................... ..`.rdata..............................@..@.data...@............f..............@....gfids..p............j..............@..@.tls.................l..............@....rsrc................n..............@..@.reloc..(............p..............@..B................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\windows_hook.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	544768
Entropy (8bit):	5.394993462138102
Encrypted:	false
SSDEEP:	6144:quo4fjUUZS4GlwkWXyKdynaktvEVAVurQWtjfPG4xxm5GCKIBFmgZOetzs8ww:1ZfjGwkrnakaKluPG4/moPyxZZ2w
MD5:	3888783120F2A5AE2B9C6F5ADD3143A9
SHA1:	7B846A34121A3987E3D50D2E1146374D42B695E7
SHA-256:	5314C3C1570595785D58D93287FCCB77B58D94F90888EFACDB3681934C9262F3
SHA-512:	E4AA3359EBCD1C8B146DDABB07909D945F58F40803C83EA36F8FB3579091644E5C04BEAE928A0E115ED9B1D2D9A9315F6F85E915FE9FDE7FCD6CAAB084252B2A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,...M..M..M..5G..M......M.%...M.....M.....M.....M.....M......M......M..M.NL.W...M.W...M.R.+..M.W...M.Rich.M.........PE..L....Y.e...........!.................F....................................................@.................................P........@.......................P..pN..`...T...............................@............................................text............................... ..`.rdata..............................@..@.data...Hc.......X..................@....gfids..h.... ......................@..@.tls.........0......................@....rsrc........@......................@..@.reloc..pN...P...P..................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Windows Provisioning\windows_hook_64.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1059328
Entropy (8bit):	5.653709882921514
Encrypted:	false
SSDEEP:	12288:ZpfNRbih34rFQYU6cSKReEl403Mhxet1/eowkUsbgkw7:5RsKQY7wpl4/hxet1/e9kRI
MD5:	D122FE3F4BCAC3809242188DD46ED421
SHA1:	5DEAFB82E8B321BF5B85EFC7B11646A632E796CF
SHA-256:	51605EBA94DBE992BA119DB2FA026323203EDF3E562FD608FFD41450CBA25DFC
SHA-512:	F59A16DC13854816B8FC0B899CFCBBC5C1E8B3D5421F105A542E28DE145354C59EADA1F5BE0155A02D93C3C44D36722DA29790922A2A25801336CDB76B597683
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......-.."i..qi..qi..q.@.qd..q.@.q...q.@.qr..q.#2qh..q...pk..qR..pa..qR..p...qR..pA..q.#,qm..q.#)qr..qi..q=..q...p9..q...ph..q...qh..q...ph..qRichi..q........................PE..d.../Z.e.........." .....@................................................................`..........................................................p..........................0....1..T....................2..(...02...............P...............................text....>.......@.................. ..`.rdata...e...P...f...D..............@..@.data...h...........................@....pdata...............\|..............@..@.gfids.......P......................@..@.tls.........`......................@....rsrc........p......................@..@.reloc..0...........................@..B........................................................................................................................

C:\Users\user\AppData\Local\Temp\nsmE645.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.854901984552606
Encrypted:	false
SSDEEP:	192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5:	0063D48AFE5A0CDC02833145667B6641
SHA1:	E7EB614805D183ECB1127C62DECB1A6BE1B4F7A8
SHA-256:	AC9DFE3B35EA4B8932536ED7406C29A432976B685CC5322F94EF93DF920FEDE7
SHA-512:	71CBBCAEB345E09306E368717EA0503FE8DF485BE2E95200FEBC61BCD8BA74FB4211CD263C232F148C0123F6C6F2E3FD4EA20BDECC4070F5208C35C6920240F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L......]...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3010002, page size 32768, file counter 9, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 9
Category:	modified
Size (bytes):	229376
Entropy (8bit):	0.7256748281262911
Encrypted:	false
SSDEEP:	384:S71zkVmvQhyn+Zoz67sU8an6Gp1ZMMTNlH333JqN8j/LKXAdO8596uv:S7wM0sCye
MD5:	F9C2C55CDC6351B4A8055396AFEAFC84
SHA1:	991B2BCA17D7A6706A41740A27C3998A707283FD
SHA-256:	9323955796CC783D33ED83A7E274980DEAB9351ACF245A10D5756423F3CDFFA2
SHA-512:	8AFF829C643499D3A2F5CDF4B620501DB842503ED6D2203159DA620F0926AED7F071EC6785A4195D45627FEFA0EB0979865FC55E80418C883B9112C4AF0D7250
Malicious:	true
Preview:	SQLite format 3......@ .........................................................................-.......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db-journal

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	229944
Entropy (8bit):	0.71297226091747
Encrypted:	false
SSDEEP:	384:7I6ux85Cn8an6Gp1ZMMTNlH333JqN8j/LKX2f1zkVmvQhyn+Zoz67e:mM0sCycf
MD5:	B47E8D8680D6F8714DC98B33EB4B8005
SHA1:	E2604D7C7DE4E41C645EE66613414FF1EBAED7F9
SHA-256:	3E561475ADCAE198C9B1D1C633C9C38F2CCFC63AAFE603D62102A5AC5460B894
SHA-512:	47A07187C86874A8E178F6DBD50B57CC4F0AAEE9616455A8A494786BEF0B2E845AA1C59DFC622D61A6DB72D0C641473A089834A63AFECCC3CF0018875C3AC724
Malicious:	true
Preview:	.... .c.....e.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R....k.........R..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3010002, page size 32768, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.15197124999372147
Encrypted:	false
SSDEEP:	192:dva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vYun:d1zkVmvQhyn+Zoz67tun
MD5:	3BE352A3BA65286BBAEABBB0116DC81D
SHA1:	B6C291A88A92E761A61083911A71BA851A2092EE
SHA-256:	21EA41EB8548E3EB9D17D85205A769E5E2C864167FDCF8AE798C4750761E3A53
SHA-512:	DA966B72CDA576EFBB72D0E8EE5490FE5BCB09577C8338E29872AAFF5863F6F380611EAD445736491F043D6178408CFDB42690281717D08CE4D1137DCE0F8797
Malicious:	true
Preview:	SQLite format 3......@ .........................................................................-.......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db-journal

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	98840
Entropy (8bit):	0.22706952742998673
Encrypted:	false
SSDEEP:	192:7Jeiva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vt:7Jei1zkVmvQhyn+Zoz67o
MD5:	9379A944887007EB4399A105D421E0B5
SHA1:	A269B398F1AD2E2BEBC402FA28A1D924D19731DE
SHA-256:	675387A561698F48B899CCB2869D49F86D7B0DFAE8C9230B490CDD14C37AD6CC
SHA-512:	A70C6C5DF1A89FF166E1D37C9AD7D9B3700DAB41EBADE60753D3CA918D005241EF492356A31DC3005579FA7CA205C98E73C92F12C13CC6B056C22DA3D70E3A8D
Malicious:	true
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js

Download File

Process:	C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe
File Type:	data
Category:	modified
Size (bytes):	9558
Entropy (8bit):	5.509553558339033
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4SW:PeegJUaJHEw9T
MD5:	6330EBA843B2080E3CA68510769DCEC1
SHA1:	B92D347111135234957E26A8FE01F8433ECF758C
SHA-256:	ECC10724DF27ED6183EFA5794E67D642D77A885CFED90A366896FC1965F4D810
SHA-512:	511A49821726A041BC474A43042FEA048ED2447DADD7E565732D7922DF0B27C6E2EDB6BD7A8D3E816E8E8860EAB64C2A754823C677800FA66903618D754606B8
Malicious:	true
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe

Download File

Process:	C:\Users\user\Desktop\5006_2.6.2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2827776
Entropy (8bit):	6.508653659833048
Encrypted:	false
SSDEEP:	6144:8IACSAtjVdHp1vN82Yed05UEl8FV8V306IAThNgUOfN/wZuSSMGYtXU:PACBBp1aJedCFlv06I4NgTN4ZuSS4tX
MD5:	7BCC1F1DEB45BF58C7C559DFE3240E08
SHA1:	80837EE226B256F9E24FA64C9188C6F92D253835
SHA-256:	79E2537982C1AEDE2925F5083F916BEECAE23301E2E04F3DEF69E849DCB9AAD9
SHA-512:	9F05B597C0382AA4409E2AB9F3C38C8E67D499CDA891C89D981BC64BA97A986E779375BB0D974BD9E3E63B840FA41A677007C2643591F40C41628FE9DF89C592
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P..............U.............................U#..............U#..........[.............9.......Q.............Rich............PE..L....Z.e......................).....Q`............@..........................p+...........@..................................Q............(..................P+.....p/..p...................<0......./..@............................................text............................... ..`.rdata..............................@..@.data...h....p.......Z..............@....gfids..t............^..............@..@.tls.................`..............@....rsrc.....(.......(..b..............@..@.reloc.......P+.......+.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe

Download File

Process:	C:\Users\user\Desktop\5006_2.6.2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	16131606
Entropy (8bit):	7.980924133095628
Encrypted:	false
SSDEEP:	393216:muo7WoZ24T+6vdEuIkTx49pktdzjPsxKZEOOtIoTSOderB+:m7Wk29odk3H0dHjEHtIh8e4
MD5:	2F61BD2AC7DC2252AD5743093CEB09DC
SHA1:	B3CE0F074037B1E9513680516F6B1B0A87CE242B
SHA-256:	2A75269F9C3012561E1DB5CB7883BE6A0DA057EDC2F61A6AC7610C2079689635
SHA-512:	D723D8738350DBCDE2066B666CE0CF96E4F9FA088CCDA11B51241E876347A1288607BEFABBAD981C218BCFB1B1411F6234D242D0172B9EFE10F3FD19B7B63387
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F.....F..G.w.F.....F..v..F...@..F.Rich.F.........PE..L......].................d...\|......k2............@.......................................@.................................<........... ............................................................................................................text....b.......d.................. ..`.rdata..J............h..............@..@.data....U...........\|..............@....ndata...................................rsrc... ...........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Windows Provisioning\version.txt

Download File

Process:	C:\Users\user\Desktop\5006_2.6.2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	1.9182958340544893
Encrypted:	false
SSDEEP:	3:3jF:J
MD5:	DF4F0F1534FAA418D6185F67DAA63A7B
SHA1:	D1501DEAE95507919B30F2ADFA13EE822464CC92
SHA-256:	3CFDEC96C972680CABF7829616A54508CABCFC4FBF80AB160DCAD001322AF69F
SHA-512:	CF5493D53B591941C1123BF347DDDFC123196A94EB6B1685E32D37BF42FBBEAA8619AF5A6F73F0E1216951856C0C73D97F0DF221020EDC3F27E9CCCC424DEE62
Malicious:	false
Preview:	2.6.2

C:\Windows\SysWOW64\Packet.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98040
Entropy (8bit):	6.127745728436191
Encrypted:	false
SSDEEP:	1536:zg6Z54QkC2wpk2c+ZCDHKklh74RTfIEtaYQ0:M6Z54ARcIxk4LIEtaYj
MD5:	86316BE34481C1ED5B792169312673FD
SHA1:	6CCDE3A8C76879E49B34E4ABB3B8DFAF7A9D77B5
SHA-256:	49656C178B17198470AD6906E9EE0865F16F01C1DBBF11C613B55A07246A7918
SHA-512:	3A6E77C39942B89F3F149E9527AB8A9EB39F55AC18A9DB3A3922DFB294BEB0760D10CA12BE0E3A3854FF7DABBE2DF18C52E3696874623A2A9C5DC74B29A860BC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........H...H...H...oe.Z...oe.j...oe.+......C...H...2...oe..L...oe..I...oe.I...oe..I...RichH...........PE..L...<.0Q...........!.........p......`Q..........................................................................................x....P..T............`.......`..d...................................X...@............................................text...:........................... ..`.rdata...+.......0..................@..@.data....,... ....... ..............@....rsrc...T....P.......0..............@..@.reloc..d....`... ...@..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\PocoCrypto.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143872
Entropy (8bit):	6.369995603809854
Encrypted:	false
SSDEEP:	3072:FjY8iLiuBSvvB5irGAB3YFOnzIfuKBNJrSmR:FjiLiuBSvp8au3YFOzuuKBNJrSmR
MD5:	359B243D01126EDFCE72FA17A6D17EF2
SHA1:	986209D7BE14AAD4C485A82BAF696F44060C744A
SHA-256:	B96218444F3AE1DBCCB75DC15FA71D558AB3D2BEA45B9BFE1A0AC5EA4BB21DAB
SHA-512:	7FE92B6CD5EAF210ADA8642FCF274B3C89B24E6D284D89191D8754D5043D950C97F78F7297553C3EE0E56C60D88223C1E2DCB67397259E9F0647F959DFA8A19B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|..........................................................................................................Rich....................PE..L...\.Z...........!........................@...............................p............@..............................R...........@.......................P.......V...............................W..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data........ ......................@....gfids..8....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\PocoFoundation.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1224704
Entropy (8bit):	6.619655547971226
Encrypted:	false
SSDEEP:	12288:hwDrxQ3/DeOaPFLxbLpugOgopp2pPgJY/Nom9XeKcmmriYn9UTn/m+GhhsQk3OTT:hwq3/KOohh+M5gQO9i/WHW3OTriG5
MD5:	7CA710161F0986625BDD223D6E8E37E0
SHA1:	FF29F5F454D7AF49C472C12CD03ED039B2833D4D
SHA-256:	8C32BD7E6F0B286C651AF387836718944A6CB2F28BAB0767255E0161B387CCC1
SHA-512:	CF21B9EC7B13156977A2B06845230CC5222E1F9FBBC2AA7A667DF6ECC60A2A6AE7A08B259F683F53A7C99AAA1B7BC4C1CA1B066E7E6ECB0AF069EA78234A1277
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......JM...,.[.,.[.,.[.T.[.,.[5r.Z.,.[5r.Z.,.[5r.Z.,.[5r.Z.,.[,L.Z.,.[.,.[.,.[.r.Z.,.[.r.Z.,.[.r.Z.,.[.rr[.,.[.,.[.,.[.r.Z.,.[Rich.,.[........PE..L.....Z...........!.................<....................................................@......................... ................`.......................p......P...............................p...@............................................text...'........................... ..`.rdata...(.......*..................@..@.data....I.......:..................@....gfids..@....@......................@..@.tls.........P......................@....rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Windows\SysWOW64\PocoJSON.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	186368
Entropy (8bit):	6.437052892190694
Encrypted:	false
SSDEEP:	3072:xzKRrdhg6Ie/0EjnStS5g22oqlTPcF6cgWoBcyfYZeoazOrTfbyWwCp:xuRjpIWutyTglrpmoBc/Ze7OrTfbDZ
MD5:	A6F591815772522ABB444C19CBCB8875
SHA1:	52D9280B30A399FDCC98CEA5907B4D6BD4B70E4B
SHA-256:	BBEBACA74FA8F7E5354AE9E6AD14485A73D67AFE4CAC8889F49C6257BAA0A5FA
SHA-512:	5C9A43B86CF476DC9C5D2953EB9B3522A9A1492C664CE7D73CAD19D9DAE80EBFE002BD8AA5FC41D063D810F7E0FA9B5BA37D4D54388E87BFED8042CD5CF2B85F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z...>...>...>...7...4.....=.....+.....5.....:.....=......<...>........3.....?.....f.?.....?...Rich>...................PE..L...$.Z...........!.........................................................0............@......................... +..(J..Hu...................................!..`...................................@............................................text.............................. ..`.rdata..............................@..@.data...p...........................@....tls................................@....gfids..@...........................@..@.rsrc...............................@..@.reloc...!......."..................@..B................................................................................................................................................................................................................

C:\Windows\SysWOW64\PocoNet.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	745472
Entropy (8bit):	6.543320477943913
Encrypted:	false
SSDEEP:	12288:R0Spsa6b8Z42X9sIriWvfEKZWJlsusW2PTb:R0Spsa6bi9HvfEKZWJ/R2PX
MD5:	34271180589EC380E0C973E1EE2B6C7F
SHA1:	3962D796B5F431D72B5AB8FE4F107CA6CCD8E43B
SHA-256:	DA4A1875A3F25E2E94FD50BAC9FDB8CF60261167EE0F10E019C7C8CEEEC0D004
SHA-512:	49AD69EB42005EA17F32F3DDED310595F4922CF138E0989764541A63925F764549A2292A4A0BED641D7154E61B4AC5F73252F59D03600E26C4D3AC509CB97C0B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................y.....................................U......................U......U.......P.......U.......Rich............PE..L...4.Z...........!....."...V......j........@............................................@.........................P.......TT.......0.......................@.............................\|....... ...@............@..D............................text....!.......".................. ..`.rdata...}...@...~...&..............@..@.data....H..........................@....gfids..8...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc......@......................@..B........................................................................................................................................................................................................................

C:\Windows\SysWOW64\PocoNetSSL.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	186368
Entropy (8bit):	6.373003244821189
Encrypted:	false
SSDEEP:	3072:7e9IlWW9P5jzQI+3O7WQAgaCjpAQT5uv:K+4UPVQI+3O7WQ3TT5uv
MD5:	41A34F51CAA20DCFDE91F433C12F5988
SHA1:	5403646C7FA87C0480FC81F8BF98444C2029DDFE
SHA-256:	FC9D294E070C50B3C2BD6BDE1A82E2A5DDF3F19B0374EFA29EEE2A4D6257D60A
SHA-512:	EEC4F96845E96BD9ED733C254862149706FEB37E5AD48439C50F78533512E410BA79DDCEDC925CADAC1D2E6B56BCDBEC531BDD23215610124D9CCC1E358D657F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R..<..<..<......<...?..<...8...<...=...<...9...<.d.=...<...=...<..=..<.d.9..<.d.<..<.a....<.d.>..<.Rich.<.................PE..L.....Z...........!.....P...........1.......`............................... ............@............................. ... T...................................".. }..............................@}..@............`.. ............................text...VN.......P.................. ..`.rdata..pE...`...F...T..............@..@.data...............................@....gfids..@...........................@..@.rsrc...............................@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\PocoUtil.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	315392
Entropy (8bit):	6.468108074574678
Encrypted:	false
SSDEEP:	6144:hZiWbcnCy+zEQP5OQiuvRBC1lkVCH7rRj2SJrCoF4tKhjDMiFrt:XjboMA3ACB7N14tKhjDMwx
MD5:	821B8944BE225058CFA47863949E8330
SHA1:	70A40DBD359567E5AE0E40E209F696DAAAF1A2C8
SHA-256:	6E220A50FF97264B9DE695859F1FF6F46CA32A0118353014FAFCCCAAD1C873BB
SHA-512:	F155121B8DC5C1BAF04714A9AC7E4C77827462B23100AA55DB963898289D3B374B26BC57F7FD41532A0C59606FC0844AC16AAC948C394384FD7757DAB3CC23BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i..]-es.-es.-es.$...%es..;p..es..;v.;es..;w.&es..;r.)es..;r.+es...r.(es.-er..ds..;v.3es..;s.,es..;..,es..;q.,es.Rich-es.........................PE..L...).Z...........!.........H......u`.......................................0............@..........................2...........................................4..........................<...........@............................................text.............................. ..`.rdata..J...........................@..@.data...("...........v..............@....gfids..@...........................@..@.tls................................@....rsrc...............................@..@.reloc...4.......6..................@..B........................................................................................................................................................................................................

C:\Windows\SysWOW64\PocoXML.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	466432
Entropy (8bit):	6.591031773652152
Encrypted:	false
SSDEEP:	6144:WA58L7DdM7EcKnm+LG0wXuRytGKfvylZSeFe9G/HQXXb1nOFWmlwOsIMBZqlXyUm:D8nD27Am+LGvtGKfk0HYLh9USOZ
MD5:	14A58A611F68D7C6C6A43E869F4A7CA0
SHA1:	8795B5843F449839AC2EB35F2FB9F0BC4200A5E9
SHA-256:	8377C7C9D73EA0C6187ED8AE0D6E016A13CA7B76AEE9212D95E2F72E0E2408A9
SHA-512:	783DEBCFF351171A76142CF2AA49E18F3F15DFF68609F8E2C47C1A8702AC778FC9FDE0B5005AB50AE499D0EA57A5E24C65016F54A4D9C3F1EB4BDB66BA24643A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t....G...G...G..G...G...F...G...F..G...F...G...F...Gk..F...G...F...G...Gv..Gk..F...Gk..F...Gk..F...Gn..G...Gk..F...GRich...G........................PE..L... .Z...........!.....T...................p...............................p............@.........................@!...................................... ..dH..@...............................`...@............p..4............................text....R.......T.................. ..`.rdata...i...p...j...X..............@..@.data...8...........................@....gfids..(...........................@..@.rsrc...............................@..@.reloc..dH... ...J..................@..B........................................................................................................................................................................................................................................

C:\Windows\SysWOW64\libcrypto.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2085888
Entropy (8bit):	6.275502958098816
Encrypted:	false
SSDEEP:	49152:nMIJjR0L3RYAzqxCQhScKFVvHeb0Q1CPwv3uQ2VXoyk:MIJyLySc0leV1CPwv3uQ2
MD5:	14F37CF1955FC31C6AB544B596CC07CA
SHA1:	EFA3B6A5C92CFCE32A1E4DBF2656F9BEBA4DD746
SHA-256:	82B38741E7F28D2C47D23B0D24BD414D58A488CACD50AD3C0F359E33FB4A369D
SHA-512:	F67833DFF8DC50D3959161259B1D0D96D9BD420EF9CBA37F50E1315E6A6E84D9BD2E0858ACDB1BE9C084B80E72FE694C6F164C173CF90A4C3EEB2874512DEC1B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.Z ..4s..4s..4s..s..4s,.5r..4s,.7r..4s,.1r..4s,.0r..4s5.5r..4s..5s..4s..4s..4s..0rY.4s..4r..4s...s..4s..6r..4sRich..4s................PE..L......Z...........!.....N...................`...............................P ...........@.........................`n...-...5..@....p..............................`U..8............................U..@............0...............................text....M.......N.................. ..`.rdata...;...`...<...R..............@..@.data............X..................@....idata.......0......................@..@.gfids..%....P......................@..@.00cfg.......`......................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................

C:\Windows\SysWOW64\libeay32.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1023488
Entropy (8bit):	6.829669925678923
Encrypted:	false
SSDEEP:	12288:kLOOiZOSffVbf1xO9QSq8dsTwd9xLAT6O6HBlp8oWt9V+NXaZpnNnU3dFXaizR9F:k+EZd9xLAVgBlCuzR9gopeKll0GV
MD5:	FD8BD6C382FF28D9E119BB0B16DEBF0E
SHA1:	C06DC43A50ED2101DFB18FC17DCEBE6F3122C6AB
SHA-256:	C09226191A49733293D12AF73300B3965438A15A5613E916A9138402812A76A7
SHA-512:	6BB444A5CA7D38F1209E1B51EAF1BBAF373FD840C962E31EB37AAB15DF3E2C0FAC20E0C46D205EE135FA03211B287BAEB85A25CA2A3F2DF7B200823D115257D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N......Z...Z...Z..YZ...Z..ZZ...Z..KZ...Z..\Z...Z...Z...Z..LZ...Z...Z...Z..]Z...Z..[Z...Z..^Z...ZRich...Z........PE..L...3k.T...........!......................... .......................................4...................................m...........0.......................@..........................................@............ ..x............................text............................... ..`.rdata....... ......................@..@.data...$...........................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\libssl.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	375296
Entropy (8bit):	5.695333832967505
Encrypted:	false
SSDEEP:	6144:4Po/RYitktWHoX7zUMnyPvKpZG4AFuvkzrzDNmGpamA8ND7P46yLqiDoVnjSOOvy:9RYwktWIX7zUMnyPSTG4AFuczrzDNmYD
MD5:	3860A72B4BFC4722CC3AB8C05F27FCCE
SHA1:	8A1B0A2E6072995F0CE9BD087AB6EA35B3D1B338
SHA-256:	D6CD873E147A3FE816AE10F5A7AFD6BD17539102DA6FCC768CE17D388453513F
SHA-512:	B80FF4B4151A3D5DD625630751D9ABE034709B312C41E8D6253A4DAA43DBA494B400B2DEC7EECDCB24E527FDD1001FB721821EE94A9BAA5B2ED4466DE288D5D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q1a.5P..5P..5P..<(..=P......7P...0..7P......6P......>P......>P......6P..5P...Q.......P......4P......4P......4P..Rich5P..........................PE..L......Z...........!.........................0............................................@.........................@...c=...y...................................&......8...............................@............p...............................text............................... ..`.rdata.......0......................@..@.data...\C... ...>..................@....idata...=...p...>...B..............@..@.gfids..%...........................@..@.00cfg..............................@..@.rsrc...............................@..@.reloc...,..........................@..B................................................................................................................................................................

C:\Windows\SysWOW64\msvcr110.dll

Download File

Process:	C:\Users\user\Desktop\5006_2.6.2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	875472
Entropy (8bit):	6.9224404430053434
Encrypted:	false
SSDEEP:	12288:TmCyHcMpK7QdgD+9Tr8r3FmJciMgLFWkA8qTWu+FVlofpJCjNdr12iqwZeq:TmCyHNIQdTryVmCipIkqTWu+Fr
MD5:	4BA25D2CBE1587A841DCFB8C8C4A6EA6
SHA1:	52693D4B5E0B55A929099B680348C3932F2C3C62
SHA-256:	B30160E759115E24425B9BCDF606EF6EBCE4657487525EDE7F1AC40B90FF7E49
SHA-512:	82E86EC67A5C6CDDF2230872F66560F4B0C3E4C1BB672507BBB8446A8D6F62512CBD0475FE23B619DB3A67BB870F4F742761CF1F87D50DB7F14076F54006F6C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x._'<.1t<.1t<.1t<.0t..1t...t?.1t.+.t..1t.+.t].1t.+.t..1t.+.t..1t.+.t=.1t.+.t=.1t.+.t=.1tRich<.1t................PE..L......P.........."!.....`..........<........@...............................`......l9....@.........................`...........(........................=.......S..0n..8...........................0...@............................................text....^.......`.................. ..`.data....\...p...N...d..............@....idata..............................@....rsrc...............................@..@.reloc...S.......T..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\pthreadVC.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	53299
Entropy (8bit):	3.9943496203596918
Encrypted:	false
SSDEEP:	384:hSvfC8Vv0Vy7ojuq7GQcdWTc4zU+GFronD/yD5rBEe0kiH32Jp9AhOW:wt+TGQcdWYdMG59EeJiH3YzW
MD5:	F04A90F917BA10AE2DCBE859870F4DEA
SHA1:	6668EBE373CE58C33017697C477557653427E626
SHA-256:	99C61ABF41C3AEC38CAB3ED6270ADBCA9A247BBF5F9AA9D29ECB0659A5527F48
SHA-512:	AEC29301B9CE311B27F1590B0E0C4121ACDC183A30B570E087D77B7035684F02A6DFBDEE950C37F3023B32E2EA5A075A5FBE6D18A2804DA9490D4959733BB516
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......EGi..&...&...&..c9...&...&..7&...9...&...9...&..Rich.&..........................PE..L.....g?...........!.....p...P.......d..............................................................................0...^.......P...............................T...................................................................................text...3f.......p.................. ..`.rdata........... ..................@..@.data...............................@....idata..4...........................@....reloc..J...........................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ssleay32.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217600
Entropy (8bit):	6.502467400971621
Encrypted:	false
SSDEEP:	6144:T+MCLaMRv89FpK5sZ7kwvrH/rhqlq0/HqfkT7UALGicQpgo9u9/JTibcnd//N:TfCrvSpK5sZ7kwvrH/1qlq0/HqfkTDLO
MD5:	85CEB6B1F6EA475E80A068AC1EB2E1D7
SHA1:	9C0FFED6929AC584C9B6CDCADA7BE4C74FAE05E3
SHA-256:	43A4930DC3ED17989AF435C55952D6FFD39035840BBAADEB802F2741EEA92CB1
SHA-512:	E3DAB7ED298C9785CE72941ED93B1D7F1B89D2189878A40839B7088AB267A84CBC31CCA7EAACACB3F9ADE0C59C2899BC0E30B8E37D094DB1FECC79546E30D86E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;K..hK..hK..hB.\|hO..hB.mhI..hB.zhL..hK..h...hB.jhp..hB.{hJ..hB.}hJ..hB.xhJ..hRichK..h........PE..L...@k.T...........!.....z...........................................................O..................................A.......P....P.......................`......................................8...@...............D............................text....x.......z.................. ..`.rdata..............~..............@..@.data....(... ...&..................@....rsrc........P.......*..............@..@.reloc.......`... ...2..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\wpcap.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	282360
Entropy (8bit):	6.604477037348888
Encrypted:	false
SSDEEP:	6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
MD5:	4633B298D57014627831CCAC89A2C50B
SHA1:	E5F449766722C5C25FA02B065D22A854B6A32A5B
SHA-256:	B967E4DCE952F9232592E4C1753516081438702A53424005642700522055DBC9
SHA-512:	29590FA5F72E6A36F2B72FC2A2CCA35EE41554E13C9995198E740608975621142395D4B2E057DB4314EDF95520FD32AAE8DB066444D8D8DB0FD06C391111C6D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%I+&a(Eua(Eua(Eu..;uc(EuF.8uv(EuF.+uC(EuF.(u.(EuF.>uc(Eua(Du.(Eu.'.ud(EuF.4ut(EuF.?u`(EuF.9u`(EuF.=u`(EuRicha(Eu........................PE..L.....0Q...........!................z...............................................8_.............................. ...........P....................0..........8&..p...................................@...............,............................text....z.......................... ..`.rdata..=7.......@..................@..@.data...!........ ..................@....rsrc...............................@..@.reloc..p........0..................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\System32\Packet.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107768
Entropy (8bit):	6.207807273671645
Encrypted:	false
SSDEEP:	3072:xpMSqNrAF/ln2800b4U7kByZo6Fsl1LOb:xpMSq0/AN0EG4yZ/
MD5:	899A5BF1669610CDB78D322AC8D9358B
SHA1:	80A2E420B99FFE294A523C6C6D87ED09DFC8D82B
SHA-256:	AB3CCE674F5216895FD26A073771F82B05D4C8B214A89F0F288A59774A06B14B
SHA-512:	41F2459793AC04E433D8471780E770417AFAC499DC3C5413877D4A4499656C9669C069D24E638D0AAF43AF178A763ACB656FFD34D710EB5E3C94682DB1559056
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................5.......5.......5.....n..............5.......5.......5.......5......Rich....................PE..d.....0Q.........." .........t...... l..............................................r................................................\.......P..x.......T.......\....................$............................................... ...............................text...>........................... ..`.rdata...@... ...B..................@..@.data...(7...p.......T..............@....pdata..\............j..............@..@.rsrc...T............\|..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Windows\System32\drivers\npf.sys

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36600
Entropy (8bit):	6.293365115285525
Encrypted:	false
SSDEEP:	768:VVRRdUlDRJuOfUhk8ZX2ZeRY4soGLeTZ8wwfKRw:VVRsZREOfUhNK96TZ8wwi6
MD5:	DE7FCC77F4A503AF4CA6A47D49B3713D
SHA1:	8206E2D8374F5E7BF626E47D56D2431EDC939652
SHA-256:	4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6
SHA-512:	FDACE7EE2593FFE5724DB32F4BE62BB13AA1EC89E1E01C713D8C1E9891A5A0975D127450024C3388A987A35E546568ECDBCC60C185DC8F8B08CCEF67A084B20D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}i.}i.}i.}h..}i...}i...}i...}i...}i...}i...}i.Rich.}i.................PE..d.....0Q.........."......V..........................................................9q......................................................d...P....................p...............a...............................................`...............................text....M.......N.................. ..h.rdata.......`.......R..............@..H.data...4....p.......X..............@....pdata...............^..............@..HINIT.................`.............. ....rsrc................h..............@..B.reloc..<............n..............@..B........................................................................................................................................................................................................................................

C:\Windows\System32\wpcap.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	370424
Entropy (8bit):	6.481542014421452
Encrypted:	false
SSDEEP:	6144:pH+VjFreKE0V/NGvaX86tWBXZkbTe/CtjgZBwIV8g/wNmJ4eXk:pH+VBeT0V/NBX8k2YTe/QIwIs8k
MD5:	A672F1CF00FA5AC3F4F59577F77D8C86
SHA1:	B68E64401D91C75CAFA810086A35CD0838C61A4B
SHA-256:	35AAB6CAAAF1720A4D888AE0DE9E2A8E19604F3EA0E4DD882C3EEAE4F39AF117
SHA-512:	A566E7571437BE765279C915DD6E13F72203EFF0DC3838A154FC137ED828E05644D650FD8432D1FB4C1E1D84EE00EF9BDE90225C68C3CA8A5DA349065E7EBFD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[...[...[.e.%...[...&...[...5...[...6..[... ...[...Z.d.[.U ...[...*...[...!...[...'...[...#...[.Rich..[.........................PE..d.....0Q.........." ................p........................................P......................................................P4.......'..P....0...........'...........@..X.......................................................X............................text............................... ..`.rdata..mm.......n..................@..@.data........@...&...,..............@....pdata...'.......(...R..............@..@.rsrc........0.......z..............@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.997137455203288
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5006_2.6.2.exe
File size:	17'131'434 bytes
MD5:	8541da559ecb090cd768bc6f3173ffc4
SHA1:	35c33bb61dcc017903a07ba70d69885c67fee39a
SHA256:	fbe8bba07f8b3c2307339d5aff885e46f8a14a251af04fc0455943c72b8c3ef6
SHA512:	4c189317d209082138b83b7e24d33ddaeae4625e9f28e323e8ea42ea680b15e42dd1bb51703be43c9d7a613a9163b717575cf4e4c96259daee7f6fbcc984b32c
SSDEEP:	393216:C9C85yn4CoUE4Px5h2SUzyIZzZahMbhE+0O1X0iCB5:pSc9xEw29+IZ4MbhP4h
TLSH:	D407339EFA45F83AD85175F42029B91D30626C8C79BC571AA13834277A3EB43DE2F25C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.w.F......F...v...F...@...F.Rich..F.........PE..L......].................d...\|......k2............@

File Icon


Icon Hash:	0f33797d6d793307

Static PE Info

General

Entrypoint:	0x40326b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DF6D4F0 [Mon Dec 16 00:50:56 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e9c0657252137ac61c1eeeba4c021000

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 0040A198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004080A0h]
call dword ptr [0040809Ch]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042F40Ch], eax
je 00007F85A8B04A83h
push ebx
call 00007F85A8B07B6Bh
cmp eax, ebx
je 00007F85A8B04A79h
push 00000C00h
call eax
mov esi, 00408298h
push esi
call 00007F85A8B07AE7h
push esi
call dword ptr [00408098h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F85A8B04A5Dh
push 0000000Ah
call 00007F85A8B07B3Fh
push 00000008h
call 00007F85A8B07B38h
push 00000006h
mov dword ptr [0042F404h], eax
call 00007F85A8B07B2Ch
cmp eax, ebx
je 00007F85A8B04A81h
push 0000001Eh
call eax
test eax, eax
je 00007F85A8B04A79h
or byte ptr [0042F40Fh], 00000040h
push ebp
call dword ptr [00408040h]
push ebx
call dword ptr [00408284h]
mov dword ptr [0042F4D8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 00429830h
call dword ptr [00408178h]
push 0040A188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x853c	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3e000	0x19520	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x62ff	0x6400	c3db412a38f3960c44c292549b21be26	False	0.672421875	data	6.457821426487787	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x134a	0x1400	ff2238780ac4c7099d13c72f0663eda0	False	0.459765625	data	5.238921057104071	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x25518	0x600	40b80ca9c843c54385c408bd5f31c6f1	False	0.4557291666666667	data	4.049203760121162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x30000	0xe000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3e000	0x19520	0x19600	f0768d095d4f458d3e47709ec6528e7c	False	0.3665236299261084	data	5.943400539589614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3e2e0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.3400567845735242
RT_ICON	0x4eb08	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.43351440717997164
RT_ICON	0x52d30	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.475207468879668
RT_ICON	0x552d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.551594746716698
RT_ICON	0x56380	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6932624113475178
RT_ICON	0x567e8	0x2e8	data	English	United States	0.020161290322580645
RT_ICON	0x56ad0	0x128	data	English	United States	0.04391891891891892
RT_DIALOG	0x56bf8	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x56e00	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x56ef8	0xa0	data	English	United States	0.60625
RT_DIALOG	0x56f98	0xee	data	English	United States	0.6260504201680672
RT_GROUP_ICON	0x57088	0x68	data	English	United States	0.5961538461538461
RT_MANIFEST	0x570f0	0x42e	XML 1.0 document, ASCII text, with very long lines (1070), with no line terminators	English	United States	0.5130841121495328

Imports

DLL	Import
KERNEL32.dll	GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetFileAttributesA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileTime, GetFileAttributesA, SetCurrentDirectoryA, MoveFileA, GetFullPathNameA, GetShortPathNameA, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, DeleteFileA, FindFirstFileA, FindNextFileA, FindClose, SetFilePointer, GetPrivateProfileStringA, WritePrivateProfileStringA, MulDiv, MultiByteToWideChar, FreeLibrary, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
USER32.dll	GetSystemMenu, SetClassLongA, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, LoadImageA, CreateDialogParamA, SetTimer, SetWindowTextA, SetForegroundWindow, ShowWindow, SetWindowLongA, SendMessageTimeoutA, FindWindowExA, IsWindow, AppendMenuA, TrackPopupMenu, CreatePopupMenu, DrawTextA, EndPaint, DestroyWindow, wsprintfA, PostQuitMessage
GDI32.dll	SelectObject, SetTextColor, SetBkMode, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, GetDeviceCaps, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2024 11:50:19.385669947 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:19.385720968 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:19.385802984 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:19.386604071 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:19.386616945 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.310662985 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.310750008 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:20.312697887 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:20.312707901 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.312954903 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.313304901 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:20.360233068 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.579301119 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:20.579344988 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.580020905 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:20.580317020 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:20.580327988 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.632229090 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.632255077 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.632313013 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:20.632337093 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:20.632411957 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:21.190452099 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:21.190596104 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:21.191611052 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:21.191618919 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:21.191858053 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:21.192524910 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:21.236238956 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:21.839823961 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:21.839852095 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:21.839912891 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:21.839946985 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:21.839993954 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:30.647998095 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:30.648035049 CET	443	49712	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:30.648051023 CET	49712	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:30.648994923 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:30.649074078 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:30.649171114 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:30.649955988 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:30.649983883 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.260037899 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.260154963 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:31.261125088 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:31.261157990 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.261471033 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.261694908 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:31.304255962 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.850991011 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:31.851030111 CET	443	49713	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.851044893 CET	49713	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:31.852396965 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:31.852440119 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.852516890 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:31.852818966 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:31.852838039 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.906388044 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.906413078 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.906466007 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:31.906487942 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:31.906516075 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:32.464788914 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:32.464899063 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:32.465809107 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:32.465816975 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:32.466155052 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:32.466418982 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:32.508239031 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:33.109750986 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:33.109786987 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:33.109864950 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:33.109935999 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:33.109992981 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:41.897989035 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:41.897989988 CET	49714	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:41.898046970 CET	443	49714	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:41.899281025 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:41.899303913 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:41.899414062 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:41.913599968 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:41.913614988 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:42.520705938 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:42.520953894 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:42.521822929 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:42.521830082 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:42.522059917 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:42.522521973 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:42.564238071 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.101064920 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.101064920 CET	49715	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.101097107 CET	443	49715	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.102267027 CET	49717	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.102293015 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.102387905 CET	49717	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.102533102 CET	49717	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.102549076 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.167388916 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.167421103 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.167495012 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.167634964 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.167634964 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.710072041 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.710267067 CET	49717	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.711172104 CET	49717	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.711178064 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.711400986 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:43.711767912 CET	49717	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:43.756246090 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:44.354978085 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:44.355015039 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:44.355079889 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:44.355221033 CET	49717	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:53.179461002 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:53.179482937 CET	443	49716	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:53.179491043 CET	49716	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:53.180936098 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:53.180975914 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:53.181070089 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:53.181235075 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:53.181251049 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:53.789472103 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:53.789546967 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:53.790797949 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:53.790807962 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:53.791035891 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:53.791430950 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:53.836250067 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.366533995 CET	49717	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:54.366558075 CET	443	49717	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.366571903 CET	49717	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:54.367803097 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:54.367837906 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.367913961 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:54.382184982 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:54.382200956 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.433679104 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.433697939 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.433759928 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.433815002 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:54.433867931 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:54.990598917 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.990695000 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:54.991600037 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:54.991611004 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.991842985 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:54.992242098 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:55.040235996 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:55.637170076 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:55.637202978 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:55.637278080 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:50:55.637340069 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:50:55.637412071 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:04.460452080 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:04.460452080 CET	49719	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:04.460475922 CET	443	49719	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:04.462748051 CET	49721	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:04.462796926 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:04.462884903 CET	49721	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:04.475931883 CET	49721	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:04.475950003 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.083621025 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.083802938 CET	49721	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:05.084804058 CET	49721	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:05.084814072 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.085041046 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.085649014 CET	49721	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:05.132260084 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.647793055 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:05.647836924 CET	443	49720	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.647852898 CET	49720	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:05.648958921 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:05.648988008 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.649096012 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:05.663423061 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:05.663436890 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.728966951 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.728990078 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.729051113 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:05.729217052 CET	49721	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:06.274643898 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:06.274926901 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:06.276065111 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:06.276072979 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:06.276319027 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:06.276546001 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:06.324238062 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:06.918884039 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:06.918952942 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:06.919022083 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:06.919048071 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:06.919091940 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:06.919097900 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:06.919151068 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:15.726035118 CET	49721	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:15.726083994 CET	443	49721	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:15.726165056 CET	49721	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:15.727447987 CET	49723	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:15.727494955 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:15.727591038 CET	49723	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:15.741544008 CET	49723	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:15.741561890 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.350111008 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.350327969 CET	49723	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:16.351367950 CET	49723	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:16.351385117 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.351618052 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.351881981 CET	49723	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:16.392251015 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.913639069 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:16.913677931 CET	443	49722	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.913696051 CET	49722	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:16.915707111 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:16.915738106 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.915808916 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:16.916109085 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:16.916120052 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.996542931 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.996573925 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.996644020 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:16.996680975 CET	49723	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:16.996721029 CET	49723	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:17.530915976 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:17.531136990 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:17.532052040 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:17.532059908 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:17.532849073 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:17.533072948 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:17.580255032 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:18.172177076 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:18.172262907 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:18.172429085 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:18.172496080 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:18.172523975 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:27.007282972 CET	49723	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:27.007311106 CET	443	49723	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:27.008923054 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:27.008956909 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:27.009020090 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:27.009182930 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:27.009197950 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:27.616730928 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:27.616811037 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:27.618357897 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:27.618367910 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:27.618624926 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:27.618866920 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:27.664239883 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.179049015 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.179090023 CET	443	49725	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.179110050 CET	49725	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.180336952 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.180367947 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.182182074 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.194696903 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.194713116 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.260389090 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.260416985 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.260485888 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.260493040 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.260531902 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.809556007 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.809719086 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.810621977 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.810630083 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.811395884 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:28.811788082 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:28.856235027 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:29.452537060 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:29.452598095 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:29.452667952 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:29.452693939 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:29.452739000 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:29.452748060 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:29.452797890 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:38.272799015 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:38.272823095 CET	443	49726	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:38.272840977 CET	49726	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:38.274187088 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:38.274230957 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:38.274312019 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:38.288342953 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:38.288360119 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:38.896816015 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:38.897007942 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:38.897905111 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:38.897919893 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:38.898149967 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:38.898392916 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:38.944236994 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:39.444782019 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:39.444807053 CET	443	49727	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:39.444866896 CET	49727	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:39.446794033 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:39.446832895 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:39.446898937 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:39.447077036 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:39.447084904 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:39.541471004 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:39.541498899 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:39.541574955 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:39.541624069 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:39.541714907 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:40.060910940 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:40.061032057 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:40.062011003 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:40.062020063 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:40.062889099 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:40.063114882 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:40.108225107 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:40.701478958 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:40.701554060 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:40.701630116 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:40.701654911 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:40.701694012 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:40.701715946 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:40.701759100 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:49.538384914 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:49.538464069 CET	443	49728	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:49.538506031 CET	49728	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:49.539741039 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:49.539849043 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:49.539969921 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:49.540115118 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:49.540139914 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.150010109 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.150162935 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:50.151084900 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:50.151101112 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.151463032 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.151684999 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:50.192253113 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.710243940 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:50.710285902 CET	443	49729	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.710300922 CET	49729	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:50.723283052 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:50.723342896 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.723422050 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:50.723608017 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:50.723623037 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.795722961 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.795756102 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.795814991 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:50.795825958 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:50.795869112 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:51.334142923 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:51.334271908 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:51.548336983 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:51.548382998 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:51.548747063 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:51.550304890 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:51.592277050 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:51.978844881 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:51.978912115 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:51.979027033 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:51:51.979051113 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:51.979069948 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:51:51.979137897 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:00.788587093 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:00.788619041 CET	443	49730	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:00.788631916 CET	49730	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:00.789629936 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:00.789668083 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:00.791383028 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:00.804152966 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:00.804168940 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:01.411232948 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:01.411403894 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:01.412463903 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:01.412471056 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:01.412889004 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:01.413398027 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:01.460242033 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:01.991503000 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:01.991530895 CET	443	49731	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:01.991563082 CET	49731	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:01.992835045 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:01.992871046 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:01.992944956 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:02.007071018 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:02.007087946 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:02.055027008 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:02.055051088 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:02.055125952 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:02.055131912 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:02.055175066 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:02.624116898 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:02.624203920 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:02.625041008 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:02.625049114 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:02.625807047 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:02.626024961 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:02.672224998 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:03.264828920 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:03.264950991 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:03.265028000 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:03.265049934 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:03.265119076 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:03.265171051 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:12.069554090 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:12.069578886 CET	443	49732	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:12.069593906 CET	49732	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:12.070939064 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:12.070972919 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:12.071052074 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:12.085323095 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:12.085340023 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:12.694996119 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:12.695081949 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:12.695941925 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:12.695951939 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:12.696202993 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:12.696415901 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:12.744246960 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.272687912 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.272717953 CET	443	49733	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.272731066 CET	49733	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.273947001 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.273984909 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.274076939 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.274266958 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.274282932 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.341487885 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.341515064 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.341592073 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.341609001 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.341641903 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.890491009 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.890624046 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.891484976 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.891494989 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.892471075 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:13.896416903 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:13.944236040 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:14.530359030 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:14.530385017 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:14.530469894 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:14.530476093 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:14.530524969 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:23.350847960 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:23.350882053 CET	443	49734	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:23.350898027 CET	49734	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:23.352191925 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:23.352236986 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:23.352318048 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:23.352597952 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:23.352611065 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:23.964847088 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:23.964927912 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:23.965702057 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:23.965713024 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:23.965940952 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:23.966150999 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:24.012233019 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:24.526434898 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:24.526460886 CET	443	49735	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:24.526488066 CET	49735	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:24.527576923 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:24.527667999 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:24.527765036 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:24.527899027 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:24.527936935 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:24.610532045 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:24.610559940 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:24.610676050 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:24.610686064 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:24.610735893 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:25.136414051 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:25.136490107 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:25.137648106 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:25.137655020 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:25.137897015 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:25.138154984 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:25.184228897 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:25.782047033 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:25.782128096 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:25.782207966 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:25.782226086 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:25.782269001 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:25.782291889 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:25.782335997 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:34.600903034 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:34.600903034 CET	49736	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:34.600931883 CET	443	49736	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:34.602149963 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:34.602205992 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:34.602288961 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:34.616425037 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:34.616439104 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.227178097 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.227271080 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:35.228137970 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:35.228147984 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.228389025 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.228598118 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:35.276228905 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.788490057 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:35.788491011 CET	49737	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:35.788531065 CET	443	49737	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.799665928 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:35.799726009 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.799801111 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:35.804030895 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:35.804055929 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.874821901 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.874850988 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.874916077 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:35.874970913 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:35.874998093 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:36.422199965 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:36.422440052 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:36.423607111 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:36.423618078 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:36.423939943 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:36.424237013 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:36.468281031 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:37.064333916 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:37.064395905 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:37.064536095 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:37.064584017 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:37.065399885 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:45.911480904 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:45.911523104 CET	443	49738	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:45.911539078 CET	49738	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:45.923197985 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:45.923235893 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:45.923327923 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:45.923584938 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:45.923609018 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:46.534364939 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:46.534609079 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:46.535451889 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:46.535464048 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:46.535768032 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:46.535995960 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:46.580231905 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.069597006 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.069639921 CET	443	49739	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.069658041 CET	49739	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.071233034 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.071260929 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.071348906 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.085475922 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.085498095 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.181560993 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.181588888 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.181673050 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.181720972 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.181888103 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.707799911 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.707971096 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.708839893 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.708861113 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.709774017 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:47.710011959 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:47.756247044 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:48.353750944 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:48.353831053 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:48.353905916 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:48.353936911 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:48.353975058 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:48.353981972 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:48.354033947 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:57.194613934 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:57.194644928 CET	443	49740	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:57.194659948 CET	49740	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:57.196212053 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:57.196254015 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:57.196337938 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:57.210187912 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:57.210205078 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:57.823124886 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:57.823239088 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:57.824079037 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:57.824089050 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:57.824343920 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:57.824701071 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:57.868247986 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:58.366451979 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:58.366478920 CET	443	49741	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:58.366499901 CET	49741	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:58.367995977 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:58.368031979 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:58.368119955 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:58.382077932 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:58.382093906 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:58.481936932 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:58.481961012 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:58.482019901 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:58.482045889 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:58.482084036 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:58.999452114 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:58.999649048 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:59.000499964 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:59.000509024 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:59.001327038 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:59.001571894 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:59.044240952 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:59.642159939 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:59.642183065 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:59.642252922 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:52:59.642400980 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:52:59.642400980 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:08.491394997 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:08.491415977 CET	443	49742	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:08.491430044 CET	49742	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:08.492786884 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:08.492815971 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:08.492883921 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:08.507091045 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:08.507102966 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.120800018 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.120879889 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.122006893 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.122015953 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.122214079 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.122425079 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.164254904 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.647711039 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.647736073 CET	443	49743	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.647770882 CET	49743	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.649060011 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.649142027 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.649239063 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.663254023 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.663306952 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.767899036 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.767920017 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.767975092 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.767986059 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.767997026 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:09.768027067 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:09.768052101 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:10.280472994 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:10.280625105 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:10.281745911 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:10.281760931 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:10.282527924 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:10.282788992 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:10.328259945 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:10.922415972 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:10.922475100 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:10.922545910 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:10.922570944 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:10.922605991 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:10.922616959 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:10.922657013 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:19.772664070 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:19.772687912 CET	443	49744	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:19.772708893 CET	49744	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:19.774255037 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:19.774290085 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:19.774378061 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:19.788253069 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:19.788266897 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:20.397686005 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:20.397816896 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:20.399204016 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:20.399211884 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:20.399528027 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:20.399800062 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:20.440243959 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:20.928945065 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:20.929038048 CET	443	49745	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:20.929081917 CET	49745	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:20.930342913 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:20.930383921 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:20.930474997 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:20.944622040 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:20.944641113 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:21.043958902 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:21.043982029 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:21.044054031 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:21.044111013 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:21.044152975 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:21.563307047 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:21.563412905 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:21.564292908 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:21.564301014 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:21.564547062 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:21.564771891 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:21.608238935 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:22.204651117 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:22.204711914 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:22.204777956 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:22.204798937 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:22.204848051 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:22.204849005 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:22.204899073 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:31.038256884 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:31.038296938 CET	443	49746	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:31.038316011 CET	49746	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:31.039602995 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:31.039627075 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:31.039700985 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:31.053868055 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:31.053884983 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:31.660942078 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:31.661025047 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:31.661994934 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:31.662003040 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:31.662216902 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:31.662437916 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:31.704236984 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.210160971 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.210191965 CET	443	49747	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.210206985 CET	49747	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.211589098 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.211622000 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.211721897 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.211920977 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.211935043 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.305608034 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.305629969 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.305682898 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.305702925 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.305748940 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.829664946 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.829862118 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.830626011 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.830635071 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.831407070 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:32.831619978 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:32.872237921 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:33.474406004 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:33.474461079 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:33.474598885 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:33.474620104 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:33.474698067 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:42.303874969 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:42.303901911 CET	443	49748	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:42.303915024 CET	49748	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:42.310139894 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:42.310197115 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:42.310286999 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:42.310415030 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:42.310431004 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:42.922291994 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:42.922359943 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:42.923229933 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:42.923238993 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:42.923484087 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:42.923887014 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:42.968240023 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:43.491626978 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:43.491653919 CET	443	49749	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:43.491728067 CET	49749	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:43.493046999 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:43.493077993 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:43.493158102 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:43.493288040 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:43.493299961 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:43.567599058 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:43.567656040 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:43.567728996 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:43.567753077 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:43.567797899 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:44.110270977 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:44.112317085 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:44.113198996 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:44.113209009 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:44.113535881 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:44.113790989 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:44.156244040 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:44.751249075 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:44.751328945 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:44.751465082 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:44.751467943 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:44.751524925 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:53.772613049 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:53.772644997 CET	443	49750	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:53.772658110 CET	49750	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:53.773767948 CET	49752	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:53.773803949 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:53.773931980 CET	49752	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:53.774014950 CET	49752	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:53.774023056 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:54.386786938 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:54.386895895 CET	49752	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:54.387964010 CET	49752	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:54.387979984 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:54.388806105 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:54.390136003 CET	49752	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:54.432240963 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:54.757128000 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:54.757128000 CET	49751	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:54.757153988 CET	443	49751	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:54.758286953 CET	49753	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:54.758378029 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:54.758466005 CET	49753	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:54.772773027 CET	49753	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:54.772809029 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:55.033648968 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:55.033715963 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:55.033787966 CET	49752	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:55.033799887 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:55.033889055 CET	443	49752	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:55.033914089 CET	49752	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:55.033961058 CET	49752	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:55.389764071 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:55.389976978 CET	49753	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:55.390716076 CET	49753	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:55.390738010 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:55.391530991 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:55.391773939 CET	49753	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:55.436228037 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:56.031580925 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:56.031646013 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:56.031728029 CET	49753	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:56.031760931 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:56.031821012 CET	49753	443	192.168.2.5	119.8.47.97
Mar 20, 2024 11:53:56.031836033 CET	443	49753	119.8.47.97	192.168.2.5
Mar 20, 2024 11:53:56.031893015 CET	49753	443	192.168.2.5	119.8.47.97

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2024 11:50:19.213615894 CET	63883	53	192.168.2.5	1.1.1.1
Mar 20, 2024 11:50:19.380253077 CET	53	63883	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2024 11:50:19.213615894 CET	192.168.2.5	1.1.1.1	0xbb92	Standard query (0)	push.mobilefonex.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2024 11:50:19.380253077 CET	1.1.1.1	192.168.2.5	0xbb92	No error (0)	push.mobilefonex.com		119.8.47.97	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

push.mobilefonex.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:50:20 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: nBGeczvijzupKaYAUSH4RA==
2024-03-20 10:50:20 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=Awh69j0a0gWyINdFbR_6G--MonHLqfp5K-pzQ0eo.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:50:20 GMT
2024-03-20 10:50:20 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:50:21 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: VZePNLUYezwqL5AtQJhrXg==
2024-03-20 10:50:21 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=r7T_4gFDHPjltgWJbAV7Jlmt2z61OhM559usnbP9.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:50:21 GMT
2024-03-20 10:50:21 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:50:31 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: K06wdEYcvgB+fcNv0a6mOQ==
2024-03-20 10:50:31 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=eHBT9srfdQyc9Pm9M858rJ8lxMXNVx7_oO4ix-j9.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:50:31 GMT
2024-03-20 10:50:31 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:50:32 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: d3uAPPyZNgZMaYsxjzOdHQ==
2024-03-20 10:50:33 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=He5Q0uAvteK_7G7xdmenvqyvoEo44QnhaBoZfysW.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:50:32 GMT
2024-03-20 10:50:33 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:50:42 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: 46xSSJDLTXcqnjdLJO/7FQ==
2024-03-20 10:50:43 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=2XFKzB69b_CZuEb-NX9CPnQDIr5r66koTemeSTql.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:50:43 GMT
2024-03-20 10:50:43 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:50:43 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: RVKJB9qTozfjyIZpU2jteA==
2024-03-20 10:50:44 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=XlNvWntUi-dUZqBUP06lNdFsNelAxGscP2FTn3wm.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:50:44 GMT
2024-03-20 10:50:44 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49719	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:50:53 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: gU9dZVRrU0S384gBzBZzJQ==
2024-03-20 10:50:54 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=zTPBzC_8fukEGMHGCj42ECkiINzw349LEkTM0hSj.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:50:54 GMT
2024-03-20 10:50:54 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49720	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:50:54 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: D7WQUDGO1FMmNFlXiHEsfw==
2024-03-20 10:50:55 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=LgwN2Je50ur2nXBVgAXpGFWRSx2cZRuqtdkx5LrU.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:50:55 GMT
2024-03-20 10:50:55 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:05 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: EGL7SsaWqH3VO95A5yYQDw==
2024-03-20 10:51:05 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=1O60i0BwDR2Zhflyi9c9-JKOpKiKTk_920U0DiO_.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:05 GMT
2024-03-20 10:51:05 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:06 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: oY4aLcRoOTHFmKQvdTb6Ew==
2024-03-20 10:51:06 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=4TDJmb7K-S7jcpkGnQfWiGDYza9p0iU28RxQHMXX.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:06 GMT
2024-03-20 10:51:06 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:16 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: axusKlgQIQCd1L1tHavMSg==
2024-03-20 10:51:16 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=_d9S70Zm3r9LykEMK50vu6oA6qUqNAA6nihQ36VY.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:16 GMT
2024-03-20 10:51:16 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49725	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:17 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: zRffd4tou1bFsuBcvjgGSg==
2024-03-20 10:51:18 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=h2kNAnReZCnOsr2OCn9uAeJCXPyKFbW5RvrOmFIU.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:18 GMT
2024-03-20 10:51:18 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49726	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:27 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: GpQWHSA2bQg5Tth8GFqfeA==
2024-03-20 10:51:28 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=ZJ7wmrHrHmgpFu9BLDoAaswsaGeDtLSI8IRqXIdT.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:28 GMT
2024-03-20 10:51:28 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49727	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:28 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: KviYWWfoRxp63PoxyhdeWg==
2024-03-20 10:51:29 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=-hAyR51dFOm8W7ls703FnutR4diflR77qIo6Xz5_.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:29 GMT
2024-03-20 10:51:29 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49728	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:38 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: tQ9ERyidHSiMxwJwv5aubA==
2024-03-20 10:51:39 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=R-ztyXvyEJt2VX5MXX1gmFbAhaLwZfr3kTenrg9x.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:39 GMT
2024-03-20 10:51:39 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49729	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:40 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: xDA8Tf3dtThMnYE/Wy9yRg==
2024-03-20 10:51:40 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=DMDGbXYyLc3WTA13OqzAImRU2xUh99mPEARjksxa.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:40 GMT
2024-03-20 10:51:40 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49730	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:50 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: +nx2ZhhyzmmBVlYjWtO3Dg==
2024-03-20 10:51:50 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=GqeCqmqhnC5zQ13zhDos4TP1Xw-ZtpxgMY5QVnJK.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:50 GMT
2024-03-20 10:51:50 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49731	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:51:51 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: 2VQ5IS4IEXxEq1ILCPHLdA==
2024-03-20 10:51:51 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=VkIbzNp351gR5Op1rvPdjD-kU7TEfhK7Jze0fgYx.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:51:51 GMT
2024-03-20 10:51:51 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49732	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:01 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: AKX0GlLjTUnejKRQwtQCPw==
2024-03-20 10:52:02 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=EbNdTx8fE11zKRLVGpI8reIfgGT-WNUTa8EiR7ME.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:01 GMT
2024-03-20 10:52:02 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49733	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:02 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: FW8RC3SavSmzTKt7Ct3dJA==
2024-03-20 10:52:03 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=X0K_TaIBNwk1wOweSUMtlLEETBvDyvoApQMiA30e.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:03 GMT
2024-03-20 10:52:03 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49734	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:12 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: bA8rED+SgjX6Uolww2uuDQ==
2024-03-20 10:52:13 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=-CfOgxqJbXPRJdcoIRTSAnuqWV5_Fykzy-ucvWn8.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:13 GMT
2024-03-20 10:52:13 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49735	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:13 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: M/0dZgAmK2bbc4EhfjMHEA==
2024-03-20 10:52:14 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=mHQaA8kPwDU2m5gdlGv0wcT-tXfqaeQfKLNO3xhi.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:14 GMT
2024-03-20 10:52:14 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49736	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:23 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: qzPdUq9BpTNFaSdmFqlGJA==
2024-03-20 10:52:24 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=uslfB3AMYNANth7bdOTJCjvpTc8mlaxAHEQUjvsP.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:24 GMT
2024-03-20 10:52:24 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49737	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:25 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: 45j3WK3v00YIQtxIR4wVAQ==
2024-03-20 10:52:25 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=NFGIcelJxMld96LkFfEn_hBPUsI-Z_JNSd9lPns-.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:25 GMT
2024-03-20 10:52:25 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49738	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:35 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: 3N+OWOC7QVBYyZxJTa95dg==
2024-03-20 10:52:35 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=vI1TsHbFrw9jDdtM70SSg3-aJ74rQetwlcARk0mG.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:35 GMT
2024-03-20 10:52:35 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49739	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:36 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: w+coMVxmqTHBeYxLkCWxaA==
2024-03-20 10:52:37 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=rgjM4y0tsc1r08ifeeeKLNhmeaQ0C_09FbmX-TFc.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:36 GMT
2024-03-20 10:52:37 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49740	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:46 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: uG8rQ8WHDRKy1uJwIegFIg==
2024-03-20 10:52:47 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=wyZTtJSwTq2pnNJf6vsOIkozPfrrUQ_dGdMntpXA.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:47 GMT
2024-03-20 10:52:47 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49741	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:47 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: YClmIY75KzN1bTQcf+bcJg==
2024-03-20 10:52:48 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=SN4ZEggZepK7VhYj_Spt2m1PtO7TQfArYhiBc763.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:48 GMT
2024-03-20 10:52:48 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49742	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:57 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: +yf5IUkAU3MZ9EhxqRkdSQ==
2024-03-20 10:52:58 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=cNwsTfiZF5lYIeXepVlr-GJ1hBPCNVQszNZAKLIp.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:58 GMT
2024-03-20 10:52:58 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49743	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:52:58 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: mkyZFH/MkXu0wmR8kAh4EA==
2024-03-20 10:52:59 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=4PAld4L4XxCKQoUdpPDDkh70ni_bFkfXownmgZB9.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:52:59 GMT
2024-03-20 10:52:59 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49744	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:09 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: SSvbBKsfTCgKzR0PoKC+NQ==
2024-03-20 10:53:09 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=3HvG1oUhMPsXDZcw21J9lQ0uhtFbjIelskIwGSxI.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:09 GMT
2024-03-20 10:53:09 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49745	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:10 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: m01UNCzrLHDF9bAo7l38Kw==
2024-03-20 10:53:10 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=Agup0NCuUeWnKPZ-cQMRvceaCujS7_vgorVsPgTZ.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:10 GMT
2024-03-20 10:53:10 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49746	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:20 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: beJlBoaEBnWpfthTDuBmNw==
2024-03-20 10:53:21 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=tdVl9F94J5_czulh3f1qdnE_X1Z283bwkW4krHWj.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:20 GMT
2024-03-20 10:53:21 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49747	119.8.47.97	443

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:21 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: DZcBL4vzvTm+DZE9+xTdTQ==
2024-03-20 10:53:22 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=t9253wntXF067KFu2K9-i_Ex5I1rvfv9gzaAy7Rf.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:22 GMT
2024-03-20 10:53:22 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49748	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:31 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: x7G4OczQ+yNPPNYJ6kOCXA==
2024-03-20 10:53:32 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=fcWG80gknShLoFGouVKzZojNkdvDh6ANBZJ08Wz5.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:32 GMT
2024-03-20 10:53:32 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49749	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:32 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: 9IS/FLMNKB63WpA5rAhtNw==
2024-03-20 10:53:33 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=oims2NL9Z-C0MgBdQUI_Y9WUude0mKA2glANgdNy.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:33 GMT
2024-03-20 10:53:33 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49750	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:42 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: dKkrZez1mjrnXJluXooFCA==
2024-03-20 10:53:43 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=WqB2j8mvbo9F6xl6N3uQJhPA0NxC6YcWT-AaMnu8.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:43 GMT
2024-03-20 10:53:43 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49751	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:44 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: EVQFTYM/XUMj8y127qJCRw==
2024-03-20 10:53:44 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=RzXbIqszSA-rA-yFM-K4R0Rp7XcOTsAsF1LDQz6m.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:44 GMT
2024-03-20 10:53:44 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49752	119.8.47.97	443	6056	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:54 UTC	255	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: BYg5cUonXixA8AxSrtjCJQ==
2024-03-20 10:53:55 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=NANqImkKImWA67QUdt4MOcvbadoQq4IPGaJOUpJu.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:54 GMT
2024-03-20 10:53:55 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49753	119.8.47.97	443	2924	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-20 10:53:55 UTC	264	OUT	GET /?encoding=utf8 HTTP/1.1 Host: push.mobilefonex.com Origin: https://push.mobilefonex.com deviceId: 4953fa9c79e97e8601886c5ba93b6ec1_watchdog Connection: Upgrade Upgrade: websocket Sec-WebSocket-Version: 13 Sec-WebSocket-Key: WHSlChQsUEDWLbIK9lZ6cA==
2024-03-20 10:53:56 UTC	245	IN	HTTP/1.1 200 OK Connection: close X-Powered-By: JSP/2.3 Set-Cookie: JSESSIONID=QnMV0lpmukVu0Pu1jXJzbHuWDQFnK0bFY2nt43vX.push; path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Wed, 20 Mar 2024 10:53:55 GMT
2024-03-20 10:53:56 UTC	6953	IN	Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 69 74 6c 65 3e 57 65 6c 63 6f 6d 65 20 74 6f 20 50 75 73 68 20 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 0a 0a 0a 0a 3c 21 44 4f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Welcome to Push Server</title></head><body><!DO

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
NtOpenFile	INLINE	explorer.exe
NtQuerySystemInformation	INLINE	explorer.exe
ZwQuerySystemInformation	INLINE	explorer.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe
ZwOpenFile	INLINE	explorer.exe
Process32FirstW	INLINE	explorer.exe
Process32Next	INLINE	explorer.exe
Process32NextW	INLINE	explorer.exe
Process32First	INLINE	explorer.exe
connect	INLINE	explorer.exe
sendto	INLINE	explorer.exe
WSAConnect	INLINE	explorer.exe
closesocket	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
NtOpenFile	INLINE	0xE9 0x98 0x8B 0xB4 0x43 0x39
NtQuerySystemInformation	INLINE	0xE9 0x9A 0xAB 0xB2 0x21 0x19
ZwQuerySystemInformation	INLINE	0xE9 0x9A 0xAB 0xB2 0x21 0x19
RtlGetNativeSystemInformation	INLINE	0xE9 0x9A 0xAB 0xB2 0x21 0x19
ZwOpenFile	INLINE	0xE9 0x98 0x8B 0xB4 0x43 0x39

Process: explorer.exe, Module: KERNEL32.DLL

Function Name	Hook Type	New Data
Process32FirstW	INLINE	0xE9 0x94 0x4B 0xBD 0xD4 0x43
Process32Next	INLINE	0xE9 0x98 0x8B 0xBB 0xBD 0xD3
Process32NextW	INLINE	0xE9 0x96 0x6B 0xBD 0xD7 0x73
Process32First	INLINE	0xE9 0x9C 0xCB 0xBB 0xBD 0xD3

Process: explorer.exe, Module: WS2_32.dll

Function Name	Hook Type	New Data
connect	INLINE	0xE9 0x9B 0xBB 0xBC 0xCD 0xD6
sendto	INLINE	0xE9 0x96 0x6B 0xBD 0xD2 0x26
WSAConnect	INLINE	0xE9 0x91 0x1B 0xBE 0xE6 0x66
closesocket	INLINE	0xE9 0x92 0x2B 0xB9 0x9A 0xA6

Target ID:	0
Start time:	11:49:56
Start date:	20/03/2024
Path:	C:\Users\user\Desktop\5006_2.6.2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5006_2.6.2.exe"
Imagebase:	0x400000
File size:	17'131'434 bytes
MD5 hash:	8541DA559ECB090CD768BC6F3173FFC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:49:56
Start date:	20/03/2024
Path:	C:\Users\user\AppData\Roaming\Windows Provisioning\antivirus_detector.exe
Wow64 process (32bit):	true
Commandline:	"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe\|C:\Users\user\AppData\Roaming\Windows Provisioning\|\|
Imagebase:	0x9f0000
File size:	2'827'776 bytes
MD5 hash:	7BCC1F1DEB45BF58C7C559DFE3240E08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:50:06
Start date:	20/03/2024
Path:	C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1
Imagebase:	0x400000
File size:	16'131'606 bytes
MD5 hash:	2F61BD2AC7DC2252AD5743093CEB09DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:50:09
Start date:	20/03/2024
Path:	C:\Program Files (x86)\Windows Provisioning\post_install.exe
Wow64 process (32bit):	true
Commandline:	"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe\|inst=C:\Program Files (x86)\Windows Provisioning\|s=1\|k=\|p=\|r=0
Imagebase:	0x5b0000
File size:	204'800 bytes
MD5 hash:	52A76696B447635922D8EC87D0DA7FEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:50:12
Start date:	20/03/2024
Path:	C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Provisioning\svcAppUpdate.exe"
Imagebase:	0x6a0000
File size:	84'992 bytes
MD5 hash:	E53E0020D7FE34B1E8F75AF444E64C72
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:50:16
Start date:	20/03/2024
Path:	C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Provisioning\svcAppInit.exe"
Imagebase:	0x800000
File size:	137'216 bytes
MD5 hash:	3135A7FEE1AD484104A1309104312D9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:50:16
Start date:	20/03/2024
Path:	C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Provisioning\svcAppLookup.exe"
Imagebase:	0x680000
File size:	610'816 bytes
MD5 hash:	794122A33A390FF07CA891B568110D10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:50:16
Start date:	20/03/2024
Path:	C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Windows Provisioning\nt_system_service.exe"
Imagebase:	0x870000
File size:	1'601'024 bytes
MD5 hash:	64F8F960D535AA6200E620C1DEF292FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:50:17
Start date:	20/03/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Program Files (x86)\Windows Provisioning\svcAppInit.dll",ProcessDll s=hidedialog
Imagebase:	0xed0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Ransomware_Hellokitty_d9391a1a, Description: unknown, Source: 0000000A.00000002.4464326614.000000006AAB1000.00000020.00000001.01000000.0000001B.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:50:17
Start date:	20/03/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\sysnative\rundll32.exe "C:\Program Files (x86)\Windows Provisioning\windows_hook_64.dll",ProcessDllStub
Imagebase:	0x7ff693c40000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:50:17
Start date:	20/03/2024
Path:	C:\Program Files (x86)\Windows Provisioning\nss\certutil.exe
Wow64 process (32bit):	true
Commandline:	nss\certutil -A -t "TCu" -i "C:\PROGRA~2\WIE901~1\app_data\DE_NET~1/SSL/DIGICE~1.CER" -n "de_netfilter/SSL/DigiCert SHA2 Extended Validation Server CA 3" -d sql:"C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\V6ZCHH~1.DEF" -f pwfile
Imagebase:	0x980000
File size:	190'464 bytes
MD5 hash:	3337B8D5AAB06D9072E3D4A72E0F9D26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.2%
Total number of Nodes:	1273
Total number of Limit Nodes:	20

Executed Functions

Function 0040326B Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403290
GetVersion.KERNEL32 ref: 00403296
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004032C9
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403305
OleInitialize.OLE32(00000000), ref: 0040330C
SHGetFileInfoA.SHELL32(00429830,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 00403328
GetCommandLineA.KERNEL32(Windows Provisioning 2.6.2 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 0040333D
CharNextA.USER32(00000000,"C:\Users\user\Desktop\5006_2.6.2.exe",00000020,"C:\Users\user\Desktop\5006_2.6.2.exe",00000000,?,00000006,00000008,0000000A), ref: 00403379
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 00403476
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 00403487
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403493
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004034A7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004034AF
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004034C0
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004034C8
DeleteFileA.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 004034DC

Part of subcall function 004063A8: GetModuleHandleA.KERNEL32(?,?,?,004032DE,0000000A), ref: 004063BA
Part of subcall function 004063A8: GetProcAddress.KERNEL32(00000000,?), ref: 004063D5

Part of subcall function 0040382D: lstrlenA.KERNEL32("antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,?,?,?,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,00000000,C:\Users\user\AppData\Roaming\Windows Provisioning,1033,0042A870,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A870,00000000,00000002,75923410), ref: 0040391D
Part of subcall function 0040382D: lstrcmpiA.KERNEL32(?,.exe), ref: 00403930
Part of subcall function 0040382D: GetFileAttributesA.KERNEL32("antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||), ref: 0040393B
Part of subcall function 0040382D: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Windows Provisioning), ref: 00403984
Part of subcall function 0040382D: RegisterClassA.USER32(0042EBA0), ref: 004039C1

ExitProcess.KERNEL32(?,?,00000006,00000008,0000000A), ref: 00403585

Part of subcall function 00403753: CloseHandle.KERNEL32(FFFFFFFF,0040358A,?,?,00000006,00000008,0000000A), ref: 0040375E

OleUninitialize.OLE32(?,?,00000006,00000008,0000000A), ref: 0040358A
ExitProcess.KERNEL32 ref: 004035AB
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 004036C8
OpenProcessToken.ADVAPI32(00000000), ref: 004036CF
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004036E7
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403706
ExitWindowsEx.USER32(00000002,80040002), ref: 0040372A
ExitProcess.KERNEL32 ref: 0040374D

Part of subcall function 0040572C: MessageBoxIndirectA.USER32(0040A218), ref: 00405787

Strings

.tmp, xrefs: 004035D2
TMP, xrefs: 004034C3
Low, xrefs: 004034A9
~nsu, xrefs: 004035B6
"C:\Users\user\Desktop\5006_2.6.2.exe", xrefs: 00403343, 00403349, 00403500
SeShutdownPrivilege, xrefs: 004036E1
C:\Users\user\AppData\Local\Temp\, xrefs: 0040346B, 00403470, 00403486, 00403492, 004034A1, 004034AE, 004034BA, 004034C2, 004035BB, 004035CC, 004035D7, 004035E3, 004035F0, 004035FF, 004036AE
Windows Provisioning 2.6.2 Setup, xrefs: 00403333
C:\Users\user\Desktop\5006_2.6.2.exe, xrefs: 00403668
C:\Users\user\Desktop, xrefs: 004035DD, 004035E2, 0040360E
\Temp, xrefs: 0040348D
NSIS Error, xrefs: 0040332E
UXTHEME, xrefs: 004032BD, 004032C2, 004032C8
1033, xrefs: 004034D7
C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 00403567
", xrefs: 0040339E
C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 0040345B, 0040355C, 00403606, 0040360F
TEMP, xrefs: 004034BB
Error launching installer, xrefs: 00403542

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Process$Exit$File$EnvironmentHandlePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
String ID: "$"C:\Users\user\Desktop\5006_2.6.2.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Windows Provisioning$C:\Users\user\AppData\Roaming\Windows Provisioning$C:\Users\user\Desktop$C:\Users\user\Desktop\5006_2.6.2.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$Windows Provisioning 2.6.2 Setup$\Temp$~nsu
API String ID: 562314493-3042610276
Opcode ID: 05a91e025c9aea1742115f42aadd9019c56ba4b480ae67e611fec9d80049b737
Instruction ID: c488d4947f624a60ea111d8e8e2b3f6be1d3d76fce8bfd42f4ae142e8cae794f
Opcode Fuzzy Hash: 05a91e025c9aea1742115f42aadd9019c56ba4b480ae67e611fec9d80049b737
Instruction Fuzzy Hash: 9EC10570104741AAD7216F759D49B2F3EA8AF4570AF44443FF582B61E2CB7C8A198B2F

Uniqueness

Uniqueness Score: -1.00%

Function 00406313 Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(75923410,0042C0C0,0042BC78,00405AD9,0042BC78,0042BC78,00000000,0042BC78,0042BC78,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 0040631E
FindClose.KERNEL32(00000000), ref: 0040632A

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1839775ab65f4c7429e333cf5f3a5f1104f42c23ffe018d7624b5080913ebc3e
Instruction ID: f1da5dbc8fb4190b670de1866088b9aea297c62f24eccc1d76d376cb4bf46ee5
Opcode Fuzzy Hash: 1839775ab65f4c7429e333cf5f3a5f1104f42c23ffe018d7624b5080913ebc3e
Instruction Fuzzy Hash: A8D0123250A030ABC350177C7E0C88F7A989F163347218A36F4A6F21E0C7348C2286DC

Uniqueness

Uniqueness Score: -1.00%

Function 0040382D Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004063A8: GetModuleHandleA.KERNEL32(?,?,?,004032DE,0000000A), ref: 004063BA
Part of subcall function 004063A8: GetProcAddress.KERNEL32(00000000,?), ref: 004063D5

lstrcatA.KERNEL32(1033,0042A870,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A870,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\5006_2.6.2.exe",00000000), ref: 004038A8
lstrlenA.KERNEL32("antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,?,?,?,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,00000000,C:\Users\user\AppData\Roaming\Windows Provisioning,1033,0042A870,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A870,00000000,00000002,75923410), ref: 0040391D
lstrcmpiA.KERNEL32(?,.exe), ref: 00403930
GetFileAttributesA.KERNEL32("antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||), ref: 0040393B
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Windows Provisioning), ref: 00403984

Part of subcall function 00405F6E: wsprintfA.USER32 ref: 00405F7B

RegisterClassA.USER32(0042EBA0), ref: 004039C1
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004039D9
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A0E
ShowWindow.USER32(00000005,00000000), ref: 00403A44
GetClassInfoA.USER32(00000000,RichEdit20A,0042EBA0), ref: 00403A70
GetClassInfoA.USER32(00000000,RichEdit,0042EBA0), ref: 00403A7D
RegisterClassA.USER32(0042EBA0), ref: 00403A86
DialogBoxParamA.USER32(?,00000000,00403BCA,00000000), ref: 00403AA5

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00403861
RichEd20, xrefs: 00403A4A
"C:\Users\user\Desktop\5006_2.6.2.exe", xrefs: 00403831
RichEdit, xrefs: 00403A77
RichEd32, xrefs: 00403A58
C:\Users\user\AppData\Local\Temp\, xrefs: 00403832
"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||, xrefs: 004038EB, 004038F3, 00403900, 0040394A, 00403950
_Nb, xrefs: 004039A0, 00403A08
.exe, xrefs: 0040392A
.DEFAULT\Control Panel\International, xrefs: 00403893
1033, xrefs: 0040384D, 004038A3
RichEdit20A, xrefs: 00403A68, 00403A6E
C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 004038B7, 004038BF, 00403957, 0040395D, 0040396D

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\5006_2.6.2.exe"$"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Windows Provisioning$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-4269149020
Opcode ID: 15822f17e376e41266fbf8a251ac5c412d7bb8a3b85e81a9d7c16052a8cecaf4
Instruction ID: 5bdd09b32da2b5bd11ad56600dd1adb443959310d265eb20ccced3f07ac4f103
Opcode Fuzzy Hash: 15822f17e376e41266fbf8a251ac5c412d7bb8a3b85e81a9d7c16052a8cecaf4
Instruction Fuzzy Hash: B461C770340201AED620BB669D45F2B3E6CEB54749F80447FF981B22E2CB7D9D469B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402DC4 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DD5
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\5006_2.6.2.exe,00000400), ref: 00402DF1

Part of subcall function 00405BA9: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\5006_2.6.2.exe,80000000,00000003), ref: 00405BAD
Part of subcall function 00405BA9: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BCF

GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\5006_2.6.2.exe,C:\Users\user\Desktop\5006_2.6.2.exe,80000000,00000003), ref: 00402E3D
GlobalAlloc.KERNELBASE(00000040,00000020), ref: 00402F73

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F9A
C:\Users\user\Desktop, xrefs: 00402E1F, 00402E24, 00402E2A
soft, xrefs: 00402EB2
"C:\Users\user\Desktop\5006_2.6.2.exe", xrefs: 00402DC4
Null, xrefs: 00402EBB
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DCB
TA, xrefs: 00402E52
C:\Users\user\Desktop\5006_2.6.2.exe, xrefs: 00402DDB, 00402DEA, 00402DFE, 00402E1E
Inst, xrefs: 00402EA9
Error launching installer, xrefs: 00402E14

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: TA$"C:\Users\user\Desktop\5006_2.6.2.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\5006_2.6.2.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2480270032
Opcode ID: a6173edc5218a8736919d7ec244e80ad4ff8d0a671bf7eda1f584d4bdf14a1ba
Instruction ID: 027006cf2d98db9fa9c400e5027e86f3261d974ae097fd254c994c4dc937b6e6
Opcode Fuzzy Hash: a6173edc5218a8736919d7ec244e80ad4ff8d0a671bf7eda1f584d4bdf14a1ba
Instruction Fuzzy Hash: FF51E471900215ABCB20AF64DE89B9F7BB8EB14359F50403BF500B32D1C6BC9E459AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00406032 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32("antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,00000400), ref: 0040615D
GetWindowsDirectoryA.KERNEL32("antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,00000400,?,0042A050,00000000,0040516F,0042A050,00000000), ref: 00406170
SHGetSpecialFolderLocation.SHELL32(0040516F,759223A0,?,0042A050,00000000,0040516F,0042A050,00000000), ref: 004061AC
SHGetPathFromIDListA.SHELL32(759223A0,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||), ref: 004061BA
CoTaskMemFree.OLE32(759223A0), ref: 004061C6
lstrcatA.KERNEL32("antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,\Microsoft\Internet Explorer\Quick Launch), ref: 004061EA
lstrlenA.KERNEL32("antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,?,0042A050,00000000,0040516F,0042A050,00000000,00000000,00427388,759223A0), ref: 0040623C

Strings

"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||, xrefs: 0040605C, 00406129, 0040612A, 0040612B, 00406147, 0040615C, 0040616F, 0040618B, 004061B6, 004061E9, 004061EF, 00406207, 0040621A, 00406235, 0040623B, 00406243, 0040626D
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004061E4
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040612C

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: "antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1349478114
Opcode ID: b5f21783dff86301b55f28ea11f9c7815398c55a2ca1ca21ed943f87329636d9
Instruction ID: 0eb145c1bee873094c14c85ea59bbbcbcc52f889deb60e0de917f7e6e63be494
Opcode Fuzzy Hash: b5f21783dff86301b55f28ea11f9c7815398c55a2ca1ca21ed943f87329636d9
Instruction Fuzzy Hash: F1610171900114AEDF24AF64CC84BBE3BA5AB15314F52417FE913BA2D2C77C49A2CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,C:\Users\user\AppData\Roaming\Windows Provisioning,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,00000000,00000000,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,C:\Users\user\AppData\Roaming\Windows Provisioning,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406010: lstrcpynA.KERNEL32(?,?,00000400,0040333D,Windows Provisioning 2.6.2 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 0040601D

Part of subcall function 00405137: lstrlenA.KERNEL32(0042A050,00000000,00427388,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000,?), ref: 00405170
Part of subcall function 00405137: lstrlenA.KERNEL32(00403156,0042A050,00000000,00427388,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000), ref: 00405180
Part of subcall function 00405137: lstrcatA.KERNEL32(0042A050,00403156,00403156,0042A050,00000000,00427388,759223A0), ref: 00405193
Part of subcall function 00405137: SetWindowTextA.USER32(0042A050,0042A050), ref: 004051A5
Part of subcall function 00405137: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051CB
Part of subcall function 00405137: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051E5
Part of subcall function 00405137: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051F3

Strings

C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 00401826, 00401842
"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 00401786

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||$C:\Users\user\AppData\Roaming\Windows Provisioning$C:\Users\user\AppData\Roaming\Windows Provisioning
API String ID: 1941528284-521884884
Opcode ID: d2d4c9be4c77887772f7a063183bc6da9d3610935c72e1bf3270bbb4a4cc9717
Instruction ID: fcac4804817dd72ce497849c2c59a0292666c96c0e268c836f952ab8254f0f2b
Opcode Fuzzy Hash: d2d4c9be4c77887772f7a063183bc6da9d3610935c72e1bf3270bbb4a4cc9717
Instruction Fuzzy Hash: 5941E571900114BACF10BBB5CD45E9F3A79EF45369F20823BF412F20E2DA7C8A519A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040633A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406351
wsprintfA.USER32 ref: 0040638A
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040639E

Strings

%s%s.dll, xrefs: 00406384
\, xrefs: 00406362
UXTHEME, xrefs: 00406343

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 99878a05f639d6717cee7e73d8174e66263622090e4b33b6bcde024c159c7dc8
Instruction ID: 4d0fdf3fe302aa3e605d302367287b0bc06203fc89102858e08200231af957cf
Opcode Fuzzy Hash: 99878a05f639d6717cee7e73d8174e66263622090e4b33b6bcde024c159c7dc8
Instruction Fuzzy Hash: 9EF0F670510609ABEB24AB74DD0DFEB366CAB08305F14057AAA86E11D1EA78D9358BDC

Uniqueness

Uniqueness Score: -1.00%

Function 00402FFB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403062
GetTickCount.KERNEL32 ref: 00403109
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00403132
wsprintfA.USER32 ref: 00403142

Strings

... %d%%, xrefs: 0040313C

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: fadbfff98126c3f33fc218ff52c7570f2bc54738a50a490896210387b9f65f46
Instruction ID: 2f86f0e091d903dd4c8dc1f0d7d1d97a23866136c8ad304ef4da6da149bc5d25
Opcode Fuzzy Hash: fadbfff98126c3f33fc218ff52c7570f2bc54738a50a490896210387b9f65f46
Instruction Fuzzy Hash: D2518D71801219EBDB10DF65DA44A9E7FB8EF08316F10817BE810B72E1C7789B44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405BD8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BEC
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405C06

Strings

"C:\Users\user\Desktop\5006_2.6.2.exe", xrefs: 00405BD8
C:\Users\user\AppData\Local\Temp\, xrefs: 00405BDB
nsa, xrefs: 00405BE3

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\5006_2.6.2.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-574165253
Opcode ID: 81a8a72dc23b4af90602e2553ee1124644ae594fa0167b908fb3a738e8e2aa10
Instruction ID: 7981c9ddf24778652055132877b92488972f9a5eb9cf132aa873dca7e4a118a1
Opcode Fuzzy Hash: 81a8a72dc23b4af90602e2553ee1124644ae594fa0167b908fb3a738e8e2aa10
Instruction Fuzzy Hash: 0FF082363183046BEB109F56DD04B9B7BA9DFD2750F14803BFA489B290D6B4A9548B58

Uniqueness

Uniqueness Score: -1.00%

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405A41: CharNextA.USER32(?,?,0042BC78,?,00405AAD,0042BC78,0042BC78,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A4F
Part of subcall function 00405A41: CharNextA.USER32(00000000), ref: 00405A54
Part of subcall function 00405A41: CharNextA.USER32(00000000), ref: 00405A68

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004055FD: CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405640

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\Windows Provisioning,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\Windows Provisioning
API String ID: 1892508949-2535408887
Opcode ID: a516b4748d05a08e440426ddae0d387c05c7f5690fa4427b99a5bf14fe3e0d49
Instruction ID: 1afb8a6b6fc663fc0b529d5452f3d1f5a7876e1f873962654dbae4e79628cbca
Opcode Fuzzy Hash: a516b4748d05a08e440426ddae0d387c05c7f5690fa4427b99a5bf14fe3e0d49
Instruction Fuzzy Hash: 08112731508141EBCB217FB54D41A7F36B4AE96324F68093FE4D1B22E2D63D4842AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 004056AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042C078,Error launching installer), ref: 004056D8
CloseHandle.KERNEL32(?), ref: 004056E5

Strings

Error launching installer, xrefs: 004056C2

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: a2b9ecb8406674d5a7d1aded78611502900df459338db245270d40db8d5eaf79
Instruction ID: d682804100e664e073205113f6b11307167482a28e2818ee20dd6d85df95f7a7
Opcode Fuzzy Hash: a2b9ecb8406674d5a7d1aded78611502900df459338db245270d40db8d5eaf79
Instruction Fuzzy Hash: CFE046F0640209BFEB109FA0EE49F7F7AADEB00704F404521BD00F2190EA7498088A7C

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ffebd5fca59fb87aab51f7597ede924ce92eaed1a0ec0a619fe9c5b1ad01a7d
Instruction ID: 5ed4d9c38c73c282456bb639181f16eab54b9a7fb1a82fe129ff52a3f74c88ba
Opcode Fuzzy Hash: 3ffebd5fca59fb87aab51f7597ede924ce92eaed1a0ec0a619fe9c5b1ad01a7d
Instruction Fuzzy Hash: B101F4317242109BE7199B399D04B6A3698E710719F54823FF852F61F1D678EC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 004063A8 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?,004032DE,0000000A), ref: 004063BA
GetProcAddress.KERNEL32(00000000,?), ref: 004063D5

Part of subcall function 0040633A: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406351
Part of subcall function 0040633A: wsprintfA.USER32 ref: 0040638A
Part of subcall function 0040633A: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: dd9300423111a071ed2c714751f7876f95e5d132df45129638b184150075da19
Instruction ID: 650a49b09a3c495eabc0f371936d9c907298e200c4f2363c251d84495e191d7a
Opcode Fuzzy Hash: dd9300423111a071ed2c714751f7876f95e5d132df45129638b184150075da19
Instruction Fuzzy Hash: B4E08C32604220ABD2106A74AE0493B72A89E94710302083EF947F2240DB389C3697AD

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA9 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\5006_2.6.2.exe,80000000,00000003), ref: 00405BAD
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BCF

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 80243517f436f95d2d00e5b5224d95f101b34955670c918b0becce4e09b30ec3
Instruction ID: 6905ba7dec075751c4c8bdaf1e97cd52a4ed4154a0977e2bcfee25d1bc4df630
Opcode Fuzzy Hash: 80243517f436f95d2d00e5b5224d95f101b34955670c918b0becce4e09b30ec3
Instruction Fuzzy Hash: F5D09E31254201EFEF098F20DE16F2EBBA2EB94B00F11952CB682944E1DA715819AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00405B84 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,?,0040579C,?,?,00000000,0040597F,?,?,?,?), ref: 00405B89
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B9D

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a53a5738952024e77fe51bdf82e6835a24f68a8863f167a8e3b3ad13dd9f075c
Instruction ID: 89bb1c08115ccb47c9876ad1094a3663263f91dea81084495bed50ebcc9a35d2
Opcode Fuzzy Hash: a53a5738952024e77fe51bdf82e6835a24f68a8863f167a8e3b3ad13dd9f075c
Instruction Fuzzy Hash: B7D0C972504421ABD2102728AE0889BBBA5DB542717028A36F9A5A22B1DB304C569A99

Uniqueness

Uniqueness Score: -1.00%

Function 0040567A Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,0040325E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 00405680
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 0040568E

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: f012ed4f2e447eb03a7c1a9074efbf4aa4d4dcf66ab1e3e2b7403bfb804529af
Instruction ID: cb450b3a329ff4c2b820c3640ee2c86a22e1ba63869c3c930ac7c2b00640337e
Opcode Fuzzy Hash: f012ed4f2e447eb03a7c1a9074efbf4aa4d4dcf66ab1e3e2b7403bfb804529af
Instruction Fuzzy Hash: B3C04C302145029EDA515B319E08B1B7A59AB90781F528839654AE81B0DE768455DD2E

Uniqueness

Uniqueness Score: -1.00%

Function 00405C50 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031D6,00000000,0041D428,000000FF,0041D428,000000FF,000000FF,00000004,00000000), ref: 00405C64

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d47d29d2c4ad98e9097244963089aa7711ad8f9da7a01510603535aa68a2578c
Instruction ID: df976955bb7b77361248817f919be03bb6bd2f6f3b4dc1c0c3d16748aaf5f5c5
Opcode Fuzzy Hash: d47d29d2c4ad98e9097244963089aa7711ad8f9da7a01510603535aa68a2578c
Instruction Fuzzy Hash: 65E0EC3221476EABEF509F559D04EEB7B6CEB06360F004436FE25E2550D631E9219BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405C21 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403220,00000000,00000000,0040304A,000000FF,00000004,00000000,00000000,00000000), ref: 00405C35

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c828ac78080eafadef002e80ceae40fa9d69551b6ff84e56452d6cc727993955
Instruction ID: 6d14d449f293f6f00ca5a49b865ea561f53b7d8d8b79739f6419f9b8fb6d3ad5
Opcode Fuzzy Hash: c828ac78080eafadef002e80ceae40fa9d69551b6ff84e56452d6cc727993955
Instruction Fuzzy Hash: 9EE0EC3221476AABEF109E559C00EEB7B6CEB05361F008836F915E3150D631E8219FA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7c7e4bdf60eaee922853463450b3a098a6950b3c426d1b45f9d85291b8358fec
Instruction ID: 4f8ec7b4fa93eeb61d23c1d92a418e90caec6e25b57ca3d9eeae261b5adaa5a1
Opcode Fuzzy Hash: 7c7e4bdf60eaee922853463450b3a098a6950b3c426d1b45f9d85291b8358fec
Instruction Fuzzy Hash: 0FD012727042009BCB11EFA8AB08A5E7775EB54324F600537D101F21D1D2B885459759

Uniqueness

Uniqueness Score: -1.00%

Function 00403223 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F89,?), ref: 00403231

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: af556f1437a27586b8d302be8c6d190c2fb2fb51029204f11d8d070fc2108142
Instruction ID: 81fdcbbc46e9ac73494c3809a02cbb86869920566b24394b282a4516d046c7b0
Opcode Fuzzy Hash: af556f1437a27586b8d302be8c6d190c2fb2fb51029204f11d8d070fc2108142
Instruction Fuzzy Hash: 32B01231140300BFDA214F00DF09F057B21AB90700F10C034B384780F086711075EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00403753 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,0040358A,?,?,00000006,00000008,0000000A), ref: 0040375E

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4bfc4a86c4512e3107b8fb86be471d5238cf24995b86bfa467bc0e008276a2a3
Instruction ID: fc3c4bd29221364ca44687d693abbcbbd121fb750d4ff3e3919dc32638d5829b
Opcode Fuzzy Hash: 4bfc4a86c4512e3107b8fb86be471d5238cf24995b86bfa467bc0e008276a2a3
Instruction Fuzzy Hash: F6C012B0540700B6C5647F799E8F9053A545B41736F608726B0B8F20F1C73C4659556F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00405275 Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004052D4
GetDlgItem.USER32(?,000003EE), ref: 004052E3
GetClientRect.USER32(?,?), ref: 00405320
GetSystemMetrics.USER32(00000002), ref: 00405327
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405348
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405359
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040536C
SendMessageA.USER32(?,00001026,00000000,?), ref: 0040537A
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040538D
ShowWindow.USER32(00000000,?,0000001B,?), ref: 004053AF
ShowWindow.USER32(?,00000008), ref: 004053C3
GetDlgItem.USER32(?,000003EC), ref: 004053E4
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053F4
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040540D
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405419
GetDlgItem.USER32(?,000003F8), ref: 004052F2

Part of subcall function 004040D3: SendMessageA.USER32(00000028,?,00000001,00403F03), ref: 004040E1

GetDlgItem.USER32(?,000003EC), ref: 00405435
CreateThread.KERNEL32(00000000,00000000,Function_00005209,00000000), ref: 00405443
CloseHandle.KERNEL32(00000000), ref: 0040544A
ShowWindow.USER32(00000000), ref: 0040546D
ShowWindow.USER32(?,00000008), ref: 00405474
ShowWindow.USER32(00000008), ref: 004054BA
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054EE
CreatePopupMenu.USER32 ref: 004054FF
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405514
GetWindowRect.USER32(?,000000FF), ref: 00405534
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040554D
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405589
OpenClipboard.USER32(00000000), ref: 00405599
EmptyClipboard.USER32 ref: 0040559F
GlobalAlloc.KERNEL32(00000042,?), ref: 004055A8
GlobalLock.KERNEL32(00000000), ref: 004055B2
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004055C6
GlobalUnlock.KERNEL32(00000000), ref: 004055DF
SetClipboardData.USER32(00000001,00000000), ref: 004055EA
CloseClipboard.USER32 ref: 004055F0

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 850865324eda7255bc617561a744910c99d6829a0b955d2a94bbb97841d7110d
Instruction ID: 66d789517199d7de7cfadb6731c275bc9a2b232ae8febcf914e4846c803f5e83
Opcode Fuzzy Hash: 850865324eda7255bc617561a744910c99d6829a0b955d2a94bbb97841d7110d
Instruction Fuzzy Hash: A3A147B0900608BFDB119F61DE89AAF7F79FB08354F40403AFA41BA1A0C7755E519F68

Uniqueness

Uniqueness Score: -1.00%

Function 00404530 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040457F
SetWindowTextA.USER32(00000000,?), ref: 004045A9
SHBrowseForFolderA.SHELL32(?,00429C48,?), ref: 0040465A
CoTaskMemFree.OLE32(00000000), ref: 00404665
lstrcmpiA.KERNEL32("antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,0042A870), ref: 00404697
lstrcatA.KERNEL32(?,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||), ref: 004046A3
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004046B5

Part of subcall function 00405710: GetDlgItemTextA.USER32(?,?,00000400,004046EC), ref: 00405723

Part of subcall function 0040627A: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\5006_2.6.2.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062D2
Part of subcall function 0040627A: CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062DF
Part of subcall function 0040627A: CharNextA.USER32(?,"C:\Users\user\Desktop\5006_2.6.2.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062E4
Part of subcall function 0040627A: CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062F4

GetDiskFreeSpaceA.KERNEL32(00429840,?,?,0000040F,?,00429840,00429840,?,00000001,00429840,?,?,000003FB,?), ref: 00404773
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040478E

Part of subcall function 004048E7: lstrlenA.KERNEL32(0042A870,0042A870,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404802,000000DF,00000000,00000400,?), ref: 00404985
Part of subcall function 004048E7: wsprintfA.USER32 ref: 0040498D
Part of subcall function 004048E7: SetDlgItemTextA.USER32(?,0042A870), ref: 004049A0

Strings

"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||, xrefs: 00404691, 00404696, 004046A1
C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 00404680
A, xrefs: 00404653

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||$A$C:\Users\user\AppData\Roaming\Windows Provisioning
API String ID: 2624150263-350062850
Opcode ID: f8c5b323b79a30612e5f20638997160abd30a80c2805ffb51c5d0b55a3138d2a
Instruction ID: 05eea3de79cf24fe9bb33e9012793c4f482d3b98f46f23a5f19240ee3c7d349e
Opcode Fuzzy Hash: f8c5b323b79a30612e5f20638997160abd30a80c2805ffb51c5d0b55a3138d2a
Instruction Fuzzy Hash: 78A160B1900218ABDB11AFA6CD45AAF77B8AF85314F14843BF601B62D1D77C8A418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004057D8 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405801
lstrcatA.KERNEL32(0042B878,\*.*,0042B878,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405849
lstrcatA.KERNEL32(?,0040A014,?,0042B878,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040586A
lstrlenA.KERNEL32(?,?,0040A014,?,0042B878,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405870
FindFirstFileA.KERNEL32(0042B878,?,?,?,0040A014,?,0042B878,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405881
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 0040592E
FindClose.KERNEL32(00000000), ref: 0040593F

Strings

\*.*, xrefs: 00405843
"C:\Users\user\Desktop\5006_2.6.2.exe", xrefs: 004057D8
C:\Users\user\AppData\Local\Temp\, xrefs: 004057E5

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\5006_2.6.2.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-929013018
Opcode ID: 1028c0a1378fe67f5cfd0213f93084011618ac7fb180f8f6d485c044da562b3f
Instruction ID: b1b2ef924c21ee39ce724be99c412cdb4e11523259fae964be374fa5306f8f12
Opcode Fuzzy Hash: 1028c0a1378fe67f5cfd0213f93084011618ac7fb180f8f6d485c044da562b3f
Instruction Fuzzy Hash: 9A51A171800A04EADB216B618C45BBF7AB8DF42728F14807BF845B51D1C73C4982DE6A

Uniqueness

Uniqueness Score: -1.00%

Function 00402138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040851C,?,00000001,0040850C,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021BA
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,0040850C,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402269

Strings

C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 004021FA

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\Windows Provisioning
API String ID: 123533781-2535408887
Opcode ID: 60642f32df86b4976e115d0feba91d7607e51b39a6776a6b0e1cbc617f6027f1
Instruction ID: 754b6e0833e3014b2c682637ef6945f2e05814b0a8fe180c789646af90cdafbf
Opcode Fuzzy Hash: 60642f32df86b4976e115d0feba91d7607e51b39a6776a6b0e1cbc617f6027f1
Instruction Fuzzy Hash: DD510771A00209AFCB04DFE4C988A9D7BB5EF48314F2045BAF515EB2D1DB799941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00402765 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402774

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2e6c685056bc8af82a5edd524c4e61cab1dcb69a9ac82fb004b4bd38b3b6fa23
Instruction ID: 5c82bf4159fd1739121f93a17669663fbe331ae18c29918af2b78fc5806f8225
Opcode Fuzzy Hash: 2e6c685056bc8af82a5edd524c4e61cab1dcb69a9ac82fb004b4bd38b3b6fa23
Instruction Fuzzy Hash: 39F0EC725441009BD301EB749A49AFEB77CEF15324F60017BE141F21C1D6F84945D77A

Uniqueness

Uniqueness Score: -1.00%

Function 004067ED Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a44bc8fd526afdff965e1cd5e7f2d0a246497ca5c27b0c944ad4ba04d420dd
Instruction ID: dc39b55080118b2a9f2c57fc2b953182458e36931565741e2945480d6a34e330
Opcode Fuzzy Hash: 82a44bc8fd526afdff965e1cd5e7f2d0a246497ca5c27b0c944ad4ba04d420dd
Instruction Fuzzy Hash: D2E19A7190070ADFDB24CF58D890BAAB7F1EB44305F15842EE897A76C1D738AA95CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406FC4 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca4b55698b2abcc8e5cbf272b741b12ffb4e3b740e9774b5bdfc5da95159218
Instruction ID: 2f0950e66cb79552dca6b2fc49cb98149526550dbc918883d7c1b9af38c738a1
Opcode Fuzzy Hash: fca4b55698b2abcc8e5cbf272b741b12ffb4e3b740e9774b5bdfc5da95159218
Instruction Fuzzy Hash: 42C13831E042598BCF18CF68D4905EEB7B2BF99314F25827ED8567B380D734A942CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00404AA3 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404ABA
GetDlgItem.USER32(?,00000408), ref: 00404AC7
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B16
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404B2D
SetWindowLongA.USER32(?,000000FC,004050AB), ref: 00404B47
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B59
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404B6D
SendMessageA.USER32(?,00001109,00000002), ref: 00404B83
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B8F
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B9F
DeleteObject.GDI32(00000110), ref: 00404BA4
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404BCF
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BDB
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C75
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404CA5

Part of subcall function 004040D3: SendMessageA.USER32(00000028,?,00000001,00403F03), ref: 004040E1

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404CB9
GetWindowLongA.USER32(?,000000F0), ref: 00404CE7
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CF5
ShowWindow.USER32(?,00000005), ref: 00404D05
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404E00
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E65
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E7A
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E9E
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404EBE
ImageList_Destroy.COMCTL32(?), ref: 00404ED3
GlobalFree.KERNEL32(?), ref: 00404EE3
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F5C
SendMessageA.USER32(?,00001102,?,?), ref: 00405005
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00405014
InvalidateRect.USER32(?,00000000,00000001), ref: 00405034
ShowWindow.USER32(?,00000000), ref: 00405082
GetDlgItem.USER32(?,000003FE), ref: 0040508D
ShowWindow.USER32(00000000), ref: 00405094

Strings

M, xrefs: 00404C5D
N, xrefs: 00404D3E
, xrefs: 0040506C

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 7979eb89c2ba789210c478efbd40ca5770d0cf58fb7a2a7deeb4f629e08dd5c3
Instruction ID: b93138f0eedc2449d1e9bfda9be5258a8e47cdb0f0c7c2118b7039f3366b9e37
Opcode Fuzzy Hash: 7979eb89c2ba789210c478efbd40ca5770d0cf58fb7a2a7deeb4f629e08dd5c3
Instruction Fuzzy Hash: AA026EB0900209AFEB20DFA5DD45AAE7BB5FB44314F14813AF614B62E0C7799D52CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403BCA Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C06
ShowWindow.USER32(?), ref: 00403C23
DestroyWindow.USER32 ref: 00403C37
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C53
GetDlgItem.USER32(?,?), ref: 00403C74
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403C88
IsWindowEnabled.USER32(00000000), ref: 00403C8F
GetDlgItem.USER32(?,00000001), ref: 00403D3D
GetDlgItem.USER32(?,00000002), ref: 00403D47
SetClassLongA.USER32(?,000000F2,?), ref: 00403D61
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403DB2
GetDlgItem.USER32(?,00000003), ref: 00403E58
ShowWindow.USER32(00000000,?), ref: 00403E79
EnableWindow.USER32(?,?), ref: 00403E8B
EnableWindow.USER32(?,?), ref: 00403EA6
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403EBC
EnableMenuItem.USER32(00000000), ref: 00403EC3
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403EDB
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403EEE
lstrlenA.KERNEL32(0042A870,?,0042A870,00000000), ref: 00403F18
SetWindowTextA.USER32(?,0042A870), ref: 00403F27
ShowWindow.USER32(?,0000000A), ref: 0040405B

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 5ffd1eee2a53c0bce8439eebe02f74cc0bfe9fdaa9e9cbb129ddddf772baf92f
Instruction ID: 8391a727dd330e9af47019fb45b898bbd0b6ec160f5193fdc8e4d7e88c7c5567
Opcode Fuzzy Hash: 5ffd1eee2a53c0bce8439eebe02f74cc0bfe9fdaa9e9cbb129ddddf772baf92f
Instruction Fuzzy Hash: 39C1B171600704AFDB20AF62EE45E2B3AA9FB95706F40043EF642B51E1CB799852DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00404209 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404294
GetDlgItem.USER32(00000000,000003E8), ref: 004042A8
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004042C6
GetSysColor.USER32(?), ref: 004042D7
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004042E6
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004042F5
lstrlenA.KERNEL32(?), ref: 004042F8
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404307
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040431C
GetDlgItem.USER32(?,0000040A), ref: 0040437E
SendMessageA.USER32(00000000), ref: 00404381
GetDlgItem.USER32(?,000003E8), ref: 004043AC
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004043EC
LoadCursorA.USER32(00000000,00007F02), ref: 004043FB
SetCursor.USER32(00000000), ref: 00404404
LoadCursorA.USER32(00000000,00007F00), ref: 0040441A
SetCursor.USER32(00000000), ref: 0040441D
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404449
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040445D

Strings

"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||, xrefs: 004043D7
N, xrefs: 0040439A

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: "antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||$N
API String ID: 3103080414-1866840078
Opcode ID: 448c26d367fa4ce24fea73f86f3c1ebcb169a2680b3cc918c82a0762cc84cb42
Instruction ID: e1855738532d9be41fcebd9a9c4146cd0e241e622fdf0fb061f71f1fb699f553
Opcode Fuzzy Hash: 448c26d367fa4ce24fea73f86f3c1ebcb169a2680b3cc918c82a0762cc84cb42
Instruction Fuzzy Hash: 2661A4B1A40208BFDB109F61DD45F6A7B69FB84314F00803AFB057A1D1C7B8A952CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Windows Provisioning 2.6.2 Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Windows Provisioning 2.6.2 Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Windows Provisioning 2.6.2 Setup
API String ID: 941294808-487385042
Opcode ID: 7b2e9886d4a0a86190cfd2eb73994447d751dd60ad8b28ccd238e082d53d4ecc
Instruction ID: a83fe4be3842045fa55e49ef5e4516223b86fcdf0b70f1128ddfc4a40beffe79
Opcode Fuzzy Hash: 7b2e9886d4a0a86190cfd2eb73994447d751dd60ad8b28ccd238e082d53d4ecc
Instruction Fuzzy Hash: 48418C71400209AFCB058FA5DE459BF7BB9FF45314F00842EF9A1AA1A0C7749955DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405C7F Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405E10,?,?), ref: 00405CB0
GetShortPathNameA.KERNEL32(?,0042C600,00000400), ref: 00405CB9

Part of subcall function 00405B0E: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1E
Part of subcall function 00405B0E: lstrlenA.KERNEL32(00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B50

GetShortPathNameA.KERNEL32(?,0042CA00,00000400), ref: 00405CD6
wsprintfA.USER32 ref: 00405CF4
GetFileSize.KERNEL32(00000000,00000000,0042CA00,C0000000,00000004,0042CA00,?,?,?,?,?), ref: 00405D2F
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D3E
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D76
SetFilePointer.KERNEL32(0040A3B8,00000000,00000000,00000000,00000000,0042C200,00000000,-0000000A,0040A3B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405DCC
GlobalFree.KERNEL32(00000000), ref: 00405DDD
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DE4

Part of subcall function 00405BA9: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\5006_2.6.2.exe,80000000,00000003), ref: 00405BAD
Part of subcall function 00405BA9: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BCF

Strings

%s=%s, xrefs: 00405CEA
[Rename], xrefs: 00405D5E, 00405D70

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: f77fbfde1968c6cc6d109ac9641d83ed14e9d60a65f6ef3fc352fd67b9dcf635
Instruction ID: 5f10e72b046bb4c3808544f3b96a1b07f09bbbda3d3e46611c613b54f85f09c3
Opcode Fuzzy Hash: f77fbfde1968c6cc6d109ac9641d83ed14e9d60a65f6ef3fc352fd67b9dcf635
Instruction Fuzzy Hash: F631F231600B15ABD2207BA59D4DFAB3A6CDF42754F14443BFA01F62D2DA7CE8058ABD

Uniqueness

Uniqueness Score: -1.00%

Function 0040627A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\5006_2.6.2.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062D2
CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062DF
CharNextA.USER32(?,"C:\Users\user\Desktop\5006_2.6.2.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062E4
CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062F4

Strings

"C:\Users\user\Desktop\5006_2.6.2.exe", xrefs: 004062B6
*?|<>/":, xrefs: 004062C2
C:\Users\user\AppData\Local\Temp\, xrefs: 0040627B

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\5006_2.6.2.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3875146732
Opcode ID: a4ab23b94a56fbb4e4ab915d6a0181bd243ee2e30b5e95404a857257d08c8b81
Instruction ID: 6247d5b4c7038ff51e561e9c2f84ae45375c8bcee8d01d3c6d5c321a6abb2e6d
Opcode Fuzzy Hash: a4ab23b94a56fbb4e4ab915d6a0181bd243ee2e30b5e95404a857257d08c8b81
Instruction Fuzzy Hash: 2211E95180479029EB3226246C40BBB7F884F97751F1A00BFE8C2722C1C67C5C52867D

Uniqueness

Uniqueness Score: -1.00%

Function 00404105 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404122
GetSysColor.USER32(00000000), ref: 00404160
SetTextColor.GDI32(?,00000000), ref: 0040416C
SetBkMode.GDI32(?,?), ref: 00404178
GetSysColor.USER32(?), ref: 0040418B
SetBkColor.GDI32(?,?), ref: 0040419B
DeleteObject.GDI32(?), ref: 004041B5
CreateBrushIndirect.GDI32(?), ref: 004041BF

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2fd397ab70c88e7053abfa2b1889d7e6adf273714bf8f91ffd366fbe1d5efa4b
Instruction ID: 549509973aaa983cd2a57f184cdff44cbcc336d3318ba047a0b32752f088f93e
Opcode Fuzzy Hash: 2fd397ab70c88e7053abfa2b1889d7e6adf273714bf8f91ffd366fbe1d5efa4b
Instruction Fuzzy Hash: 7D2162715007049BCB219F68DD4CB5BBBF8AF91714B048A3EEA96A66E0C734E984CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405137 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A050,00000000,00427388,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000,?), ref: 00405170
lstrlenA.KERNEL32(00403156,0042A050,00000000,00427388,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000), ref: 00405180
lstrcatA.KERNEL32(0042A050,00403156,00403156,0042A050,00000000,00427388,759223A0), ref: 00405193
SetWindowTextA.USER32(0042A050,0042A050), ref: 004051A5
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051CB
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051E5
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051F3

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 2f522a59394b9be444cbcacf3a1b4d18be92345b96de9eacb0d1f76aaf85f54b
Instruction ID: 7d4789c60296e211bada9a9e2a19d16c38d622f2d1b0cadef69f4b7d7b7d07eb
Opcode Fuzzy Hash: 2f522a59394b9be444cbcacf3a1b4d18be92345b96de9eacb0d1f76aaf85f54b
Instruction Fuzzy Hash: CE21A971900118BFDB119FA5CD85ADEBFA9EF08354F04807AF844A6291C7398E408FA8

Uniqueness

Uniqueness Score: -1.00%

Function 004049F1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404A0C
GetMessagePos.USER32 ref: 00404A14
ScreenToClient.USER32(?,?), ref: 00404A2E
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A40
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A66

Strings

f, xrefs: 00404A42

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b233b2991907e98a40282691d164461162982266b543cde43f51771bab81e11a
Instruction ID: dd2724b276b0829887a11dc4f26b79c7971af77995a7330ace4ae867cc8e4813
Opcode Fuzzy Hash: b233b2991907e98a40282691d164461162982266b543cde43f51771bab81e11a
Instruction Fuzzy Hash: 4B018071940218BADB00DB94DD81BFEBBB8AF95711F10412BBA11B61C0C7B455018FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402CDD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402CF8
MulDiv.KERNEL32(010567A6,00000064,010567AA), ref: 00402D23
wsprintfA.USER32 ref: 00402D33
SetWindowTextA.USER32(?,?), ref: 00402D43
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402D55

Strings

verifying installer: %d%%, xrefs: 00402D2D

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: f8f7fb574b01a37347c2b5a7030e5195f98b1542352a9ab3f35e70a1f9b9ac5a
Instruction ID: 025fba79a5afffe449226ec8edfc98a8674e121caf39d96b1da50a976b993c92
Opcode Fuzzy Hash: f8f7fb574b01a37347c2b5a7030e5195f98b1542352a9ab3f35e70a1f9b9ac5a
Instruction Fuzzy Hash: AA01FF71640209FBEF249F60DE49FAE37A9FB04345F008039FA06B61D0DBB599568F59

Uniqueness

Uniqueness Score: -1.00%

Function 004055FD Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405640
GetLastError.KERNEL32 ref: 00405654
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405669
GetLastError.KERNEL32 ref: 00405673

Strings

C:\Users\user\Desktop, xrefs: 004055FD
C:\Users\user\AppData\Local\Temp\, xrefs: 00405623

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-1521822154
Opcode ID: 3f07113bbed92aa299f899006a5ac68722d9e9d13463f273e10feef126da3ab7
Instruction ID: eb9787142c6b7489d22a19a099e3bfbf20428df61be735a73e08cf58b85abbae
Opcode Fuzzy Hash: 3f07113bbed92aa299f899006a5ac68722d9e9d13463f273e10feef126da3ab7
Instruction Fuzzy Hash: 89010871C00219EAEF009FA1C904BEFBBB8EB14354F00847AD545B6290DB7996088FA9

Uniqueness

Uniqueness Score: -1.00%

Function 004027A3 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027F7
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402813
GlobalFree.KERNEL32(?), ref: 0040284C
GlobalFree.KERNEL32(00000000), ref: 0040285F
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402877
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040288B

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: a2aa54484539e5cf0e08f909926563fd1753a777fa44bb9cc822b41f9e16e333
Instruction ID: 78559feecc0fcc9b474bd36237e9e6194516f5e07b3510cecd676cf0fe7807ca
Opcode Fuzzy Hash: a2aa54484539e5cf0e08f909926563fd1753a777fa44bb9cc822b41f9e16e333
Instruction Fuzzy Hash: A4217C72C00224ABCF217FA5CD49DAE7F79EF09364B10823AF520762E1CA7959419F98

Uniqueness

Uniqueness Score: -1.00%

Function 00401D41 Relevance: 7.6, APIs: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D58
GetClientRect.USER32(?,?), ref: 00401D9F
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DCD
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401DDD
DeleteObject.GDI32(00000000), ref: 00401DF4

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 9644c32a9e4c878c02d501d8468e5b93635b482ba6b65d3f6b9056da4127c7af
Instruction ID: 7a7dd6c208c7a4d57f36c402fdb0fe657614a2e015b6db45afd3f1aca9992802
Opcode Fuzzy Hash: 9644c32a9e4c878c02d501d8468e5b93635b482ba6b65d3f6b9056da4127c7af
Instruction Fuzzy Hash: 30215172E00109AFDB05DF98DE44AEEBBB9FB58310F10403AF945F62A1CB789941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401DFF Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E02
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E1C
MulDiv.KERNEL32(00000000,00000000), ref: 00401E24
ReleaseDC.USER32(?,00000000), ref: 00401E35
CreateFontIndirectA.GDI32(0040B818), ref: 00401E84

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 4e2ac4968fbcfc45df335883300c5f964cad547b4711af948e6fa709055a9030
Instruction ID: a7e809a5f5c9b27870585acda152ffb90eb46fec6a88876af75f69e410eeec04
Opcode Fuzzy Hash: 4e2ac4968fbcfc45df335883300c5f964cad547b4711af948e6fa709055a9030
Instruction Fuzzy Hash: A6015672544240AFD7016B74AE4ABA93FB8EB59305F108839F141B61F2C7750505CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C7A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C92

Strings

!, xrefs: 00401C46

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: d1a5455d7aacc09bf912e97d7887ce2258fe7abf1a6a230a252a42dd7e2e40c1
Instruction ID: f2250e9d7a54984aac42e0f48c7b57cae310fb8b86675e6ff90c870375dfe4cb
Opcode Fuzzy Hash: d1a5455d7aacc09bf912e97d7887ce2258fe7abf1a6a230a252a42dd7e2e40c1
Instruction Fuzzy Hash: 4D216BB1944208BEEF06AFA4D98AAAD7FB5EB44304F10447EF501B61D1C7B88640DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004048E7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A870,0042A870,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404802,000000DF,00000000,00000400,?), ref: 00404985
wsprintfA.USER32 ref: 0040498D
SetDlgItemTextA.USER32(?,0042A870), ref: 004049A0

Strings

%u.%u%s%s, xrefs: 0040496F

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 8f52a3d2b7158611b8ddfee5cd82df9920a420a3de20037d500134a76e905cd2
Instruction ID: e3696489e73bdb8ba2be03c53b0d6a47c9a41464d55e6eab91935fd2637341d8
Opcode Fuzzy Hash: 8f52a3d2b7158611b8ddfee5cd82df9920a420a3de20037d500134a76e905cd2
Instruction Fuzzy Hash: 0E11E473A441286BDB10A57D9C41EAF329CDB85374F254237FA26F31D1E978CC2282A9

Uniqueness

Uniqueness Score: -1.00%

Function 004059A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004059AE
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004059B7
lstrcatA.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 004059C8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004059A8

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: dfed55a16eab86d89f3af7970decdd3a6c9dbbcd65d2cf450bad9cf681275afb
Instruction ID: 62df29c05e3eff7e61c48a1ee3c1863d20e1198667f6a1bd608fcc747cda2104
Opcode Fuzzy Hash: dfed55a16eab86d89f3af7970decdd3a6c9dbbcd65d2cf450bad9cf681275afb
Instruction Fuzzy Hash: 90D0A9B2211A30BAE20266259E09ECF2E088F06310B060037F200B21A1CA3D0D1287FE

Uniqueness

Uniqueness Score: -1.00%

Function 0040206A Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00402095

Part of subcall function 00405137: lstrlenA.KERNEL32(0042A050,00000000,00427388,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000,?), ref: 00405170
Part of subcall function 00405137: lstrlenA.KERNEL32(00403156,0042A050,00000000,00427388,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000), ref: 00405180
Part of subcall function 00405137: lstrcatA.KERNEL32(0042A050,00403156,00403156,0042A050,00000000,00427388,759223A0), ref: 00405193
Part of subcall function 00405137: SetWindowTextA.USER32(0042A050,0042A050), ref: 004051A5
Part of subcall function 00405137: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051CB
Part of subcall function 00405137: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051E5
Part of subcall function 00405137: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051F3

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 004020A5
GetProcAddress.KERNEL32(00000000,?), ref: 004020B5
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040211F

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 81f5fa400d44f1169190a20222c34f29c944439e06ae8ac5dbfd902d2af26aa6
Instruction ID: 166643d80e3f452ca3a3677f95ea327ecca8534a485506fba34b2def260d9046
Opcode Fuzzy Hash: 81f5fa400d44f1169190a20222c34f29c944439e06ae8ac5dbfd902d2af26aa6
Instruction Fuzzy Hash: EA21C671900214ABCF217FA4CF89AAE7A74AF15318F20413BF601B62D0D6FD49829A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C2E Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402C93
RegCloseKey.ADVAPI32(?,?,?), ref: 00402C9C
RegCloseKey.ADVAPI32(?,?,?), ref: 00402CBD

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: f81053263e66775c86f22c9e7281053eb29660a1472c423ac1bc7bfee237aa75
Instruction ID: 2c23bb11d6ae01cf130d195ddd5538b48d854d6e1d77fd04796d14e07e1bb179
Opcode Fuzzy Hash: f81053263e66775c86f22c9e7281053eb29660a1472c423ac1bc7bfee237aa75
Instruction Fuzzy Hash: 70116A32504109FBEF129F90DF09B9E7B6DEB54340F204036BD45B61E0E7B59E15ABA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402D60 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F3E,00000001), ref: 00402D73
GetTickCount.KERNEL32 ref: 00402D91
CreateDialogParamA.USER32(0000006F,00000000,00402CDD,00000000), ref: 00402DAE
ShowWindow.USER32(00000000,00000005), ref: 00402DBC

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 92830607251259d7b21fa7f6a4b037c479e5f1f9739c9a057c3e932900ba9aab
Instruction ID: 761b86bf19c83071f88326f4280a43ff42c19d235faedd25f12e3078a496723d
Opcode Fuzzy Hash: 92830607251259d7b21fa7f6a4b037c479e5f1f9739c9a057c3e932900ba9aab
Instruction Fuzzy Hash: 62F0F431A05621ABC6217B64BE4C9DF7A64BB04B11B51047AF545B22E4DB744C878BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00405A96 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406010: lstrcpynA.KERNEL32(?,?,00000400,0040333D,Windows Provisioning 2.6.2 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 0040601D

Part of subcall function 00405A41: CharNextA.USER32(?,?,0042BC78,?,00405AAD,0042BC78,0042BC78,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A4F
Part of subcall function 00405A41: CharNextA.USER32(00000000), ref: 00405A54
Part of subcall function 00405A41: CharNextA.USER32(00000000), ref: 00405A68

lstrlenA.KERNEL32(0042BC78,00000000,0042BC78,0042BC78,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405AE9
GetFileAttributesA.KERNEL32(0042BC78,0042BC78,0042BC78,0042BC78,0042BC78,0042BC78,00000000,0042BC78,0042BC78,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 00405AF9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A96

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-823278215
Opcode ID: a0e90dbc06f1550ade5f4dfcb0fddeac6c7db65a8ba4490088ce0944d0043635
Instruction ID: 19c9bca0149f7da3aa3ccb8fe98c792d35a3de88cc2685bd8f8020a319c38c36
Opcode Fuzzy Hash: a0e90dbc06f1550ade5f4dfcb0fddeac6c7db65a8ba4490088ce0944d0043635
Instruction Fuzzy Hash: 94F0F425305D6116DA22323A5D85AAF2A44CED632471A073BF852B12C3DB3C89439DFE

Uniqueness

Uniqueness Score: -1.00%

Function 004050AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004050DA
CallWindowProcA.USER32(?,?,?,?), ref: 0040512B

Part of subcall function 004040EA: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004040FC

Strings

, xrefs: 004050BB

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: e888eab98be9719f5677808cf14d784dfa63dd3181dd39c0deeb7150e6d77b2f
Instruction ID: 77e6a5b3f6bfc6627eb61d09ca0671ae0e6a579f7b3ef645513b94fc1d41cd39
Opcode Fuzzy Hash: e888eab98be9719f5677808cf14d784dfa63dd3181dd39c0deeb7150e6d77b2f
Instruction Fuzzy Hash: FD017171600648ABDF206F11DD81A5B3B65EB84750F144036FA417A1D2D73A8C629F6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405EF7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,0042A050,?,?,?,00000002,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,?,0040613B,80000002), ref: 00405F3D
RegCloseKey.ADVAPI32(?,?,0040613B,80000002,Software\Microsoft\Windows\CurrentVersion,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||,?,0042A050), ref: 00405F48

Strings

"antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||, xrefs: 00405EFA, 00405F2E

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CloseQueryValue
String ID: "antivirus_detector.exe" C:\Users\user\Desktop\5006_2.6.2.exe|C:\Users\user\AppData\Roaming\Windows Provisioning||
API String ID: 3356406503-2781392156
Opcode ID: fbc34f94f804cf7f8ceee3a94302c0ccfb61d5b85e95000fdd84f5b54f9224ff
Instruction ID: 2ff6a7a209fcbf00177f68e0cac6a7fed3d2e9df1b1dc864ec66af95abe17f1f
Opcode Fuzzy Hash: fbc34f94f804cf7f8ceee3a94302c0ccfb61d5b85e95000fdd84f5b54f9224ff
Instruction Fuzzy Hash: 63017C7250060AABDF228F61CD09FDB3FA8EF59364F04403AF955E2190D2B8DA54CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403798 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923410,00000000,C:\Users\user\AppData\Local\Temp\,00403770,0040358A,?,?,00000006,00000008,0000000A), ref: 004037B2
GlobalFree.KERNEL32(00000000), ref: 004037B9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403798

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 248c780681ff10c09d9810c58c710ba8abcca500869ff380da07a7f320702544
Instruction ID: 06ba742c3ad1fb67bc09d12af4c86e1058789e05b1a36190638fabe2eea0851a
Opcode Fuzzy Hash: 248c780681ff10c09d9810c58c710ba8abcca500869ff380da07a7f320702544
Instruction Fuzzy Hash: EAE0C27352212097C7312F15EE04B1AB7A86F86F22F09403AE8407B2A087741C438BCC

Uniqueness

Uniqueness Score: -1.00%

Function 004059EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402E30,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\5006_2.6.2.exe,C:\Users\user\Desktop\5006_2.6.2.exe,80000000,00000003), ref: 004059F5
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E30,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\5006_2.6.2.exe,C:\Users\user\Desktop\5006_2.6.2.exe,80000000,00000003), ref: 00405A03

Strings

C:\Users\user\Desktop, xrefs: 004059EF

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 4402843b33e5109e67992b99d0281bb7e81fac819ebae0ac34b6d7d52c4d849b
Instruction ID: 7185998fb8cc4c4ccda179d560b4c8302004e2739ffdff7e1043df3a51136750
Opcode Fuzzy Hash: 4402843b33e5109e67992b99d0281bb7e81fac819ebae0ac34b6d7d52c4d849b
Instruction Fuzzy Hash: E6D0C7B3519DB06EE30392549D04B9F6A48DF16710F094566E181A6195C6784D424BED

Uniqueness

Uniqueness Score: -1.00%

Function 00405B0E Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1E
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405B36
CharNextA.USER32(00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B47
lstrlenA.KERNEL32(00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B50

Memory Dump Source

Source File: 00000000.00000002.1991310187.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1991298196.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991336061.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991349244.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1991396817.000000000043E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5006_2.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: dddc0b46adaff912d9c321cf48e41736a02eed0190ef2a74250491e495455120
Instruction ID: 0197496b5d832c36441f5dd9a15c5c44ab4bce902fcb82863052ee0cfca36748
Opcode Fuzzy Hash: dddc0b46adaff912d9c321cf48e41736a02eed0190ef2a74250491e495455120
Instruction Fuzzy Hash: C9F0C231600418BFC7029BA5DD00D9EBBB8DF06250B2540BAE840F7210D634FE019BA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: antivirus_detector.exePID: 3808, Parent PID: 6532COMMON

Execution Graph

Execution Coverage:	19.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	22

Executed Functions

Function 009F2E60 Relevance: 185.3, APIs: 64, Strings: 41, Instructions: 1515registrystringwindowCOMMON

Download Yara Rule

APIs

new.LIBCMT ref: 009F2E99

Part of subcall function 00A05B51: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,009F608A,?,6D285D9C,?,?,?), ref: 00A05B78

Part of subcall function 009FA870: GetFileAttributesA.KERNELBASE(0000001C,.txt,00000004,debug_antivirus,0000000F,009F2EC0,?,6D285D9C,?), ref: 009FA98A
Part of subcall function 009FA870: _mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(0000001C), ref: 009FA9A2
Part of subcall function 009FA870: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009FA9AF

new.LIBCMT ref: 009F2ECD

Part of subcall function 00A05B51: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,009F608A,?,6D285D9C,?,?,?), ref: 00A05B59

Part of subcall function 009FBC50: new.LIBCMT ref: 009FBCAD
Part of subcall function 009FBC50: InitializeCriticalSection.KERNEL32(00000004), ref: 009FBCC4

Part of subcall function 009F27D0: new.LIBCMT ref: 009F2802

GetCurrentProcessId.KERNEL32(?), ref: 009F2F12
ProcessIdToSessionId.KERNEL32(00000000), ref: 009F2F19
GetCommandLineW.KERNEL32 ref: 009F2F6F
CloseHandle.KERNEL32(00000000), ref: 009F2F98
ExitProcess.KERNEL32 ref: 009F2FA0
memset.VCRUNTIME140(00000000,00000000,?), ref: 009F3037
wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?), ref: 009F3049
strtok.API-MS-WIN-CRT-STRING-L1-1-0(?,00A0A6D0), ref: 009F305A
Sleep.KERNELBASE(000007D0), ref: 009F307B
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00A0A6D0), ref: 009F317C
?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position), ref: 009F321C
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009F3292
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009F32B2
RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000201,?), ref: 009F332C
RegQueryValueExA.ADVAPI32(?,?,?,?,LIC,00000000,?), ref: 009F337B
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000000,?,SOFTWARE\Policies\Windows Provisioning\Path,00A0A5E1,00000000,license.txt,0000000B), ref: 009F33B0
RegQueryValueExA.ADVAPI32(?,LIC,00000000,?,00000000,?,?,?,?,?,?,00000000,?,SOFTWARE\Policies\Windows Provisioning\Path,00A0A5E1,00000000), ref: 009F33CE
RegQueryValueExA.ADVAPI32(?,Status,00000000,?,00000000,?), ref: 009F3415
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,00000000,?,SOFTWARE\Policies\Windows Provisioning\Path,00A0A5E1,00000000,license.txt,0000000B), ref: 009F344A
RegQueryValueExA.ADVAPI32(?,Status,00000000,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009F3468
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,?,SOFTWARE\Policies\Windows Provisioning\Path,00A0A5E1,00000000,license.txt,0000000B), ref: 009F3497
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009F34B4

Part of subcall function 009F5620: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,009F11F1,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/,00000040), ref: 009F5693
Part of subcall function 009F5620: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,009F11F1,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/,00000040), ref: 009F56E7

new.LIBCMT ref: 009F34FF
memset.VCRUNTIME140(00000000,00000000,00000088,00000000,license.txt,0000000B), ref: 009F3511
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009F356B
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009F3594
new.LIBCMT ref: 009F35CF
memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000002,?,00000088,00000000,license.txt,0000000B), ref: 009F35E1
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009F3690
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009F36BD
memset.VCRUNTIME140(00000000,00000000,00000040,?,?,?,?,?,?,00000002,?,?,?,?,?,00000088), ref: 009F3700

Part of subcall function 009FD020: remove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,00000000,00000000,009FD573), ref: 009FD025
Part of subcall function 009FD020: MoveFileExA.KERNEL32(00000000,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 009FD039

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009F37DF
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,00A0A5E1,?,?,?,?,00000002), ref: 009F3830
memset.VCRUNTIME140(00000000,00000000,?,00000000), ref: 009F3931
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00A0A618), ref: 009F396A
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00A0A618,00000000,?,?,?,?,?,00000000), ref: 009F3987
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00A0A618,00000000,?,?,?,?,?,?,?,00000000), ref: 009F39A4
GdiplusStartup.GDIPLUS(?,?,?,?), ref: 009F3A40
LoadIconW.USER32(0000006C), ref: 009F3AD0
LoadIconW.USER32(0000006A), ref: 009F3ADF
FindResourceW.KERNEL32(000003EA,00000005), ref: 009F3AF3
LoadResource.KERNEL32(00000000), ref: 009F3B04
DialogBoxIndirectParamW.USER32(00000000,00000000,009F69A0,00000000), ref: 009F3B1E

Part of subcall function 009F29D0: ShellExecuteW.SHELL32(00000000,00000000,main_installer.exe,?,00000000,00000000), ref: 009F29DE

GetLastError.KERNEL32 ref: 009F3B28
GdiplusShutdown.GDIPLUS(?), ref: 009F3B32

Strings

Do auto install and activate, xrefs: 009F3C07
Status, xrefs: 009F340C, 009F345F
log.csv, xrefs: 009F325F
process session id %d, xrefs: 009F2F23
Received session id %d, xrefs: 009F2F48
Cannot open OpenSCManager error code %d, xrefs: 009F412A
token3: %d, xrefs: 009F3155
create stealth manager, xrefs: 009F35BB
version , xrefs: 009F3A81
len status path: %d, xrefs: 009F341B
install replace, xrefs: 009F3B95
len lic path: %d, xrefs: 009F3381
version.txt, xrefs: 009F37A2
LIC, xrefs: 009F336D, 009F33C5
main_installer.exe, xrefs: 009F42AF
Old Version: %d.%d.%d, New Version: %d.%d.%d, xrefs: 009F3D3E
Display dialog, xrefs: 009F3A46
get filename, xrefs: 009F360B
self re-launch: success !!!, xrefs: 009F2F85
self re-launch: fail !!!, xrefs: 009F2FA6
License path: %s, xrefs: 009F33DB
install silent mode, xrefs: 009F36E0
\version.txt, xrefs: 009F3C1F, 009F3CB1
Do not auto install. (Application has installed already), xrefs: 009F4141
token1: %s, xrefs: 009F30D5
token2: %d, xrefs: 009F3129
open reg: %d, xrefs: 009F3333
Status path: %s, xrefs: 009F3478
License file exists: %d, xrefs: 009F34BF
invalid string position, xrefs: 009F3217
possible launch from msi., xrefs: 009F2FB7
SOFTWARE\Policies\Windows Provisioning\Path, xrefs: 009F32EA
load name map, xrefs: 009F35F0
-s=1, xrefs: 009F3BF8
Cannot open service [%s], error code: %d, xrefs: 009F3E53, 009F3F2A, 009F3FE0
antivirus_detector, xrefs: 009F2F28, 009F2F4D, 009F2F8A, 009F2FAB, 009F2FBC, 009F3087, 009F30DA, 009F312E, 009F315A, 009F3338, 009F3386, 009F33E0, 009F3420, 009F347D, 009F34C4, 009F35C0, 009F35F5, 009F3610, 009F36E5, 009F3A4B, 009F3B9A, 009F3C0C, 009F3D43, 009F3DEF, 009F3E58, 009F3EBD, 009F3F2F, 009F3F7F, 009F3FE5, 009F412F, 009F4146
Open service: %s, xrefs: 009F3DEA, 009F3EB8, 009F3F7A
license.txt, xrefs: 009F324F
-s=%d -k='%s' -p='%s', xrefs: 009F40AB, 009F4247
-s=%d, xrefs: 009F370A
token0: %s, xrefs: 009F3082

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _stat64i32memset$strtok$QueryValue$LoadProcess$CloseFileGdiplusIconResource$AttributesCommandCriticalCurrentDialogErrorExecuteExitFindHandleIndirectInitializeLastLineMoveOpenParamSectionSessionShellShutdownSleepStartupXlength_error@std@@Xout_of_range@std@@_callnewh_errno_mkdirmallocmemcpyremovewcstombs
String ID: -s=%d$-s=%d -k='%s' -p='%s'$-s=1$Cannot open OpenSCManager error code %d$Cannot open service [%s], error code: %d$Display dialog$Do auto install and activate$Do not auto install. (Application has installed already)$LIC$License file exists: %d$License path: %s$Old Version: %d.%d.%d, New Version: %d.%d.%d$Open service: %s$Received session id %d$SOFTWARE\Policies\Windows Provisioning\Path$Status$Status path: %s$\version.txt$antivirus_detector$create stealth manager$get filename$install replace$install silent mode$invalid string position$len lic path: %d$len status path: %d$license.txt$load name map$log.csv$main_installer.exe$open reg: %d$possible launch from msi.$process session id %d$self re-launch: fail !!!$self re-launch: success !!!$token0: %s$token1: %s$token2: %d$token3: %d$version $version.txt
API String ID: 772305779-892903629
Opcode ID: 7cf88f9e097d3131e827ea170f6cd63ba448c63a5f8cebd304ce411b7465ba7f
Instruction ID: 3cfca097e6a3a4e4a3ab041991c677a7a91dae683f4595b0f4447909237ae2cd
Opcode Fuzzy Hash: 7cf88f9e097d3131e827ea170f6cd63ba448c63a5f8cebd304ce411b7465ba7f
Instruction Fuzzy Hash: 2FC2C270608348AFE724EB24DC46BBF77E8AF94304F44092CF685962D2DB75A945CB93

Uniqueness

Uniqueness Score: -1.00%

Function 009F69A0 Relevance: 161.6, APIs: 82, Strings: 10, Instructions: 602
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateCompatibleDC.GDI32(?), ref: 009F6A2C
SelectObject.GDI32(00000000,00000000), ref: 009F6A58
GetObjectW.GDI32(00000000,00000018,00000000), ref: 009F6A67
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 009F6A8D
SelectObject.GDI32(?,00000000), ref: 009F6A95
DeleteDC.GDI32(?), ref: 009F6A9C
GetDlgItem.USER32(?,00000519), ref: 009F6AB4
GetDlgItem.USER32(?,0000051F), ref: 009F6AC3
GetDlgItem.USER32(?,0000052F), ref: 009F6AD8
SendMessageW.USER32(00000000,000000B1,000000FF,00000000), ref: 009F6AE4
DefWindowProcW.USER32(?,?,75A88FB0), ref: 009F6AF3
GetClientRect.USER32(?,?), ref: 009F6B03
RedrawWindow.USER32(?,?,00000000,00000005), ref: 009F6B12
SetWindowLongW.USER32(?,00000000,00000002), ref: 009F6B79
GetDlgItem.USER32(?,00000515), ref: 009F6BB3
GetDlgItem.USER32(?,00000544), ref: 009F6BC2
GetDlgItem.USER32(?,0000052C), ref: 009F6BD5
GetDlgItem.USER32(?,0000052D), ref: 009F6BE8
GetDlgItem.USER32(?,0000052E), ref: 009F6BFB
GetDlgItem.USER32(?,0000052F), ref: 009F6C0E
GetDlgItem.USER32(?,00000518), ref: 009F6C1E
GetDlgItem.USER32(?,0000051B), ref: 009F6C31
GetDlgItem.USER32(?,0000051C), ref: 009F6C44
GetDlgItem.USER32(?,0000051D), ref: 009F6C57
SetTextColor.GDI32(?,00FFFFFF), ref: 009F6CB8
SetBkMode.GDI32(?,00000001), ref: 009F6CC6
GetStockObject.GDI32(00000005), ref: 009F6CCE
FindResourceW.KERNEL32(000003EE,00000005,6D285D9C), ref: 009F6D10
LoadResource.KERNEL32(00000000), ref: 009F6D19
DialogBoxIndirectParamW.USER32(00000000,?,009F7280,00000000), ref: 009F6D2E
KiUserCallbackDispatcher.NTDLL(?,00000524), ref: 009F6D3A
FindResourceW.KERNEL32(000003EB,00000005), ref: 009F6D4D
LoadResource.KERNEL32(00000000), ref: 009F6D56
DialogBoxIndirectParamW.USER32(00000000,00000000,009F7950,00000000), ref: 009F6D6C
FindResourceW.KERNEL32(000003EF,00000005,6D285D9C), ref: 009F6DA9
LoadResource.KERNEL32(00000000), ref: 009F6DB6
DialogBoxIndirectParamW.USER32(00000000,?,009F8F60,00000000), ref: 009F6DCB
EndDialog.USER32(?,00000525), ref: 009F6DE4

Strings

To Install this software, you must accept this agreement., xrefs: 009F7083
Do you accept all the terms of the preceeding License Agreement? If you choose No, Setup will close. , xrefs: 009F7070
Installation, xrefs: 009F711F
Yes, xrefs: 009F7139
I also agree to inform anyone who uses those computers that their computer usage may be monitored., xrefs: 009F704F
Software Installation, xrefs: 009F70A5
Please read the following License Agreement. Press the PAGE DOWN key to see the rest of the agreement., xrefs: 009F7063
License Agreement, xrefs: 009F7112
I agree to install this software only on computers that I own. , xrefs: 009F7040
Ready To Activate, xrefs: 009F712C

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Item$Resource$DialogObject$FindIndirectLoadParamWindow$Select$CallbackClientColorCompatibleCreateDeleteDispatcherLongMessageModeProcRectRedrawSendStockTextUser
String ID: Do you accept all the terms of the preceeding License Agreement? If you choose No, Setup will close. $I agree to install this software only on computers that I own. $I also agree to inform anyone who uses those computers that their computer usage may be monitored.$Installation$License Agreement$Please read the following License Agreement. Press the PAGE DOWN key to see the rest of the agreement.$Ready To Activate$Software Installation$To Install this software, you must accept this agreement.$Yes
API String ID: 672286209-3308482168
Opcode ID: 334eeae304efc19ca4dd4f6ae3db833bfe1deeb318cbbf2fa34f6c584373a3e1
Instruction ID: 23a9fb1af5d3a9f344969a79b31a768d85c17bd771100b317feb47d40ad37cd9
Opcode Fuzzy Hash: 334eeae304efc19ca4dd4f6ae3db833bfe1deeb318cbbf2fa34f6c584373a3e1
Instruction Fuzzy Hash: EF229E30A4072CABEB219BA4DC49FAEBE79EF59711F104199F618A61E0CB705A42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 009FD380 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 161
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000000,?,\*.*,00000004,00000000,00000000,000000FF,00A17720,00A17721,6D285D9C), ref: 009FD44E

Strings

\*.*, xrefs: 009FD42E
., xrefs: 009FD470

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: FileFindFirst
String ID: .$\*.*
API String ID: 1974802433-3701014519
Opcode ID: 67dce6097ad41a4806042ae8f85d2bae5f11e7ffa11617df1dcdcd0d80ad3fed
Instruction ID: d21250317745d11151d20518623043625943e9d6865ec5725ff52e45ce793b22
Opcode Fuzzy Hash: 67dce6097ad41a4806042ae8f85d2bae5f11e7ffa11617df1dcdcd0d80ad3fed
Instruction Fuzzy Hash: A361BA7090025CDFEF25DFA8C898BFEBBB9EB05314F500198E505A7282C7751E89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A046B0 Relevance: 7.7, APIs: 5, Instructions: 228
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?,00000000,00000228,6D285D9C,?,00000000), ref: 00A0472B
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A04741
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00A0475E
Process32NextW.KERNEL32(?,0000022C), ref: 00A049A5

Part of subcall function 00A04D40: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,?,?,00000000,00A0496E,?,00A084EF,00000000,000000FF,?,?,?,00000000), ref: 00A04D8F

CloseHandle.KERNEL32(?), ref: 00A049B9

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32Xlength_error@std@@memset
String ID:
API String ID: 1022414800-0
Opcode ID: 457ac72af995770d5304cf5c6761d043984492a27688a8f2b25335e451501156
Instruction ID: 5ec01876073c0c75ccefff856001f0384c7ed05fe0ffa3ba5d198c2078bd6889
Opcode Fuzzy Hash: 457ac72af995770d5304cf5c6761d043984492a27688a8f2b25335e451501156
Instruction Fuzzy Hash: 18918CB090025DDBDB24DFA4D988BEEBBB4FF08314F244599E619A72D0E7746A84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 009F7950 Relevance: 138.9, APIs: 71, Strings: 8, Instructions: 617
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,00000020,?,000000FF,6D285D9C), ref: 009F79DC
CreateCompatibleDC.GDI32(?), ref: 009F79E8
LoadBitmapW.USER32(0000044D), ref: 009F7A01
SelectObject.GDI32(00000000,00000000), ref: 009F7A20
GetObjectW.GDI32(00000000,00000018,00000000), ref: 009F7A2F
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 009F7A56
SelectObject.GDI32(?,00000000), ref: 009F7A5E
DeleteDC.GDI32(?), ref: 009F7A65
GetDlgItem.USER32(?,00000519), ref: 009F7A7D
GetDlgItem.USER32(?,0000051F), ref: 009F7A8C
GetDlgItem.USER32(?,00000520), ref: 009F7AA1
GetDlgItem.USER32(?,00000532), ref: 009F7AB6
GetDlgItem.USER32(?,00000533), ref: 009F7ACB
KillTimer.USER32(?,00000001,6D285D9C), ref: 009F7AE2
SetWindowLongW.USER32(?,00000000,00000002), ref: 009F7B7A
GetDlgItem.USER32(?,00000515), ref: 009F7BB3
GetDlgItem.USER32(?,0000051B), ref: 009F7BC2
GetDlgItem.USER32(?,0000051C), ref: 009F7BD5
GetDlgItem.USER32(?,0000051D), ref: 009F7BE8
GetDlgItem.USER32(?,00000530), ref: 009F7BFB
GetDlgItem.USER32(?,00000531), ref: 009F7C0E
SetTextColor.GDI32(?,00FFFFFF), ref: 009F7C5A
SetBkMode.GDI32(?,00000001), ref: 009F7C68
GetStockObject.GDI32(00000005), ref: 009F7C70

Strings

Next, xrefs: 009F813A
Installation, xrefs: 009F8120
-s=1, xrefs: 009F81D8
License Agreement, xrefs: 009F8113
Installing your software, xrefs: 009F80F9
post_install.exe, xrefs: 009F7D51
P L E A S E W A I T, xrefs: 009F8106
Ready To Activate, xrefs: 009F812D

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Item$Object$SelectWindow$BitmapColorCompatibleCreateDeleteKillLoadLongModeProcStockTextTimer
String ID: -s=1$Installation$Installing your software$License Agreement$Next$P L E A S E W A I T$Ready To Activate$post_install.exe
API String ID: 312924425-2055219389
Opcode ID: 87e2221a24812ec43abc4f0dd11c415856d50c7e0f364c59eaf423f07be3fab5
Instruction ID: bdf553b65ef7e60bde2580bd26ba7cb00558801c20828a1ce17e196aea3228fc
Opcode Fuzzy Hash: 87e2221a24812ec43abc4f0dd11c415856d50c7e0f364c59eaf423f07be3fab5
Instruction Fuzzy Hash: A3327C30A5461CABDB20DFA4DC49FEEBBB9EB58701F004199F605A72E0DB746A42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 009F8220 Relevance: 124.7, APIs: 63, Strings: 8, Instructions: 489
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,00000020,?,?), ref: 009F827C
CreateCompatibleDC.GDI32(?), ref: 009F8297
LoadBitmapW.USER32(0000044D), ref: 009F82AE
SelectObject.GDI32(00000000), ref: 009F82D6
GetObjectW.GDI32(00000000,00000018,00000000), ref: 009F82E2
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00CC0020), ref: 009F8306
SelectObject.GDI32(?,00000000), ref: 009F830E
DeleteDC.GDI32(?), ref: 009F8311
GetDlgItem.USER32(?,00000519), ref: 009F8327
GetDlgItem.USER32(?,0000051F), ref: 009F8336
GetDlgItem.USER32(?,00000520), ref: 009F834B
GetDlgItem.USER32(?,00000521), ref: 009F8360
GetDlgItem.USER32(?,00000534), ref: 009F8375
SetWindowLongW.USER32(?,00000000,00000002), ref: 009F8410
GetDlgItem.USER32(?,00000515), ref: 009F8458
GetDlgItem.USER32(?,0000051B), ref: 009F8462
GetDlgItem.USER32(?,0000051C), ref: 009F846E
GetDlgItem.USER32(?,0000051D), ref: 009F847A
GetDlgItem.USER32(?,00000535), ref: 009F8486
GetDlgItem.USER32(?,00000536), ref: 009F8492
GetDlgItem.USER32(?,00000537), ref: 009F849E
GetDlgItem.USER32(?,00000538), ref: 009F84AA
SetTextColor.GDI32(?,00FFFFFF), ref: 009F84F5
SetBkMode.GDI32(?,00000001), ref: 009F8501
GetStockObject.GDI32(00000005), ref: 009F8509

Strings

Global\Show_5491c4d3-0a5f-4898-bec4-cd906998e306, xrefs: 009F8591
Activate Now, xrefs: 009F8786
Installation, xrefs: 009F875F
set event error: %d, xrefs: 009F85B0
Activate Later, xrefs: 009F8779
antivirus_detector, xrefs: 009F85B5
License Agreement, xrefs: 009F8752
Ready To Activate, xrefs: 009F876C, 009F8793

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Item$Object$SelectWindow$BitmapColorCompatibleCreateDeleteLoadLongModeProcStockText
String ID: Activate Later$Activate Now$Global\Show_5491c4d3-0a5f-4898-bec4-cd906998e306$Installation$License Agreement$Ready To Activate$antivirus_detector$set event error: %d
API String ID: 247354590-3374414970
Opcode ID: ce716c4bf6f5c6c6dad27ed183637ccd663552d9dee1abdca7e3edb64b78d4d8
Instruction ID: 47f638563aed06103779071169048e1a40d970164fdae4316893f74b7e9e2c1b
Opcode Fuzzy Hash: ce716c4bf6f5c6c6dad27ed183637ccd663552d9dee1abdca7e3edb64b78d4d8
Instruction Fuzzy Hash: C1F1F371644708ABD710DFB4EC4AF6F7BA9FB88701F00491AF645A72E1DA749901CF52

Uniqueness

Uniqueness Score: -1.00%

Function 009F7254 Relevance: 95.0, APIs: 46, Strings: 8, Instructions: 519
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,?,00000002), ref: 009F72F4
DefWindowProcW.USER32(?,00000020,?,?,6D285D9C), ref: 009F7309
CreateSolidBrush.GDI32(003300CC), ref: 009F731F
GetClientRect.USER32(?,?), ref: 009F732E
FillRect.USER32(?,?,00000000), ref: 009F733C
CreateSolidBrush.GDI32(00000099), ref: 009F7347
GetClientRect.USER32(?), ref: 009F7355
GetDC.USER32 ref: 009F735D
FillRect.USER32(00000000,?,00000000), ref: 009F7369
GetWindowLongW.USER32(?,000000F0), ref: 009F737C
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009F738B
GetParent.USER32(?), ref: 009F7392
GetDesktopWindow.USER32 ref: 009F739C
GetWindowRect.USER32(00000000,?), ref: 009F73AD
GetWindowRect.USER32(?,?), ref: 009F73B4
CopyRect.USER32(?,?), ref: 009F73BE
OffsetRect.USER32(?,?,?), ref: 009F73DA
OffsetRect.USER32(?,?,?), ref: 009F73EC
OffsetRect.USER32(?,?,?), ref: 009F73FE
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000001), ref: 009F7421
GetDlgItem.USER32(?,0000053D), ref: 009F7438
GetDlgItem.USER32(?,0000053E), ref: 009F7442
GetDlgItem.USER32(?,0000053F), ref: 009F7451
GetDlgItem.USER32(?,00000529), ref: 009F7464
SendMessageW.USER32(00000000,00000030,00000000), ref: 009F7479
GetDlgItem.USER32(?,0000053D), ref: 009F7806
GetDlgItem.USER32(?,0000053E), ref: 009F7810
GetDlgItem.USER32(?,0000053F), ref: 009F781E
GetDlgItem.USER32(?,00000529), ref: 009F782C
SetBkMode.GDI32(?,00000001), ref: 009F7868
GetStockObject.GDI32(00000005), ref: 009F7870

Strings

list<T> too long, xrefs: 009F77DB
For your software to work correctly it must be added as an exception to the following Antivirus programs., xrefs: 009F74A7
Please use the instructions below to add exceptions to your Antivirus software to ensure that your software will work smoothly and, xrefs: 009F74F1
Antivirus Detected!, xrefs: 009F74BD
Click here for instructions, xrefs: 009F75CE
button, xrefs: 009F75D3
static, xrefs: 009F758D, 009F7771
#, xrefs: 009F771D

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Rect$ItemWindow$LongOffset$BrushClientCreateFillSolid$CopyDesktopMessageModeObjectParentProcSendStock
String ID: #$Antivirus Detected!$Click here for instructions$For your software to work correctly it must be added as an exception to the following Antivirus programs.$Please use the instructions below to add exceptions to your Antivirus software to ensure that your software will work smoothly and$button$list<T> too long$static
API String ID: 34053187-1816344687
Opcode ID: 2fe8e9d273ab3c315951b5a5a0af6f33d49d0ab6dead1206825ab49177f3a96c
Instruction ID: 33e1765399601e3257c14ea2bb5e44950b4ab3364df8427e46335c6f0075b9e6
Opcode Fuzzy Hash: 2fe8e9d273ab3c315951b5a5a0af6f33d49d0ab6dead1206825ab49177f3a96c
Instruction Fuzzy Hash: 7C02807190421DAFEB20DBA4DC89FAEBBB9FB54300F104595F609A7291D7709E82CF61

Uniqueness

Uniqueness Score: -1.00%

Function 009F4850 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 245
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009F6300: new.LIBCMT ref: 009F6305

CoInitializeEx.OLE32(00000000,00000000,00000000,00000000,6D285D9C), ref: 009F48C2
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 009F48E2
CoCreateInstance.OLE32(00A0A514,00000000,00000001,00A0A524,?), ref: 009F4910
CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 009F4982
VariantClear.OLEAUT32(00000008), ref: 009F4AC5
CoUninitialize.OLE32 ref: 009F4AFC
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list<T> too long,00000000,?,00000000,?), ref: 009F4B25

Strings

list<T> too long, xrefs: 009F4B20
WQL, xrefs: 009F49AD
displayName, xrefs: 009F4A52
SELECT * FROM AntivirusProduct, xrefs: 009F4990

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Initialize$BlanketClearCreateInstanceProxySecurityUninitializeVariantXlength_error@std@@
String ID: SELECT * FROM AntivirusProduct$WQL$displayName$list<T> too long
API String ID: 1319182029-2063593977
Opcode ID: e9c9ca24ab84b4b9707fb8a9eb3a803ae272f9e562372cf0b894db1c8e0560ee
Instruction ID: 78cf5a4573f75583c0bfe101c072b829f9d46effb63acc3a8c81d1c82861a12e
Opcode Fuzzy Hash: e9c9ca24ab84b4b9707fb8a9eb3a803ae272f9e562372cf0b894db1c8e0560ee
Instruction Fuzzy Hash: 21914B70A4021DAFDB10DFA4DC45FAFBBB8BF44714F204158E605AB2D0DBB5A905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F4550 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(00000000,6D285D9C,PNG), ref: 009F456E
SizeofResource.KERNEL32(00000000,00000000), ref: 009F4580
LoadResource.KERNEL32(00000000,00000000), ref: 009F458B
LockResource.KERNEL32(00000000), ref: 009F459B
GlobalAlloc.KERNELBASE(00000002,?), ref: 009F45AC
GlobalLock.KERNEL32(00000000), ref: 009F45B9
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 009F45C8
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 009F45D9
GlobalUnlock.KERNEL32(00000000), ref: 009F4613

Part of subcall function 009F2920: GdipAlloc.GDIPLUS(00000010), ref: 009F2936
Part of subcall function 009F2920: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 009F295A

GlobalFree.KERNEL32(00000000), ref: 009F461A

Strings

PNG, xrefs: 009F4562

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLockStream$BitmapFindFreeFromLoadSizeofUnlockmemcpy
String ID: PNG
API String ID: 2868195497-364855578
Opcode ID: 340e9f1c97b702dac64c1db05126f8b3512b81c3f33764ee74711ac932e8e6c1
Instruction ID: d3051e76292c652f6f72484226b2a7f1677ad26c0b82d1a0de0be3aba5252ca4
Opcode Fuzzy Hash: 340e9f1c97b702dac64c1db05126f8b3512b81c3f33764ee74711ac932e8e6c1
Instruction Fuzzy Hash: 94216271A0021CABD7109FA5EC48A7FBBBCEF9AB11F000159FA06D7250DB349D42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 009FA870 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(0000001C,.txt,00000004,debug_antivirus,0000000F,009F2EC0,?,6D285D9C,?), ref: 009FA98A
_mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(0000001C), ref: 009FA9A2
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009FA9AF
GetFileAttributesA.KERNELBASE(0000001C,.txt,00000004,debug_antivirus,0000000F,009F2EC0,?,6D285D9C,?), ref: 009FA9CE
GetFileAttributesA.KERNEL32(00000000,00000000,00000000,000000FF,0000001C,00000000,000000FF,.txt,00000004,debug_antivirus,0000000F,009F2EC0,?,6D285D9C,?), ref: 009FAA6B
_mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000), ref: 009FAA86
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009FAA93

Strings

debug_antivirus, xrefs: 009FA955, 009FAAA8
.txt, xrefs: 009FA964

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: AttributesFile$_errno_mkdir
String ID: .txt$debug_antivirus
API String ID: 3316992066-4049534805
Opcode ID: 90fb252d7754a14643e56f5dd543b8dd3a6f115008a6b16d65725787a855011d
Instruction ID: 645c4351c0d7e8b06ba76bd130b4cb0d949fdec64867be8e65d5af74c1c0aaa7
Opcode Fuzzy Hash: 90fb252d7754a14643e56f5dd543b8dd3a6f115008a6b16d65725787a855011d
Instruction Fuzzy Hash: 34A1C4B090020CDFEB14DF68C844BBEBBB5FF05310F500528E656A72D2D7B5A985CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A00B40 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009FFC20: new.LIBCMT ref: 009FFC22

GetCurrentProcess.KERNEL32(?,6D285D9C,?,00000000), ref: 00A00C3C
IsWow64Process.KERNEL32(00000000), ref: 00A00C43
new.LIBCMT ref: 00A00CD9

Part of subcall function 009F5A50: memcpy.VCRUNTIME140(00000000,009FD4F6,E8FFFFFD,00000000,00000000,?,009FD4F6,00000000), ref: 009F5A6B

Part of subcall function 009F5B90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BA3
Part of subcall function 009F5B90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BB0
Part of subcall function 009F5B90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BBD
Part of subcall function 009F5B90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BC8

Strings

{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}, xrefs: 00A00C8C, 00A00C9F
SOFTWARE\Classes\CLSID\, xrefs: 00A00C69
Data, xrefs: 00A00D0B
\MiscStatus\1, xrefs: 00A00CBF, 00A00CCD

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process$CurrentWow64memcpy
String ID: Data$SOFTWARE\Classes\CLSID\$\MiscStatus\1${d07606c8-6532-4d75-a46d-f5f5ac6ef74a}
API String ID: 1661744430-531586979
Opcode ID: b4eb78a50773ea8ab6db6d4c188386b5cee80f666ad71acf7ed8a7b592ffb6db
Instruction ID: 103d9c9770e2870463c1f8661d22f5fb05ddfc685cb8654f4ffb693eac8ad620
Opcode Fuzzy Hash: b4eb78a50773ea8ab6db6d4c188386b5cee80f666ad71acf7ed8a7b592ffb6db
Instruction Fuzzy Hash: DEC19E70A04248DFEB08DFA8E984BAEBBB5FF01304F600559E5169B2D2C775ED45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F5FD0 Relevance: 7.6, APIs: 5, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(6D285D9C,?,?,?), ref: 009F6054
?_Xbad_alloc@std@@YAXXZ.MSVCP140(6D285D9C,?,?,?), ref: 009F606A
new.LIBCMT ref: 009F6071
new.LIBCMT ref: 009F6085

Part of subcall function 00A05B51: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,009F608A,?,6D285D9C,?,?,?), ref: 00A05B78

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,009F1132,1.3.1,00000005), ref: 009F60D3

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xbad_alloc@std@@$mallocmemcpy
String ID:
API String ID: 2729666953-0
Opcode ID: 99ca14db8cea5bd6823b2b7d685e6b19559ceb83729a81767601cd14f91dedb4
Instruction ID: 66b8a78edb57c526d2c0f875a04b1dd50e8e22b561955e0f3c32e28f1c2c01e7
Opcode Fuzzy Hash: 99ca14db8cea5bd6823b2b7d685e6b19559ceb83729a81767601cd14f91dedb4
Instruction Fuzzy Hash: C041F6B1A04708DBCB24DF29D98163AB7F8EB45350F244B2DE552C7290EB35E905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F5B30 Relevance: 7.5, APIs: 5, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B40
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B54
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B61
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B6E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B79

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 9e526c331d57989d8cb7ba1347be959191b09cc182b5b50e1f0e674e7cc4d3ee
Instruction ID: f0196f82a02279ef1a801d8d9f63407d6c95f642ac8ba0a7cdb5795d1df49b34
Opcode Fuzzy Hash: 9e526c331d57989d8cb7ba1347be959191b09cc182b5b50e1f0e674e7cc4d3ee
Instruction Fuzzy Hash: 03F0123051060E4BD708FBB4E96D5FD779D9B18317B150526EB17C2270DA2798D28A1A

Uniqueness

Uniqueness Score: -1.00%

Function 009F5460 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000058,00000040,?,00A00CD7,\MiscStatus\1,0000000D,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\,00000017), ref: 009F54C9
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000000,00000058,00000040,?,00A00CD7,\MiscStatus\1,0000000D,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\,00000017), ref: 009F54E8
memcpy.VCRUNTIME140(?,00000017,?,00000000,00000058,00000040,?,00A00CD7,\MiscStatus\1,0000000D,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\), ref: 009F554A

Strings

string too long, xrefs: 009F54C4, 009F54E3

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@$memcpy
String ID: string too long
API String ID: 44297128-2556327735
Opcode ID: ecb0869319492ab20f921f0198ca45c27870376e28be07a032ccae9a39edda72
Instruction ID: d9f393e2a1baff181de3f93145eb69880f95fb76e7b0c43a8a7cb5f871eb9495
Opcode Fuzzy Hash: ecb0869319492ab20f921f0198ca45c27870376e28be07a032ccae9a39edda72
Instruction Fuzzy Hash: 2231D632305B099B8734DE5CF88087AF3AAFF95712322492EF386C7660D731D8558BA5

Uniqueness

Uniqueness Score: -1.00%

Function 009F29D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(00000000,00000000,main_installer.exe,?,00000000,00000000), ref: 009F29DE

Strings

main_installer.exe, xrefs: 009F29D5
\*.*, xrefs: 009FD42E
., xrefs: 009FD470

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: ExecuteShell
String ID: .$\*.*$main_installer.exe
API String ID: 587946157-3509626255
Opcode ID: aca6a7f77ebdc1e4065394ebfba0c4aa388c10b7bf978415383a03db72b72bfc
Instruction ID: e709060296ab7f156ae0efda1a82b608a2839e106954c7375fac4956013f2626
Opcode Fuzzy Hash: aca6a7f77ebdc1e4065394ebfba0c4aa388c10b7bf978415383a03db72b72bfc
Instruction Fuzzy Hash: 1FD0C730789308EBE725C7809C56B783276F358741F505518F316294D0D7F42841C659

Uniqueness

Uniqueness Score: -1.00%

Function 009F4650 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 009F4668
GdipCreateFromHDC.GDIPLUS(00000000,?), ref: 009F467A
GdipDrawImageI.GDIPLUS(00000000,00000000,00000000,00000000), ref: 009F4694
GdipDeleteGraphics.GDIPLUS(00000000), ref: 009F469B

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Gdip$CreateDeleteDrawFromGraphicsImage
String ID:
API String ID: 926577726-0
Opcode ID: 806989a911655d7d249ba4f0dfe7c61a6e9d21c39f69f34b3911846243b653ad
Instruction ID: 293028e47ff9384c000f8a189ca6c5e5ba4e71de1ffef77b4061897eb5267e52
Opcode Fuzzy Hash: 806989a911655d7d249ba4f0dfe7c61a6e9d21c39f69f34b3911846243b653ad
Instruction Fuzzy Hash: BFF06D3590171CABDB10DBE4ED49BAEBBBCEF19701F014188F901A7240DA346E028B96

Uniqueness

Uniqueness Score: -1.00%

Function 009FD0A0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,750292F0,?,?,?,009F2BBF), ref: 009FD0AA
new.LIBCMT ref: 009FD0BB

Part of subcall function 00A05B51: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,009F608A,?,6D285D9C,?,?,?), ref: 00A05B78

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: fopenmalloc
String ID:
API String ID: 1458608084-0
Opcode ID: bd512d35405c3567d8fd2cbbec72d18273d4a006ecf54c333901b8a9c6c57a2b
Instruction ID: 9d6b7dc1941a459f7ac882eb4ad16d9a77176c1d43a9a7d336aa3d248c679417
Opcode Fuzzy Hash: bd512d35405c3567d8fd2cbbec72d18273d4a006ecf54c333901b8a9c6c57a2b
Instruction Fuzzy Hash: DF01D431A4E20C56D7249B2898093B2FBDE9F52324F28429EDD4C4B301E6B38883C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 009F2920 Relevance: 3.0, APIs: 2, Instructions: 43memorywindowCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 009F2936
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 009F295A

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 5c02d94d057191b7ea1df2b3a1f3f62594ca3b4e6ca1134988b97922a8be27da
Instruction ID: 279a319cbdbc81f856192ac872dc58ab0e3564e63be4a8732ba66e136b64ad8f
Opcode Fuzzy Hash: 5c02d94d057191b7ea1df2b3a1f3f62594ca3b4e6ca1134988b97922a8be27da
Instruction Fuzzy Hash: 97018635E0070C9BC710DFB9E9556AEFBF8EF5A710F5142AEE84997340EB7069818781

Uniqueness

Uniqueness Score: -1.00%

Function 009FD020 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

remove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,00000000,00000000,009FD573), ref: 009FD025
MoveFileExA.KERNEL32(00000000,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 009FD039

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: FileMoveremove
String ID:
API String ID: 1863355238-0
Opcode ID: 67a4d058ce8a4c85ef34558b7163bf99ae15a2058227ce55c2e5ce27b7966156
Instruction ID: a20c099e8b719fd631bca341ef49803e744fdd2dd3fde94d63660f3bf42892c1
Opcode Fuzzy Hash: 67a4d058ce8a4c85ef34558b7163bf99ae15a2058227ce55c2e5ce27b7966156
Instruction Fuzzy Hash: AFD05E3274222417E63016697C09FBB969C8BE2F71F190136FA04D6260EA988C435192

Uniqueness

Uniqueness Score: -1.00%

Function 009FCFF0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNELBASE(?,00000000,009FD5A5), ref: 009FCFF4
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 009FD002

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: DirectoryFileMoveRemove
String ID:
API String ID: 2107220919-0
Opcode ID: 2b5415335420c5f4f4f8e4d08ca9cc22b48712fe545fe14f72e2ac57e1a306e0
Instruction ID: 8764f318b5ecd7495acec7e33083d2c6da8a24734b3756987420d693e9e5a966
Opcode Fuzzy Hash: 2b5415335420c5f4f4f8e4d08ca9cc22b48712fe545fe14f72e2ac57e1a306e0
Instruction Fuzzy Hash: 68D0C9712062289BE6316FA9BC08BAA229C9F2A725F050165E600D5050EBA4894346A6

Uniqueness

Uniqueness Score: -1.00%

Function 00A014C0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000002A,00000000,?), ref: 00A014F3

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: FolderPathSpecial
String ID:
API String ID: 994120019-0
Opcode ID: e73509efa6b92122bfe691b3cb6a77c22797de3330bbfbf393c037197aee7474
Instruction ID: 03eb9175b8ea3072eeeeba17967c175c99bdcee9f816dd07698f239291900f5a
Opcode Fuzzy Hash: e73509efa6b92122bfe691b3cb6a77c22797de3330bbfbf393c037197aee7474
Instruction Fuzzy Hash: 0301B170A0431C9BDB24DF24DC057EABBB4AB16314F0002DDE4865B280EBB52E898B81

Uniqueness

Uniqueness Score: -1.00%

Function 009FCF80 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,00000000), ref: 009FCFAA

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _stat64i32
String ID:
API String ID: 3712039808-0
Opcode ID: 2154a3951c4a7ae634b6d61360a25445fd57e7ae01264996a73064ed7c7557de
Instruction ID: e8eaf84a3a076bcc9ae9d615bb289d7f229be5f6cf3d7a486d6f25a8196e048e
Opcode Fuzzy Hash: 2154a3951c4a7ae634b6d61360a25445fd57e7ae01264996a73064ed7c7557de
Instruction Fuzzy Hash: C7F09036A1511C9B8B00EFF8E9415FEB7B9DF5D200B4041AAED0A97251EE315F068BD5

Uniqueness

Uniqueness Score: -1.00%

Function 009FD2D0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?), ref: 009FD2E7

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: fseek
String ID:
API String ID: 623662203-0
Opcode ID: 17560b4c9da9b637b2729d33a6d8ab0b744ed23941be29464203c5204e9786e2
Instruction ID: 5ad77e748db628b4e0b7b1fd7eaae9c4b8f146a530007b51d865fd9d0a302ccc
Opcode Fuzzy Hash: 17560b4c9da9b637b2729d33a6d8ab0b744ed23941be29464203c5204e9786e2
Instruction Fuzzy Hash: E8D0A9336A020C7BCF00AFF8AC01CA27B9CAB327047008022F918C6401E232E03AA791

Uniqueness

Uniqueness Score: -1.00%

Function 009FD1C0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?), ref: 009FD1D5

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: fgets
String ID:
API String ID: 3135385589-0
Opcode ID: 4fecdb28036dbe23af20f2f546b163d89f48963625de55354fe112ee026275c9
Instruction ID: 9086fdb09a64b74acfcc867e130a90c782017e32f0b00c3bd223a91838737ba2
Opcode Fuzzy Hash: 4fecdb28036dbe23af20f2f546b163d89f48963625de55354fe112ee026275c9
Instruction Fuzzy Hash: 6DD0123224020C6BCB109F94EC00C677B9DAB74754700C011F90C89121D233E976D791

Uniqueness

Uniqueness Score: -1.00%

Function 009FD170 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 009FD17B

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: fclose
String ID:
API String ID: 3125558077-0
Opcode ID: ff533ff083fb0bfdecd98efe8a88579492991cfcd5fc56163915efb76f817f51
Instruction ID: fb3aa07b6e95a4131385583afad57aa48127175fb83698d1ae27c0ae9485e92a
Opcode Fuzzy Hash: ff533ff083fb0bfdecd98efe8a88579492991cfcd5fc56163915efb76f817f51
Instruction Fuzzy Hash: 76C08CB060531047DB30CB18B80874332DC5F00B08F044429E40AC7200CA70E862879A

Uniqueness

Uniqueness Score: -1.00%

Function 009FD2B0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

ftell.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 009FD2BC

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: ftell
String ID:
API String ID: 4150084136-0
Opcode ID: 98f6af2f6b072226b6b87da4e73b829347ecb7a96c652c78f3a820a28a486419
Instruction ID: 8835d6d125df61898f7c4b3bd8445012aa7ace7544bbbfc859943e785f31c771
Opcode Fuzzy Hash: 98f6af2f6b072226b6b87da4e73b829347ecb7a96c652c78f3a820a28a486419
Instruction Fuzzy Hash: 1AB09278A0020457DA108B78AC0855A3A5D7E52B293D887A4B539C50E1E3AAD4178686

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A02B50 Relevance: 77.3, APIs: 30, Strings: 14, Instructions: 266servicesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009F27D0: new.LIBCMT ref: 009F2802

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,750292F0,?,00000000), ref: 00A02BA2
OpenServiceA.ADVAPI32(00000000,?,00000026), ref: 00A02BCE
ChangeServiceConfig2W.ADVAPI32(00000000), ref: 00A02C31
GetTickCount.KERNEL32 ref: 00A02C3D
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00A02C4F
Sleep.KERNEL32(?,?), ref: 00A02CA4
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?,?,?), ref: 00A02CB7
GetTickCount.KERNEL32 ref: 00A02CDF
ControlService.ADVAPI32(00000000,00000001,?), ref: 00A02D09
Sleep.KERNEL32(?), ref: 00A02D2A
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00A02D39
GetTickCount.KERNEL32 ref: 00A02D51
CloseServiceHandle.ADVAPI32(00000000), ref: 00A02D6D
CloseServiceHandle.ADVAPI32(?), ref: 00A02D70
GetLastError.KERNEL32(?,?), ref: 00A02D8E
CloseServiceHandle.ADVAPI32(00000000), ref: 00A02DB1
CloseServiceHandle.ADVAPI32(00000000), ref: 00A02DB4
CloseServiceHandle.ADVAPI32(00000000), ref: 00A02DD7
CloseServiceHandle.ADVAPI32(?), ref: 00A02DDA
CloseServiceHandle.ADVAPI32(00000000), ref: 00A02DFD
CloseServiceHandle.ADVAPI32(?), ref: 00A02E00
GetLastError.KERNEL32 ref: 00A02E26
CloseServiceHandle.ADVAPI32(00000000), ref: 00A02E46
CloseServiceHandle.ADVAPI32(00000000), ref: 00A02E49
GetLastError.KERNEL32 ref: 00A02E58
CloseServiceHandle.ADVAPI32(00000000), ref: 00A02E79
CloseServiceHandle.ADVAPI32(00000000), ref: 00A02E96
GetLastError.KERNEL32 ref: 00A02E9A

Strings

QueryServiceStatusEx 3 failed (%d), xrefs: 00A02E2D
%s exit }, xrefs: 00A02EB8
QueryServiceStatusEx 2 failed (%d), xrefs: 00A02E0E
Wait timed out, xrefs: 00A02DBB
CStealthManager::stopService, xrefs: 00A02B7B, 00A02EB3
Can't find service, xrefs: 00A02E7D
OpenService [%s] failed (%d), xrefs: 00A02E60
Service stop timed out., xrefs: 00A02D77
QueryServiceStatusEx 1 failed (%d), xrefs: 00A02D95
stealth_manager, xrefs: 00A02B85, 00A02CD0, 00A02D7C, 00A02D9A, 00A02DC0, 00A02DE6, 00A02E32, 00A02E65, 00A02E82, 00A02EA6, 00A02EBD
%s enter {, xrefs: 00A02B80
ControlService failed (%d), xrefs: 00A02E1C
Service stopped successfully., xrefs: 00A02CCB, 00A02DE1
OpenSCManager failed (%d), xrefs: 00A02EA1

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Service$CloseHandle$ErrorLast$CountQueryStatusTick$OpenSleep$ChangeConfig2ControlManager
String ID: %s enter {$%s exit }$CStealthManager::stopService$Can't find service$ControlService failed (%d)$OpenSCManager failed (%d)$OpenService [%s] failed (%d)$QueryServiceStatusEx 1 failed (%d)$QueryServiceStatusEx 2 failed (%d)$QueryServiceStatusEx 3 failed (%d)$Service stop timed out.$Service stopped successfully.$Wait timed out$stealth_manager
API String ID: 656698291-246199290
Opcode ID: 4d4a41bc79d780b4b43a1e3b2ab334995b46e81f6de34c4de6756c88cd6d4f36
Instruction ID: 36534059d253c69bb17928b24d6a765754b845336e7b45f9845d3c0dc24429f5
Opcode Fuzzy Hash: 4d4a41bc79d780b4b43a1e3b2ab334995b46e81f6de34c4de6756c88cd6d4f36
Instruction Fuzzy Hash: 90918071A8031CEBDB10EF94EC4ABEE7B78FF54701F100815F905A61D1D7B4A9968BA2

Uniqueness

Uniqueness Score: -1.00%

Function 009F9B90 Relevance: 56.3, APIs: 23, Strings: 9, Instructions: 280COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000008,6D285D9C,?,00000000,00000000), ref: 009F9BDE
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,00000000), ref: 009F9BE5
GetLastError.KERNEL32(?,00000000,00000000), ref: 009F9BEF

Part of subcall function 009F2740: new.LIBCMT ref: 009F2772

WTSQuerySessionInformationW.WTSAPI32(00000000,00000008,00000005,00000000,00000000,?,00000000,00000000), ref: 009F9C30
GetLastError.KERNEL32(?,00000000,00000000), ref: 009F9C3A

Strings

fail to open token : %d, xrefs: 009F9D6B
fail to get ssid : %d, xrefs: 009F9BF6
fail to open : %d, xrefs: 009F9D26
D, xrefs: 009F9DFA
fxstd::fxwshelper, xrefs: 009F9BFB, 009F9C46, 009F9CA4, 009F9CF7, 009F9D2B, 009F9D70, 009F9DBF
fail to query session info : %d, xrefs: 009F9C41
fail to get ss user : %d, xrefs: 009F9C9F
fail to open dup : %d, xrefs: 009F9DBA
fail to get pid : %d, xrefs: 009F9CF2

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: ErrorLastProcessSession$CurrentInformationQuery
String ID: D$fail to get pid : %d$fail to get ss user : %d$fail to get ssid : %d$fail to open : %d$fail to open dup : %d$fail to open token : %d$fail to query session info : %d$fxstd::fxwshelper
API String ID: 3328655072-3779455580
Opcode ID: 3fc56c516eff1e8b2b2447548a008606852b2f264fcee08d4fe1b6b9495c651f
Instruction ID: 88c8dabfbaa850551bae687d3e0e5702bc7a26f4a18be33366d01aa66ff26cce
Opcode Fuzzy Hash: 3fc56c516eff1e8b2b2447548a008606852b2f264fcee08d4fe1b6b9495c651f
Instruction Fuzzy Hash: 26A18D71A0020CAFEB10EFA4DC46BBEBBB8FF58745F200119FA06E61A1E77569458B51

Uniqueness

Uniqueness Score: -1.00%

Function 009FBB30 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 91processCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000040,?,00000000), ref: 009FBB66
CreateEnvironmentBlock.USERENV(?,00000000,00000001,?,00000000), ref: 009FBB96
CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 009FBBC5
DestroyEnvironmentBlock.USERENV(?), ref: 009FBBD5
CloseHandle.KERNEL32(?), ref: 009FBBEA
CloseHandle.KERNEL32(?), ref: 009FBBF5

Strings

D, xrefs: 009FBB6E

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: BlockCloseCreateEnvironmentHandle$DestroyProcessUsermemset
String ID: D
API String ID: 2205774720-2746444292
Opcode ID: 98aaa4c8b6f8414f4fb1e1403cf8cac1c1690af9ee2f8b058ca0ba598bfb38f6
Instruction ID: 59ed7e51da3e4866ad966847d7776505eff2a1bc1660363f9ba4cb9ce6bfda71
Opcode Fuzzy Hash: 98aaa4c8b6f8414f4fb1e1403cf8cac1c1690af9ee2f8b058ca0ba598bfb38f6
Instruction Fuzzy Hash: 9E218F72A0030C6BDB14DBE4DC81FEE77B8EF48721F100229EA05AB284DA71A9468754

Uniqueness

Uniqueness Score: -1.00%

Function 00A056F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00A05679,00000000), ref: 00A0570D
OpenProcessToken.ADVAPI32(00000000), ref: 00A05714
LookupPrivilegeValueW.ADVAPI32(00000000), ref: 00A0574D
AdjustTokenPrivileges.ADVAPI32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00A05780
CloseHandle.KERNEL32(00000000), ref: 00A05789

Strings

SeDebugPrivilege, xrefs: 00A05729

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 143e67cde8dc545c97f98a1fdced5f51e215fd4ce03a23bac04a8706cfde014b
Instruction ID: 71b4924b43478cfaea67ebdf02db5f668b00bb29a7516d57a4e053d9aabec8b2
Opcode Fuzzy Hash: 143e67cde8dc545c97f98a1fdced5f51e215fd4ce03a23bac04a8706cfde014b
Instruction Fuzzy Hash: 6B11C871D4030DAFEB10DFE0DD49BEEBBB8BF18700F104119E501B6280D7B55A459BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A0649D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,?), ref: 00A064B6

Strings

, xrefs: 00A06613

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 74ed9eb3e44802885f5e5184ce9d0fb82ad3b3ce78603e5ce409886d8a5a1ef2
Instruction ID: 5b491a4194fa34508feeea3b9a524cf21aa9ce7e86a74ad4a31de78a13b20be6
Opcode Fuzzy Hash: 74ed9eb3e44802885f5e5184ce9d0fb82ad3b3ce78603e5ce409886d8a5a1ef2
Instruction Fuzzy Hash: 1141AFB1D043098BDB18CFA9E88579EBBF4FB48314F10C52AD805E7294D371A951CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00A067D9 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00A067E5,00A05EDC), ref: 00A067DE

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 42adc16307cb7b63505c46e8948db83d7454b098d74004f0bffe8b734e298129
Instruction ID: bbe5fee0cae08e89184503fb6acabe40d1bea75e255f856966a79a3c77fee289
Opcode Fuzzy Hash: 42adc16307cb7b63505c46e8948db83d7454b098d74004f0bffe8b734e298129
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 009F8F60 Relevance: 70.3, APIs: 34, Strings: 6, Instructions: 266windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,00000002), ref: 009F8FC4
DefWindowProcW.USER32(?,00000020,?,?,6D285D9C), ref: 009F8FD9
CreateSolidBrush.GDI32(00333333), ref: 009F8FE9
GetClientRect.USER32(?,?), ref: 009F8FF6
FillRect.USER32(?,?,00000000), ref: 009F9002
GetWindowLongW.USER32(?,000000F0), ref: 009F9015
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009F9024
GetParent.USER32(?), ref: 009F902B
GetDesktopWindow.USER32 ref: 009F9035
GetWindowRect.USER32(00000000,?), ref: 009F9046
GetWindowRect.USER32(?,?), ref: 009F904D
CopyRect.USER32(?,?), ref: 009F9057
OffsetRect.USER32(?,?,?), ref: 009F9073
OffsetRect.USER32(?,?,?), ref: 009F9085
OffsetRect.USER32(?,?,?), ref: 009F9097
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000001), ref: 009F90BA
GetDlgItem.USER32(?,00000542), ref: 009F90CC
GetDlgItem.USER32(?,00000543), ref: 009F90D6
GetDlgItem.USER32(?,00000540), ref: 009F90E2
GetDlgItem.USER32(?,00000541), ref: 009F90EF
SendMessageW.USER32(00000000,00000030,00000000), ref: 009F9105
GetDlgItem.USER32(?,00000542), ref: 009F91DC
GetDlgItem.USER32(?,00000543), ref: 009F91E6
SetTextColor.GDI32(?,00FFFFFF), ref: 009F91FC
SetBkMode.GDI32(?,00000001), ref: 009F920A
GetStockObject.GDI32(00000005), ref: 009F9212

Strings

Setup is not yet complete. If you cancel the setup now, your software will not be installed., xrefs: 009F9132
Cancel Setup, xrefs: 009F916D
To continue installing the program, click Resume. To quit the Setup program, click Exit., xrefs: 009F9157
Resume, xrefs: 009F918E
You may run the Setup program at a later time to complete the installation., xrefs: 009F9141
Exit, xrefs: 009F919B

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: RectWindow$Item$LongOffset$BrushClientColorCopyCreateDesktopFillMessageModeObjectParentProcSendSolidStockText
String ID: Cancel Setup$Exit$Resume$Setup is not yet complete. If you cancel the setup now, your software will not be installed.$To continue installing the program, click Resume. To quit the Setup program, click Exit.$You may run the Setup program at a later time to complete the installation.
API String ID: 1032763113-3762990505
Opcode ID: 87db68c5598009cc7f1a48d6024ce161c2e1e4ee986da9311e6e7fa4199c9886
Instruction ID: 7050d2a8b1c6a7460b8bdfee65435e740a6c81a87d8e1d1dc8a0103b65f57287
Opcode Fuzzy Hash: 87db68c5598009cc7f1a48d6024ce161c2e1e4ee986da9311e6e7fa4199c9886
Instruction Fuzzy Hash: 37916A71A4021CBBDB10CBE8DC89FFE7B7CEB18711F104616F616A72D1CA74A9428B60

Uniqueness

Uniqueness Score: -1.00%

Function 00A04320 Relevance: 68.4, APIs: 23, Strings: 16, Instructions: 187registrywindowsleepCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,Global\Exit_5491c4d3-0a5f-4898-bec4-cd906998e306,?,?,?,?,?,009F41F2), ref: 00A0433C
GetLastError.KERNEL32(?,?,?,?,009F41F2), ref: 00A04348

Part of subcall function 009F2740: new.LIBCMT ref: 009F2772

SetEvent.KERNEL32(00000000,?,?,?,?,009F41F2), ref: 00A04371
CloseHandle.KERNEL32(00000000,?,?,?,?,009F41F2), ref: 00A04378
RegisterWindowMessageW.USER32(UWM_END_WINDOW_MSG_86A92825_6B57_423E_AAB1_13C85778886F,?,?,?,?,009F41F2), ref: 00A04383
FindWindowW.USER32(W64StubClss_27b3f5cc,00000000), ref: 00A04392
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A043A5
OpenMutexW.KERNEL32(00100000,00000000,APP_5491c4d3-0a5f-4898-bec4-cd906998e306,750292F0,?,?,?,?,?,?,009F41F2), ref: 00A043CC
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,009F41F2), ref: 00A043F1
Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,009F41F2), ref: 00A043F8
RegGetValueW.ADVAPI32(80000002,SOFTWARE\Classes\CLSID\{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}\MiscStatus\1,PID,00000010,00000000,FFFFFFFF,?), ref: 00A04454
OpenProcess.KERNEL32(00000001,00000000,FFFFFFFF), ref: 00A04481
TerminateProcess.KERNEL32(00000000,00000000), ref: 00A04490
GetLastError.KERNEL32 ref: 00A04498
CloseHandle.KERNEL32(?), ref: 00A044B5
GetWindowThreadProcessId.USER32(?,FFFFFFFF), ref: 00A044E9

Strings

Cannot create mutex. The process might have been dead, Error %d. break, xrefs: 00A04413
Waiting for process to die, xrefs: 00A043AB
terminate result: %d, err: %d, xrefs: 00A044A0
SOFTWARE\Classes\CLSID\{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}\MiscStatus\1, xrefs: 00A0444A
APP_5491c4d3-0a5f-4898-bec4-cd906998e306, xrefs: 00A043C0
Get reg value: %d, pid: %d, xrefs: 00A04460
Global\Exit_5491c4d3-0a5f-4898-bec4-cd906998e306, xrefs: 00A04331
cannot initialized app exit event (%d), xrefs: 00A0434F
The process is still running, continue waiting, xrefs: 00A043D8
terminate 2, err: %d, xrefs: 00A0454E
terminate 2 result: %d, err: %d, xrefs: 00A0451F
uninstall_util, xrefs: 00A04354, 00A043B0, 00A043DD, 00A04418, 00A04465, 00A044A5, 00A044C5, 00A04524, 00A04553
W64StubClss_27b3f5cc, xrefs: 00A0438B
UWM_END_WINDOW_MSG_86A92825_6B57_423E_AAB1_13C85778886F, xrefs: 00A0437E
PID, xrefs: 00A04445
Open process error: %d, xrefs: 00A044C0

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: CloseHandleProcessWindow$ErrorEventLastMessageOpen$CreateFindMutexPostRegisterSleepTerminateThreadValue
String ID: APP_5491c4d3-0a5f-4898-bec4-cd906998e306$Cannot create mutex. The process might have been dead, Error %d. break$Get reg value: %d, pid: %d$Global\Exit_5491c4d3-0a5f-4898-bec4-cd906998e306$Open process error: %d$PID$SOFTWARE\Classes\CLSID\{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}\MiscStatus\1$The process is still running, continue waiting$UWM_END_WINDOW_MSG_86A92825_6B57_423E_AAB1_13C85778886F$W64StubClss_27b3f5cc$Waiting for process to die$cannot initialized app exit event (%d)$terminate 2 result: %d, err: %d$terminate 2, err: %d$terminate result: %d, err: %d$uninstall_util
API String ID: 736561401-2473979389
Opcode ID: 3140a6d7ca8ac2e87b270bb22894ee4fb3daba24e9451a492384e5416acbb6e1
Instruction ID: fd0bb38320060716ddd16ff6bc9d196649eda6b40f7d3ad1609c9d434cf76b44
Opcode Fuzzy Hash: 3140a6d7ca8ac2e87b270bb22894ee4fb3daba24e9451a492384e5416acbb6e1
Instruction Fuzzy Hash: 2B517A75A8030D7FD710ABE4AC0AFEF7768FB58711F000554FA05A61D1DAB1A96287A2

Uniqueness

Uniqueness Score: -1.00%

Function 009FAB80 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 386fileCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,6D285D9C,?,?,?,?,00A07678,000000FF), ref: 009FAC64
GetFileAttributesA.KERNEL32(00000000,00000000,00000000,000000FF,?,00000000,000000FF), ref: 009FAD2E
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00A11B2C,00A0A704), ref: 009FAD78
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,00000000), ref: 009FADDC
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 009FADE3
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,000000FF), ref: 009FAE52
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00A11B2C,?,?,?,?,?,000000FF), ref: 009FAFB0
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 009FAFD1
_wsplitpath_s.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,00000000,00000000,00000000,?,00000104,?,00000100), ref: 009FAFFE
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000105,?), ref: 009FB017
GetCurrentProcessId.KERNEL32(DEBUG,?), ref: 009FB08E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,00000000,?,?,?,?,?,?,?,?,?), ref: 009FB0F4
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,?), ref: 009FB0FB

Strings

ERROR, xrefs: 009FB07A
%s %s [%d] <%s> [%s]: %s, xrefs: 009FB097
DEBUG, xrefs: 009FB085, 009FB08D
windows_hook_helper, xrefs: 009FAC03
%s Continue on next file -->, xrefs: 009FAD9B
windows_hook_manager, xrefs: 009FABB7

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: File_stat64i32fclosefopenfwrite$AttributesCurrentModuleNameProcess_wsplitpath_swcscat_s
String ID: %s Continue on next file -->$%s %s [%d] <%s> [%s]: %s$DEBUG$ERROR$windows_hook_helper$windows_hook_manager
API String ID: 3352214153-4226532283
Opcode ID: b37b318307de708a243b74625ed502f744753ce7b7800de4d0c327b508f3874d
Instruction ID: b9c91d4e85ddb3abed0d4011d9ebdec2b55485af8635614dd73737a5f17fa65f
Opcode Fuzzy Hash: b37b318307de708a243b74625ed502f744753ce7b7800de4d0c327b508f3874d
Instruction Fuzzy Hash: DCF1BF7191421CDBCB24EF54CC95BFAB7B9AF14301F4401DAE60AA7182DB719E85CF62

Uniqueness

Uniqueness Score: -1.00%

Function 009FB930 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 00A046B0: memset.VCRUNTIME140(?,00000000,00000228,6D285D9C,?,00000000), ref: 00A0472B
Part of subcall function 00A046B0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A04741
Part of subcall function 00A046B0: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00A0475E

Part of subcall function 009F5B30: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B40
Part of subcall function 009F5B30: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B54
Part of subcall function 009F5B30: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B61
Part of subcall function 009F5B30: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B6E
Part of subcall function 009F5B30: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009F60EC,?,?,?), ref: 009F5B79

ProcessIdToSessionId.KERNEL32(?,?,winlogon.exe,0000000C,6D285D9C,?,00000000), ref: 009FBA01
OpenProcess.KERNEL32(00000440,00000000,?,winlogon.exe,0000000C,6D285D9C,?,00000000), ref: 009FBA2F
OpenProcessToken.ADVAPI32(00000000,0000000B,?), ref: 009FBA55
DuplicateTokenEx.ADVAPI32(00000000,02000000,00000000,00000001,00000001,00000000), ref: 009FBA71
CloseHandle.KERNEL32(00000000), ref: 009FBA84
GetLastError.KERNEL32 ref: 009FBA8C
CloseHandle.KERNEL32(00000000), ref: 009FBAA8
GetLastError.KERNEL32 ref: 009FBAB0

Part of subcall function 009F2740: new.LIBCMT ref: 009F2772

CloseHandle.KERNEL32(00000000), ref: 009FBACA
GetLastError.KERNEL32 ref: 009FBB07

Strings

launcher, xrefs: 009FB9D4, 009FBA98, 009FBABC, 009FBB13
dup fail: %d, xrefs: 009FBA93
open token: %d, xrefs: 009FBAB7
open wlo: %d, xrefs: 009FBB0E
no wlo process, xrefs: 009FB9CF
winlogon.exe, xrefs: 009FB976

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorHandleLastProcess$OpenToken$CreateDuplicateFirstProcess32SessionSnapshotToolhelp32memset
String ID: dup fail: %d$launcher$no wlo process$open token: %d$open wlo: %d$winlogon.exe
API String ID: 2588391989-2633422826
Opcode ID: daa64ef10e361f998371250946a96065634bedfb6407dbb70ced615ca84a0b3f
Instruction ID: 07d745cf35046f1677121f879206fd899da3accd586fea8cca70c3424c2bbafc
Opcode Fuzzy Hash: daa64ef10e361f998371250946a96065634bedfb6407dbb70ced615ca84a0b3f
Instruction Fuzzy Hash: FE5136B5E4421DABDB10EFE5DC45BEEBBB8FF18700F200515FA01A6290E774A9418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 009FA280 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 373COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position), ref: 009FA298
?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?), ref: 009FA2B2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?), ref: 009FA2F3
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?), ref: 009FA31A
memcpy.VCRUNTIME140(?,?,?,?,?), ref: 009FA37D
memcpy.VCRUNTIME140(?,?,?,?,?), ref: 009FA3D5
memcpy.VCRUNTIME140(?,?,?,?,?), ref: 009FA40C
memcpy.VCRUNTIME140(?,?,?,?,?), ref: 009FA449
memcpy.VCRUNTIME140(?,?,?,?,?), ref: 009FA48C

Strings

invalid string position, xrefs: 009FA293, 009FA2AD
string too long, xrefs: 009FA2EE, 009FA315

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: memcpy$Xlength_error@std@@Xout_of_range@std@@
String ID: invalid string position$string too long
API String ID: 2456977010-4289949731
Opcode ID: 8041127c39b1fd28b93d4e64d75f6ded8aad153d271571c1a43983b3f05131c8
Instruction ID: 3b20e13eec9086e34907fa59a0c8ab37ccdc81da90a8d3fed9acb6bbc9d76177
Opcode Fuzzy Hash: 8041127c39b1fd28b93d4e64d75f6ded8aad153d271571c1a43983b3f05131c8
Instruction Fuzzy Hash: 6DE12CB160020EDFCB24CF58D9C48AEB7B6FF947057244929E94ACB210DB74E956CF92

Uniqueness

Uniqueness Score: -1.00%

Function 009F9780 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 009F97C8
GetLastError.KERNEL32 ref: 009F97D2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 009F97E1
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,?,?,00000000), ref: 009F97FD
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 009F9808
memset.VCRUNTIME140(?,00000000,00000202), ref: 009F9834
memset.VCRUNTIME140(?,00000000,00000202,?,00000000,00000202), ref: 009F9848
LookupAccountSidW.ADVAPI32(00000000,00000000,?,?,?,?,?), ref: 009F9870
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,00000000,?,?,?,?,00000000,75922EE0,00000000), ref: 009F98EF

Strings

fxstd::fxwshelper, xrefs: 009F987F
lookup, xrefs: 009F987A

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: InformationTokenfreememset$AccountErrorLastLookupmalloc
String ID: fxstd::fxwshelper$lookup
API String ID: 2804162339-3573435284
Opcode ID: eb1e9bd4e09790ffdd84af6cf199e0db8e798f7f88316d8f5fe25f6491f430bb
Instruction ID: 908eaab1a565404a21f2b069b0837b2371f4dea923fc84ff431d1cd2a9a4ca37
Opcode Fuzzy Hash: eb1e9bd4e09790ffdd84af6cf199e0db8e798f7f88316d8f5fe25f6491f430bb
Instruction Fuzzy Hash: F4418F72508308AFD720EFA4DC85FABB7ECEF89754F404929F649C2151DB3099458B92

Uniqueness

Uniqueness Score: -1.00%

Function 009F9910 Relevance: 16.7, APIs: 11, Instructions: 184processCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000228,6D285D9C,00000002,00000000,00000000), ref: 009F995C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 009F9971
Process32FirstW.KERNEL32(00000000,0000022C), ref: 009F998E
ProcessIdToSessionId.KERNEL32(?,00000007), ref: 009F99DA
OpenProcess.KERNEL32(00000400,00000000,?), ref: 009F99FE
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 009F9A22
CloseHandle.KERNEL32(00000000), ref: 009F9A2D
CloseHandle.KERNEL32(00000000), ref: 009F9A51
CloseHandle.KERNEL32(00000000), ref: 009F9A58
Process32NextW.KERNEL32(?,0000022C), ref: 009F9B0B
CloseHandle.KERNEL32(?), ref: 009F9B5D

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: CloseHandle$Process$OpenProcess32$CreateFirstNextSessionSnapshotTokenToolhelp32memset
String ID:
API String ID: 4042258717-0
Opcode ID: 6f12429dfb03ac75326080b05d8c2c93c8839904797c487ff50d9f4b6c37e386
Instruction ID: 3efedb1911403a7afc3433c0847151e684c1b3458b20334822ac66453b708f4f
Opcode Fuzzy Hash: 6f12429dfb03ac75326080b05d8c2c93c8839904797c487ff50d9f4b6c37e386
Instruction Fuzzy Hash: AC617E7190421D9FDF10DFA4DC89BBEBBB8FF48308F2041A9E519A7250DB749E068B91

Uniqueness

Uniqueness Score: -1.00%

Function 009F66A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

CreateFontW.GDI32(00000012,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,Calibri), ref: 009F66C9
CreateFontW.GDI32(00000024,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,Calibri), ref: 009F66F2
CreateFontW.GDI32(00000015,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,Calibri), ref: 009F671B
CreateFontW.GDI32(00000017,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,Calibri), ref: 009F6744
CreateFontW.GDI32(00000014,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,Calibri), ref: 009F676D
CreateFontW.GDI32(00000013,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,Calibri), ref: 009F6796
CreateFontW.GDI32(00000020,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,Calibri), ref: 009F67BF
CreateFontW.GDI32(00000014,00000000,00000000,00000000,00000320,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,Calibri), ref: 009F67E8

Strings

Calibri, xrefs: 009F66A1, 009F66CB, 009F66F4, 009F671D, 009F6746, 009F676F, 009F6798, 009F67C1

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: CreateFont
String ID: Calibri
API String ID: 1830492434-1409258342
Opcode ID: 0c9ed3b22ba045bc108782b6c9649edfd112a233d674cfedc2647189d92e04b8
Instruction ID: 3af3fff1a136e493611c0c4ddd204f24ea395590c6cc65a2c240e04fba090379
Opcode Fuzzy Hash: 0c9ed3b22ba045bc108782b6c9649edfd112a233d674cfedc2647189d92e04b8
Instruction Fuzzy Hash: 62215E70BC4718BAF730DBA56E0BF8A2E60A710F50F31581AB3187E2D1D6E574019A8D

Uniqueness

Uniqueness Score: -1.00%

Function 009F4C80 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 009F27D0: new.LIBCMT ref: 009F2802

CloseHandle.KERNEL32(00000000), ref: 009F4D50
ShellExecuteW.SHELL32(00000000,open,iexplore.exe,?,00000000,00000001), ref: 009F4D74

Strings

iexplore.exe, xrefs: 009F4D68
open, xrefs: 009F4D6D
%s exit }, xrefs: 009F4D7F
cmd.exe, xrefs: 009F4D30
antivirus_detector, xrefs: 009F4CB2, 009F4D84
openUrl, xrefs: 009F4CA8, 009F4D7A
%s enter {, xrefs: 009F4CAD

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: CloseExecuteHandleShell
String ID: %s enter {$%s exit }$antivirus_detector$cmd.exe$iexplore.exe$open$openUrl
API String ID: 283469938-2367522800
Opcode ID: fd0cf41fd31133a728615882add349c64497de97a5d8dd5cc7af7a970c3ca994
Instruction ID: 2b6d2e37caca5ec74914e53582e07f5ffeaad0aedd0806a9f653e1c0fe34f75d
Opcode Fuzzy Hash: fd0cf41fd31133a728615882add349c64497de97a5d8dd5cc7af7a970c3ca994
Instruction Fuzzy Hash: 5241C170A0430CEFDF04DFA4D906BBE7BB4FB05708F104519F915AA2C1D7B5AA058BA2

Uniqueness

Uniqueness Score: -1.00%

Function 009F2B00 Relevance: 15.3, APIs: 10, Instructions: 297stringCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,00A0A5E1,00000000,6D285D9C), ref: 009F2B7D
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009F2BAC

Part of subcall function 009FD0A0: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,750292F0,?,?,?,009F2BBF), ref: 009FD0AA
Part of subcall function 009FD0A0: new.LIBCMT ref: 009FD0BB

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 009F2BE9
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 009F2D7A
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00A0A618), ref: 009F2DAA
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 009F2DBA
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00A0A618), ref: 009F2DCB
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 009F2DD5
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00A0A618), ref: 009F2DE6
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 009F2DF0

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: atoistrtok$_stat64i32memset$fopen
String ID:
API String ID: 2401252192-0
Opcode ID: 3a5acc173f536f4e6d795f56c6b84fd79d059610247df5fe57c1f38a45162806
Instruction ID: 0121f1cc2bab734ec503b9fa38bfdc9e2ed44738073d8c6c1cc20772dcd86ab2
Opcode Fuzzy Hash: 3a5acc173f536f4e6d795f56c6b84fd79d059610247df5fe57c1f38a45162806
Instruction Fuzzy Hash: 44B1B070E0024C9FEF04DFA8D845BFEBBB9EF45304F644158E915AB282D775AA05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009FA060 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position), ref: 009FA0D1
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long), ref: 009FA0F6
memcpy.VCRUNTIME140(?,?,?), ref: 009FA14B
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long), ref: 009FA17C

Strings

invalid string position, xrefs: 009FA0CC
string too long, xrefs: 009FA0F1, 009FA177

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@$Xout_of_range@std@@memcpy
String ID: invalid string position$string too long
API String ID: 369118076-4289949731
Opcode ID: d6d712b65605aa03b124af00d361c5383572bb6c144c8d0c1e11bcfd05a5a763
Instruction ID: 665427f239efd0732fedb8b1133527b48358213a80c5ff5273a46d9a7be7b526
Opcode Fuzzy Hash: d6d712b65605aa03b124af00d361c5383572bb6c144c8d0c1e11bcfd05a5a763
Instruction Fuzzy Hash: 9D71517170420D9FCB24CF5CE8808BAB7BAFF99311B14492EEA5AC7250DB31D955CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A05650 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,00000000,?,?,00A050EB,00000000,?), ref: 00A0567E
GetProcAddress.KERNEL32(00000000,NtWow64QueryInformationProcess64), ref: 00A0569F
GetProcAddress.KERNEL32(00000000,NtWow64ReadVirtualMemory64), ref: 00A056B9
GetProcAddress.KERNEL32(00000000,NtQueryInformationProcess), ref: 00A056D3

Strings

NtQueryInformationProcess, xrefs: 00A056CD
ntdll.dll, xrefs: 00A05679
NtWow64ReadVirtualMemory64, xrefs: 00A056B3
NtWow64QueryInformationProcess64, xrefs: 00A05699

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: NtQueryInformationProcess$NtWow64QueryInformationProcess64$NtWow64ReadVirtualMemory64$ntdll.dll
API String ID: 667068680-1418883184
Opcode ID: 5d34e082b8526e359a9eb54c7227a0b9636f418823754d59e9a1dfd449d4d7e7
Instruction ID: 5e5196a42403158ca07655f77a7dd30ad72f167429add4814f792548e30f6704
Opcode Fuzzy Hash: 5d34e082b8526e359a9eb54c7227a0b9636f418823754d59e9a1dfd449d4d7e7
Instruction Fuzzy Hash: 3301B530D45B1DAACB21DBB5BC447DB72A8EB50362F585826D000950E0FF768983CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 00A045C0 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 25sleepCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,Global\KNIT_NFS_EXIT_CD1DF70D-8191-4840-B884-76C2620B8ED3,?,009F41F7), ref: 00A045CC
GetLastError.KERNEL32 ref: 00A045D8

Part of subcall function 009F2740: new.LIBCMT ref: 009F2772

SetEvent.KERNEL32(00000000), ref: 00A045F4
Sleep.KERNEL32(000001F4), ref: 00A045FF
CloseHandle.KERNEL32(00000000), ref: 00A04606

Strings

uninstall_util, xrefs: 00A045E4
cannot initialize network exit event (%d), xrefs: 00A045DF
Global\KNIT_NFS_EXIT_CD1DF70D-8191-4840-B884-76C2620B8ED3, xrefs: 00A045C1

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Event$CloseCreateErrorHandleLastSleep
String ID: Global\KNIT_NFS_EXIT_CD1DF70D-8191-4840-B884-76C2620B8ED3$cannot initialize network exit event (%d)$uninstall_util
API String ID: 3653494817-796478995
Opcode ID: d98fb4573a0e7ff0188515b87bbe10abdd4a71ac671f02472721dfb99b67e256
Instruction ID: a64d72048a9dde335677fdb5d77db48395256bb17f9b03a1861549a61718bd89
Opcode Fuzzy Hash: d98fb4573a0e7ff0188515b87bbe10abdd4a71ac671f02472721dfb99b67e256
Instruction Fuzzy Hash: F8E086725C13257FD661B7E47C0FFDE3A14BF28B52F000200F601540D0869058D347A7

Uniqueness

Uniqueness Score: -1.00%

Function 00A04570 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 25sleepCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a,?,009F41ED), ref: 00A0457C
GetLastError.KERNEL32 ref: 00A04588

Part of subcall function 009F2740: new.LIBCMT ref: 009F2772

SetEvent.KERNEL32(00000000), ref: 00A045A4
Sleep.KERNEL32(000001F4), ref: 00A045AF
CloseHandle.KERNEL32(00000000), ref: 00A045B6

Strings

Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a, xrefs: 00A04571
cannot initialized app exit event (%d), xrefs: 00A0458F
uninstall_util, xrefs: 00A04594

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Event$CloseCreateErrorHandleLastSleep
String ID: Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a$cannot initialized app exit event (%d)$uninstall_util
API String ID: 3653494817-1173659242
Opcode ID: 90eef08dc95be3e8208754676fbaa80d19ba811237e2c289cb5331f5efc8a26a
Instruction ID: 8c8de2631434255b4ea1eb294c76942fc4c4f717930925a8a63a079e9f9c6cd7
Opcode Fuzzy Hash: 90eef08dc95be3e8208754676fbaa80d19ba811237e2c289cb5331f5efc8a26a
Instruction Fuzzy Hash: 77E08C72AC1329BBD621B7E47C0FFDF3A15BB28B22F000200FA01940E08A94599387A3

Uniqueness

Uniqueness Score: -1.00%

Function 009F46B0 Relevance: 13.6, APIs: 9, Instructions: 84COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 009F46CF
GdipGetImageWidth.GDIPLUS(?,?,?,?), ref: 009F46E3
GdipGetImageHeight.GDIPLUS(?,00000000,?,?), ref: 009F4709
GetDC.USER32(?), ref: 009F4724
GdipCreateFromHDC.GDIPLUS(00000000,?,?,?), ref: 009F4736
GdipGetImageHeight.GDIPLUS(?,00000000,?,?), ref: 009F474A
GdipGetImageWidth.GDIPLUS(?,?,?,?), ref: 009F476B
GdipDrawImageRectI.GDIPLUS(00000000,?,?,?,00000000,?,?,?), ref: 009F4787
GdipDeleteGraphics.GDIPLUS(00000000,?,?), ref: 009F478E

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Gdip$Image$HeightRectWidth$CreateDeleteDrawFromGraphicsWindow
String ID:
API String ID: 2886385483-0
Opcode ID: d36351db512d4ca4d100c54eb74adda1f29311d7b02f635d52b3673df034e117
Instruction ID: ac015d7514903a79f39dc3c7aa2c2b5c2b45222fc127348391dc0bf386fe948f
Opcode Fuzzy Hash: d36351db512d4ca4d100c54eb74adda1f29311d7b02f635d52b3673df034e117
Instruction Fuzzy Hash: B931C27590030DAFDB10DFE8DD88AAEBBB8FB09300F108159E916A7250DB34A946CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A02AE0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a,750292F0,?,?,009F41D1), ref: 00A02AF5
SetEvent.KERNEL32(00000000,?,009F41D1), ref: 00A02B02
CloseHandle.KERNEL32(00000000,?,009F41D1), ref: 00A02B09
GetLastError.KERNEL32(?,009F41D1), ref: 00A02B11

Strings

Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a, xrefs: 00A02AE8
cannot initialized app exit event (%d), xrefs: 00A02B18
stealth_manager, xrefs: 00A02B1D

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Event$CloseCreateErrorHandleLast
String ID: Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a$cannot initialized app exit event (%d)$stealth_manager
API String ID: 2055590504-372883222
Opcode ID: a76beb034bff3ac3135115f8a62e37dfb44b48a6305bedc0c6b15551a4a2bf46
Instruction ID: abc14dd930f8075de3a270b2bf86c7090d6c3d52d5831b2395fbe3c02c00d60e
Opcode Fuzzy Hash: a76beb034bff3ac3135115f8a62e37dfb44b48a6305bedc0c6b15551a4a2bf46
Instruction Fuzzy Hash: 72F08232F8031873C11077A97C1FF9E3A1C9B56B12F040611FD059A1D2E995995243E3

Uniqueness

Uniqueness Score: -1.00%

Function 009F68C0 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(310A0DBA), ref: 009F68D1
DeleteObject.GDI32(4C0A0DAC), ref: 009F68E7
DeleteObject.GDI32(1F0A0D8A), ref: 009F68FD
DeleteObject.GDI32(F10A0D71), ref: 009F6913
DeleteObject.GDI32(090A0DB4), ref: 009F6929
DeleteObject.GDI32(0F0A0DA4), ref: 009F693F
DeleteObject.GDI32(5A0A0DAB), ref: 009F6955
DeleteObject.GDI32(500A0DA9), ref: 009F696B

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: fa1dc4235d8c0b3a085553f20659eca364ce8809977de998bffb6851ecd7e1e2
Instruction ID: cfc62d0ba796bd2f64a40d3ac6611b513b19f017852d8d6f170b89d6077198cd
Opcode Fuzzy Hash: fa1dc4235d8c0b3a085553f20659eca364ce8809977de998bffb6851ecd7e1e2
Instruction Fuzzy Hash: CA112EB0B14B199BDB10DFBDED44B9A3BFCAB10740F04905AA514D7290DBB8D8428BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A058B6 Relevance: 12.1, APIs: 8, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 00A058D4
MultiByteToWideChar.KERNEL32(00000000,00000000,009F25D5,?,00000000,00000000,?,00A0639C,00A15098,000000FE,?,009F25D5), ref: 00A058E3
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00A0639C,00A15098,000000FE,?,009F25D5), ref: 00A058F6
GetLastError.KERNEL32(?,00A0639C,00A15098,000000FE,?,009F25D5), ref: 00A058FE
_com_issue_error.COMSUPP ref: 00A05911
SysAllocString.OLEAUT32(00000000), ref: 00A05917
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,00A0639C,00A15098,000000FE,?,009F25D5), ref: 00A05928
_com_issue_error.COMSUPP ref: 00A05939

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _com_issue_error$free$AllocByteCharErrorLastMultiStringWide
String ID:
API String ID: 2419198754-0
Opcode ID: df74a5079b07d09b966773c4d027c3e12f67c4808f1cdde163fd8b79d17f2d84
Instruction ID: 5fef32fcd04d127ef7d9ef9a1871e0214edcabd0d969f0b3469cfc00a4b3093c
Opcode Fuzzy Hash: df74a5079b07d09b966773c4d027c3e12f67c4808f1cdde163fd8b79d17f2d84
Instruction Fuzzy Hash: 1D11E571F0061CEBDB20ABB4ED49B9F7768EF58360F000129F905B72C0D63998518BA6

Uniqueness

Uniqueness Score: -1.00%

Function 009F5720 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,009F567F,?,?,?,?,?,?,009F11F1,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/,00000040), ref: 009F573A

Part of subcall function 009F5F30: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,009F5793,00000000,?,?,?,?,?,009F567F,?,?,?), ref: 009F5F46

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,009F567F,?,?,?,?,?,?,009F11F1,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/,00000040), ref: 009F575B

Strings

invalid string position, xrefs: 009F5735, 009F5756
string too long, xrefs: 009F57A1

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position$string too long
API String ID: 1960685668-4289949731
Opcode ID: f6791fbb6607448a758c99f60216b27a22ecc3d832c183d84bf162bdc6521439
Instruction ID: ca5f3e5f63cc042486368508a05a3979d1fc98fb606b9d066c7b37e0697583c4
Opcode Fuzzy Hash: f6791fbb6607448a758c99f60216b27a22ecc3d832c183d84bf162bdc6521439
Instruction Fuzzy Hash: B9319332304B18CBD720AE5CE840B6AF7A9EBA5B61F11092EE746C7241D771984187E5

Uniqueness

Uniqueness Score: -1.00%

Function 009F5340 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,009F5290,?,?,?,?,?,?,009F1132,1.3.1,00000005), ref: 009F535A
?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,009F5290,?,?,?,?,?,?,009F1132,1.3.1,00000005), ref: 009F537B
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,009F5290,?,?,?,?,?,?,009F1132,1.3.1,00000005), ref: 009F53B5
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,009F5290,?,?,?,?,?,?,009F1132,1.3.1), ref: 009F541E

Strings

invalid string position, xrefs: 009F5355, 009F5376
string too long, xrefs: 009F53B0

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xout_of_range@std@@$Xlength_error@std@@memcpy
String ID: invalid string position$string too long
API String ID: 3790025958-4289949731
Opcode ID: c5bfadf614208fb7bbfd9cbc18f80ee92d703a0ea58442a70656249837a53230
Instruction ID: 09b428e79eb4352b10d35a17a54a9b47dbd02fc1ad96e66529b83e0ff08ebcea
Opcode Fuzzy Hash: c5bfadf614208fb7bbfd9cbc18f80ee92d703a0ea58442a70656249837a53230
Instruction Fuzzy Hash: 18319332304B19DBC7249F5CE88082AF7E9FF947563120A2EE746C7250DBB19855CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 009F5D10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,00000058,00000040,00000000,?,00A00CB8,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\,00000017), ref: 009F5D2A
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000058,00000040,00000000,?,00A00CB8,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\,00000017), ref: 009F5D4D
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000058,00000040,00000000,?,00A00CB8,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\,00000017), ref: 009F5D6B
memcpy.VCRUNTIME140(?,?,?,00000058,00000040,00000000,?,00A00CB8,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\,00000017), ref: 009F5DDB

Strings

invalid string position, xrefs: 009F5D25
string too long, xrefs: 009F5D48, 009F5D66

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@$Xout_of_range@std@@memcpy
String ID: invalid string position$string too long
API String ID: 369118076-4289949731
Opcode ID: 5769ef65971bd32ebfea0c2f0d8b47d2f8e5b3b7c4e0b89531bb94150338b1b1
Instruction ID: eefbb76d26080a153df594955033428045f16424b9c42fac4b95dbb84ae2fb3a
Opcode Fuzzy Hash: 5769ef65971bd32ebfea0c2f0d8b47d2f8e5b3b7c4e0b89531bb94150338b1b1
Instruction Fuzzy Hash: 5D31A1323067099FCB28DF9CE88496AB3E9FF94711312092EE756C7290D731E915CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 009F5960 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,00000000,?,?,009F589F,00000000,?,?,?,00A17720,?,009FD43B,\*.*,00000004,00000000), ref: 009F597A
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,00000000,?,?,009F589F,00000000,?,?,?,00A17720,?,009FD43B,\*.*,00000004,00000000), ref: 009F599D
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,00000000,?,?,009F589F,00000000,?,?,?,00A17720,?,009FD43B,\*.*,00000004,00000000), ref: 009F59B8
memcpy.VCRUNTIME140(?,?,6D285D9C,?,00000000,?,?,009F589F,00000000,?,?,?,00A17720,?,009FD43B,\*.*), ref: 009F5A1F

Strings

invalid string position, xrefs: 009F5975
string too long, xrefs: 009F5998, 009F59B3

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@$Xout_of_range@std@@memcpy
String ID: invalid string position$string too long
API String ID: 369118076-4289949731
Opcode ID: 00a2a64c771896a3f3b730ec4e6ebe26be0b85669b3e2a48b491b630aa6579ae
Instruction ID: 60b56e8474ffc9d052fd6e26fd9d650afb024977eb6b1e4258da702d00e4053e
Opcode Fuzzy Hash: 00a2a64c771896a3f3b730ec4e6ebe26be0b85669b3e2a48b491b630aa6579ae
Instruction Fuzzy Hash: 9C31C731300709DFDB28CF5CE880A2AB7A5EF95721B510A2EE756C7241C3B1DC5087A5

Uniqueness

Uniqueness Score: -1.00%

Function 009F9F30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

WTSEnumerateSessionsA.WTSAPI32(00000000,00000000,00000001,?,?,00000000), ref: 009F9F52
WTSFreeMemory.WTSAPI32(?), ref: 009F9F79
GetLastError.KERNEL32 ref: 009F9F95

Strings

CANNOT FIND REAL SESSION # GOT : %d, xrefs: 009F9FB0
fxstd::fxwshelper, xrefs: 009F9FA1, 009F9FB5
GET SESSION ERROR : %d, xrefs: 009F9F9C

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: EnumerateErrorFreeLastMemorySessions
String ID: CANNOT FIND REAL SESSION # GOT : %d$GET SESSION ERROR : %d$fxstd::fxwshelper
API String ID: 1558365644-4019733835
Opcode ID: 6015e21f734dc8b33a40033d4e5e24dc084ff14f3d7a8783418a119bd1338cd1
Instruction ID: a887f58d22ca7bc8ea8e714a95cac17c427a06cacbaccd2fb95f2a29a2e507d2
Opcode Fuzzy Hash: 6015e21f734dc8b33a40033d4e5e24dc084ff14f3d7a8783418a119bd1338cd1
Instruction Fuzzy Hash: 25118231B4520CBBCB04EBA89C46BFE776CEF45761F104268FA16E72D4DA316D468781

Uniqueness

Uniqueness Score: -1.00%

Function 009FB1C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,6D285D9C,00000000,?), ref: 009FB204
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,00000000,000000FF), ref: 009FB353
wcsnlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104), ref: 009FB368
rename.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 009FB3D9

Part of subcall function 009F5B90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BA3
Part of subcall function 009F5B90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BB0
Part of subcall function 009F5B90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BBD
Part of subcall function 009F5B90: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BC8

Strings

_%d, xrefs: 009FB2DA

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$_stat64i32_wstat64i32renamewcsnlen
String ID: _%d
API String ID: 1077365053-982369593
Opcode ID: 34dc672bd31cbdb63800dbd931e150c2cf9896a34e55b174cf95aff40fca1b61
Instruction ID: 8654c5dc8bfba3ea24d7b6cb80b4c4e1d5a72c0ded155084cba766ab68902384
Opcode Fuzzy Hash: 34dc672bd31cbdb63800dbd931e150c2cf9896a34e55b174cf95aff40fca1b61
Instruction Fuzzy Hash: 7881387091422C9BDB24DF14CC99BEAB7B8FF14304F5006E9E519A21A1DB756F89CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 009F2610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

new.LIBCMT ref: 009F2639

Part of subcall function 00A05B51: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,009F608A,?,6D285D9C,?,?,?), ref: 00A05B78

SysAllocString.OLEAUT32(ROOT\SecurityCenter2), ref: 009F2672
_com_issue_error.COMSUPP ref: 009F2683
_com_issue_error.COMSUPP ref: 009F269C

Strings

ROOT\SecurityCenter2, xrefs: 009F265F

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _com_issue_error$AllocStringmalloc
String ID: ROOT\SecurityCenter2
API String ID: 2559737271-2110076786
Opcode ID: 57955bdfbaeef092bd91ad75d3a6c7e88d30ff93756ff8f7ad16b94304b29f94
Instruction ID: 0d579022c248905b8858fcc9160bd80af6908cabae741a7a53698a54c63221d2
Opcode Fuzzy Hash: 57955bdfbaeef092bd91ad75d3a6c7e88d30ff93756ff8f7ad16b94304b29f94
Instruction Fuzzy Hash: 78118E72D0175AEBD3208F64D905B5AB7E8EB54B20F20471BE954A7380E7B5A8408B90

Uniqueness

Uniqueness Score: -1.00%

Function 009FC040 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,3FFFFFFF,?,?,009FBFD9,?,?,?,?,009FBF28,?), ref: 009FC05C
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,3FFFFFFF,?,?,009FBFD9,?,?,?,?,009FBF28,?), ref: 009FC077
new.LIBCMT ref: 009FC07E
memcpy.VCRUNTIME140(00000000,?,?), ref: 009FC0A6

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xbad_alloc@std@@$memcpy
String ID:
API String ID: 3627194217-0
Opcode ID: 936b88a34ea859faffac7972405a5aa3b8cf57053c5cb9eac49ee28af03b6801
Instruction ID: 3698249952dd050c0d2bbafdf2c3d6b8319b12b39e1e98c725a84d56fafd9e82
Opcode Fuzzy Hash: 936b88a34ea859faffac7972405a5aa3b8cf57053c5cb9eac49ee28af03b6801
Instruction Fuzzy Hash: 8111A2B190060AAFCB18DF68DA8197AB768FB44300B144629EA09C3250EB31E916CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009FB6A0 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FB56C,?), ref: 009FB6B0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FB56C,?), ref: 009FB6C8
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FB56C,?), ref: 009FB6D5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FB56C,?), ref: 009FB6E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FB56C,?), ref: 009FB6ED

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 767965a82a1a82f17270d2a7105855317e02898934f18ec931dbf94b755eddb7
Instruction ID: ca23e66e4e699c1d59f81a97da30d5415f5cba62d1486084bb8fcad79de1f8e8
Opcode Fuzzy Hash: 767965a82a1a82f17270d2a7105855317e02898934f18ec931dbf94b755eddb7
Instruction Fuzzy Hash: 65F0543051020E4BD704FFA8D5AC6FD77A9AB1C321B000036EA07C5120DB27E8C28F16

Uniqueness

Uniqueness Score: -1.00%

Function 009F95F0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00A04ED7,?,?,?,?,?,?,?,00000000,000000FF,?), ref: 009F9600
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00A04ED7,?,?,?,?,?,?,?,00000000,000000FF,?), ref: 009F9615
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00A04ED7,?,?,?,?,?,?,?,00000000,000000FF,?), ref: 009F9622
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00A04ED7,?,?,?,?,?,?,?,00000000,000000FF,?), ref: 009F962F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00A04ED7,?,?,?,?,?,?,?,00000000,000000FF,?), ref: 009F963A

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 473a2853cf6050de9f09c1b6689e85741a273d29db5c210d922b88be30b997f7
Instruction ID: 2eae384d41adb5b40571d1aed165bff5f7887cd64017936a1e9bf04a9e9469ee
Opcode Fuzzy Hash: 473a2853cf6050de9f09c1b6689e85741a273d29db5c210d922b88be30b997f7
Instruction Fuzzy Hash: 15F0123050020E4BDB08FBF4AAAD6FD776D9B68355B104436EA17C6260D62798C28E16

Uniqueness

Uniqueness Score: -1.00%

Function 009FBFE0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FBD97,?,?,?,?,?,00A07800,000000FF,?,009FBCEB), ref: 009FBFF0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FBD97,?,?,?,?,?,00A07800,000000FF,?,009FBCEB), ref: 009FC005
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FBD97,?,?,?,?,?,00A07800,000000FF,?,009FBCEB), ref: 009FC012
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FBD97,?,?,?,?,?,00A07800,000000FF,?,009FBCEB), ref: 009FC01F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,009FBD97,?,?,?,?,?,00A07800,000000FF,?,009FBCEB), ref: 009FC02A

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 9654db17919e5df934c63b615ebd8d5644b0d550e37fac0144e9b3836862a981
Instruction ID: fd02dcdc366b698bf5f7f78912e1ac1cc477dbc1762c59b8ae901a93d58e112f
Opcode Fuzzy Hash: 9654db17919e5df934c63b615ebd8d5644b0d550e37fac0144e9b3836862a981
Instruction Fuzzy Hash: BEF0827051020E8BDB18FBA4AA6C5FE775D9B18351B144526EA17C1260DE279CC78B1A

Uniqueness

Uniqueness Score: -1.00%

Function 009F5840 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,00A17720,?,009FD43B,\*.*,00000004,00000000,00000000,000000FF,00A17720,00A17721,6D285D9C), ref: 009F58B8
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,00A17720,?,009FD43B,\*.*,00000004,00000000,00000000,000000FF,00A17720,00A17721,6D285D9C), ref: 009F58D4
memcpy.VCRUNTIME140(?,?,?,?,?,00A17720,?,009FD43B,\*.*,00000004,00000000,00000000,000000FF,00A17720,00A17721,6D285D9C), ref: 009F592E

Part of subcall function 009F5960: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,00000000,?,?,009F589F,00000000,?,?,?,00A17720,?,009FD43B,\*.*,00000004,00000000), ref: 009F597A
Part of subcall function 009F5960: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,00000000,?,?,009F589F,00000000,?,?,?,00A17720,?,009FD43B,\*.*,00000004,00000000), ref: 009F599D
Part of subcall function 009F5960: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,00000000,?,?,009F589F,00000000,?,?,?,00A17720,?,009FD43B,\*.*,00000004,00000000), ref: 009F59B8
Part of subcall function 009F5960: memcpy.VCRUNTIME140(?,?,6D285D9C,?,00000000,?,?,009F589F,00000000,?,?,?,00A17720,?,009FD43B,\*.*), ref: 009F5A1F

Strings

string too long, xrefs: 009F58B3, 009F58CF

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@$memcpy$Xout_of_range@std@@
String ID: string too long
API String ID: 2402964757-2556327735
Opcode ID: 4634359977161afa41947e50aea945f8f4e66574e55ae40645a22d4972329eb0
Instruction ID: 6ec458cc4c2cb7017dcd89073ba286e1f4c635ef56e8a058517287590c97e0cc
Opcode Fuzzy Hash: 4634359977161afa41947e50aea945f8f4e66574e55ae40645a22d4972329eb0
Instruction Fuzzy Hash: 69312A32300B09DBEB289E5CE88093AF3E9EF95761B61492EE396C7640C3719C4487A0

Uniqueness

Uniqueness Score: -1.00%

Function 009FCDC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,009FC184,?,?,?,?,?,?,00000000,00000000), ref: 009FCDD4
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,009FC184,?,?,?,?,?,?,00000000,00000000), ref: 009FCDE4

Strings

string too long, xrefs: 009FCDCF, 009FCDDF

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: string too long
API String ID: 1004598685-2556327735
Opcode ID: a403c4808a90debb66c225d9d86819422fe3b0f6f8fb7c934a9c2c210d73f633
Instruction ID: 095b2e8c5bcbb1238e3fad855ad51513b7179297102f0ecc478ff1bb325601d7
Opcode Fuzzy Hash: a403c4808a90debb66c225d9d86819422fe3b0f6f8fb7c934a9c2c210d73f633
Instruction Fuzzy Hash: 3321D67230035C9BC7315E5CA50067ABBB9EBA6721F10891EE69687291C7729805C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A04F20 Relevance: 6.1, APIs: 4, Instructions: 131COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000240,00000000,?), ref: 00A04FA3
ReadProcessMemory.KERNEL32(?,00000000,?,00000240,?,00000000,?), ref: 00A04FDA
memset.VCRUNTIME140(?,00000000,00000294), ref: 00A04FF2
ReadProcessMemory.KERNEL32(?,?,?,00000294,?), ref: 00A05025

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: MemoryProcessReadmemset
String ID:
API String ID: 1858673621-0
Opcode ID: d5947f74ef3baba6217e00664e3d9320bfb07acb771c957401afd538ca2ca66e
Instruction ID: 29e9b2690de8cb46318a5b9b5a5e29cb6de14714ed839fee426219b10b4f81dc
Opcode Fuzzy Hash: d5947f74ef3baba6217e00664e3d9320bfb07acb771c957401afd538ca2ca66e
Instruction Fuzzy Hash: 33415071E0060DAEDB20DFA5ED85BAFB7B8EF48340F540569F505A72C1EB70AA458F90

Uniqueness

Uniqueness Score: -1.00%

Function 009F6170 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(6D285D9C,?,?,?), ref: 009F61F8
new.LIBCMT ref: 009F61FF
new.LIBCMT ref: 009F6213
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,009F11F1,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/,00000040), ref: 009F625F

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xbad_alloc@std@@memcpy
String ID:
API String ID: 4293406529-0
Opcode ID: 70c491d89aa360e87b7c8cdb0ebda073a3bd76b630e3f4638991f28b64407dd0
Instruction ID: d3f4687e8424e33e391aa352c82fba4ce0f1b870734d66f930fde2ab578d7f29
Opcode Fuzzy Hash: 70c491d89aa360e87b7c8cdb0ebda073a3bd76b630e3f4638991f28b64407dd0
Instruction Fuzzy Hash: 9931BD71A047099FDB24CF68D980BBAB7E8EB45750F500B2DE962C7381E775E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A04DE0 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(6D285D9C,?,?,?,00000000,000000FF,?,?,?,00000000), ref: 00A04E1F
?_Xbad_alloc@std@@YAXXZ.MSVCP140(6D285D9C,?,?,?,00000000,000000FF,?,?,?,00000000), ref: 00A04E36
new.LIBCMT ref: 00A04E3D

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xbad_alloc@std@@
String ID:
API String ID: 3815834350-0
Opcode ID: 522755d779715c3d41badba75626a0b769f6371731260d1299d461a495b46a91
Instruction ID: 55f2c298947406b32ced983374a4d281bbbea5107c95572677b414973f1d8b14
Opcode Fuzzy Hash: 522755d779715c3d41badba75626a0b769f6371731260d1299d461a495b46a91
Instruction Fuzzy Hash: 7D31C7B2E005099FCB18DF68ED817AEBBB5FB98700F154169E915EB394E730E901C791

Uniqueness

Uniqueness Score: -1.00%

Function 009F6330 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,00A04D0B,?,00000000,?,?,00A05410,?,6D285D9C,00000000,?,00000000,?,00A08608,000000FF), ref: 009F6349
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,00A04D0B,?,00000000,?,?,00A05410,?,6D285D9C,00000000,?,00000000,?,00A08608,000000FF), ref: 009F635F
new.LIBCMT ref: 009F6366

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xbad_alloc@std@@
String ID:
API String ID: 3815834350-0
Opcode ID: d334bd19de9a250b594fb6ff54cfa261ca56bf0595d25779471450c32a05eceb
Instruction ID: 5643cbc19cd5c98edbbc3b12ff458d90ae9f075e66e76f8084d8c182572e9b93
Opcode Fuzzy Hash: d334bd19de9a250b594fb6ff54cfa261ca56bf0595d25779471450c32a05eceb
Instruction Fuzzy Hash: FDF082B2E043084BDB1CEBB8B956A2B769C9B24354714023AF22AC7190F662E854C759

Uniqueness

Uniqueness Score: -1.00%

Function 009F5B90 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BA3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BB0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BBD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 009F5BC8

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 793a552dd69a3d05df72d1d5cdf14a9c2cba8c6ba6f479f13babc02380c6f9c9
Instruction ID: 4577db057f63b863d017a01e90db0158cf2c690aedf1ce53e8cab7b93b22a3d2
Opcode Fuzzy Hash: 793a552dd69a3d05df72d1d5cdf14a9c2cba8c6ba6f479f13babc02380c6f9c9
Instruction Fuzzy Hash: 2FE09230500B0E9BD704FBE4AA6D4BD775DAB24312B404032FB06C5220E636E892CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 009F5620 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,009F11F1,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/,00000040), ref: 009F5693
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,009F11F1,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/,00000040), ref: 009F56E7

Part of subcall function 009F5720: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,009F567F,?,?,?,?,?,?,009F11F1,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/,00000040), ref: 009F573A
Part of subcall function 009F5720: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,009F567F,?,?,?,?,?,?,009F11F1,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/,00000040), ref: 009F575B

Strings

string too long, xrefs: 009F568E

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xout_of_range@std@@$Xlength_error@std@@memcpy
String ID: string too long
API String ID: 3790025958-2556327735
Opcode ID: 1b94b752eaacd0d1d134235c2b81b009b296434298ffb6c2a86360790d7c1ca6
Instruction ID: 3ac20eb9bbd07fa590395940447f38041a1d76b00485f286a08d4a7f515e4555
Opcode Fuzzy Hash: 1b94b752eaacd0d1d134235c2b81b009b296434298ffb6c2a86360790d7c1ca6
Instruction Fuzzy Hash: 4B312B32300B189BD7309E5CE88093AF7E9EFA1725BA1492BF7A1C7640C7719C448BE4

Uniqueness

Uniqueness Score: -1.00%

Function 009F5240 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,009F1132,1.3.1,00000005), ref: 009F52A7
memcpy.VCRUNTIME140(?,?,00000000,?,?,?,?,009F1132,1.3.1,00000005), ref: 009F5302

Strings

string too long, xrefs: 009F52A2

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@memcpy
String ID: string too long
API String ID: 237780522-2556327735
Opcode ID: 9913e587b284e72680b195d9135158dc80bf7d5f35a027e1701ff61d50c4855f
Instruction ID: cf7e78bd7d121186fd446d8a4f45c6152857fbde71d84684ce617101781af7d3
Opcode Fuzzy Hash: 9913e587b284e72680b195d9135158dc80bf7d5f35a027e1701ff61d50c4855f
Instruction Fuzzy Hash: 1F31C632304F199B86249E9CE8808BEF3E9FF957613220A2FE356C7250D721A804C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 009FC440 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,6D285D9C), ref: 009FC4DA

Strings

invalid string position, xrefs: 009FC4D5
, xrefs: 009FC4FC

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: $invalid string position
API String ID: 1960685668-3618421887
Opcode ID: 681bd63b3ef2cd5868bf7f5a334d0253a5948d59f58eb1873b26444ac81722c9
Instruction ID: 43e3c90bdee955fb1d809dbe0a60ae638dea3a4f50f2a3f3e04c9780553e9d4f
Opcode Fuzzy Hash: 681bd63b3ef2cd5868bf7f5a334d0253a5948d59f58eb1873b26444ac81722c9
Instruction Fuzzy Hash: AC31E6B061460C9FDB28DF28CA5977EBBF5EB44710F504A1DF162872C1C774A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009FCB20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,00000000,?,009FC284,?,?,?,?,?,?,00000000,00000000), ref: 009FCB34
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,00000000,?,009FC284,?,?,?,?,?,?,00000000,00000000), ref: 009FCB47

Strings

string too long, xrefs: 009FCB2F, 009FCB42

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: string too long
API String ID: 1004598685-2556327735
Opcode ID: 79e2ec9fa1907f001e16701963772c1ca684b76c9ca54fb18964fccc2b94fb1e
Instruction ID: df340a61e5a8018137044bb44ca50647117400fddb68ffa63f04bd498546f518
Opcode Fuzzy Hash: 79e2ec9fa1907f001e16701963772c1ca684b76c9ca54fb18964fccc2b94fb1e
Instruction Fuzzy Hash: 9521F47931431C97CB245F68E98147AF3A8FF697223208A2FE786C7750D6319814CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A013B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(00000040,00000104,6D285D9C), ref: 00A01405

Strings

\sysnative, xrefs: 00A01483
\system32, xrefs: 00A0148C

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: DirectoryWindows
String ID: \sysnative$\system32
API String ID: 3619848164-3725051112
Opcode ID: 9a64f997d6ce51394bab50ce247f73bea65dc1d881abf50b7298b463c8c8810e
Instruction ID: 070dfb8eee8a447731bb00c9f0586b11270d79f0bf69a0e17cc9770930253eef
Opcode Fuzzy Hash: 9a64f997d6ce51394bab50ce247f73bea65dc1d881abf50b7298b463c8c8810e
Instruction Fuzzy Hash: A421A0B0A0475CAFDB24CF14D805BEABBB4FB05B14F00469EE5465B6C1C7B55A49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009F5C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,00000000,?,?,009F539F,00000000,?,?,?,?,?,009F5290,?,?,?), ref: 009F5C76

Strings

invalid string position, xrefs: 009F5C71

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position
API String ID: 1960685668-1799206989
Opcode ID: f199740268c9cabdb6dd304875af845525723796afc19ac20c5de61cdf7a32be
Instruction ID: 482da8dcade58e0de79abc4fb12775a5b9186e597520f0a8505fac25a9e44655
Opcode Fuzzy Hash: f199740268c9cabdb6dd304875af845525723796afc19ac20c5de61cdf7a32be
Instruction Fuzzy Hash: F11181323147199B9724AF6CE84486AB7E9FFE4712302453FE786C7620EB70D918C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 009F5E80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,009F64D8,?,00000001,6D285D9C,00000000), ref: 009F5E94
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,009F64D8,?,00000001,6D285D9C), ref: 009F5EDA

Strings

string too long, xrefs: 009F5E8F

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@memcpy
String ID: string too long
API String ID: 237780522-2556327735
Opcode ID: 5c624744a5f8085c0bf75e27c040b62110cb217e907abcf0b2c0d6f936da69ef
Instruction ID: f8696906e359466e7f6760b14f2c841661295c87c640a6ed53f250841ccaf5ad
Opcode Fuzzy Hash: 5c624744a5f8085c0bf75e27c040b62110cb217e907abcf0b2c0d6f936da69ef
Instruction Fuzzy Hash: F511DD32500B095BD7319E58D84077BB7A9EF91320F064D2DEB9587281C7719944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F5F30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,009F5793,00000000,?,?,?,?,?,009F567F,?,?,?), ref: 009F5F46

Strings

invalid string position, xrefs: 009F5F41

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position
API String ID: 1960685668-1799206989
Opcode ID: 8b0730b89904c617d473579fc64d91797f6b47730119218b0af722c77eb6ea9d
Instruction ID: 19905f2e0c2efeb0d644e97c7e45244a829412745d2ae157254cf963b88a8964
Opcode Fuzzy Hash: 8b0730b89904c617d473579fc64d91797f6b47730119218b0af722c77eb6ea9d
Instruction Fuzzy Hash: 0311D0323007198FD7209E5CE840A66FBA8EBA1712B16497FF781CB251D7B1D805C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00A04CD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,00000000,?,?,00A05410,?,6D285D9C,00000000,?,00000000,?,00A08608,000000FF), ref: 00A04CFF
memset.VCRUNTIME140(?,00000000,?,?,00000000,?,?,00A05410,?,6D285D9C,00000000,?,00000000,?,00A08608,000000FF), ref: 00A04D1E

Strings

vector<T> too long, xrefs: 00A04CFA

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Xlength_error@std@@memset
String ID: vector<T> too long
API String ID: 1527646195-3788999226
Opcode ID: 51959296db5adad6b298d6b49e17b6dfc36ba2f73a35edc9957ab286a3d7e01b
Instruction ID: 7d0216ccaf1b045745660cee7e0c3621c8a232351c4de486f2c7065ecddfcc0c
Opcode Fuzzy Hash: 51959296db5adad6b298d6b49e17b6dfc36ba2f73a35edc9957ab286a3d7e01b
Instruction Fuzzy Hash: 08F0B4B2A01226BBD3009F48EC01786F7E8BF58710F208226FA18D3280E7B198208BD1

Uniqueness

Uniqueness Score: -1.00%

Function 009F2860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GdipDisposeImage.GDIPLUS(?), ref: 009F286F
GdipFree.GDIPLUS ref: 009F2881

Strings

vQs, xrefs: 009F2881

Memory Dump Source

Source File: 00000002.00000002.4457964049.00000000009F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000002.00000002.4457902913.00000000009F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458029501.0000000000A0A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458102268.0000000000A17000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4458168905.0000000000A1A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9f0000_antivirus_detector.jbxd

Similarity

API ID: Gdip$DisposeFreeImage
String ID: vQs
API String ID: 1950503971-294607111
Opcode ID: 1849b232644c1c92a90738dc83f0f65e408ed995ac6f7077d8205d1f4e8c7dbc
Instruction ID: f1b2fadd9daadc7860cf8337eb8344756d6bf5ca95046840ae82fc97d719e7fe
Opcode Fuzzy Hash: 1849b232644c1c92a90738dc83f0f65e408ed995ac6f7077d8205d1f4e8c7dbc
Instruction Fuzzy Hash: DBE0867630032C57D6215BC8BC05AEAB79CDF26BA5B004036FB44A6300D672A82297E7

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: main_installer.exePID: 1864, Parent PID: 3808COMMON

Execution Graph

Execution Coverage:	20.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1279
Total number of Limit Nodes:	28

Executed Functions

Function 0040326B Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403290
GetVersion.KERNEL32 ref: 00403296
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004032C9
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403305
OleInitialize.OLE32(00000000), ref: 0040330C
SHGetFileInfoA.SHELL32(00429830,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 00403328
GetCommandLineA.KERNEL32(Windows Provisioning Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 0040333D
CharNextA.USER32(00000000,"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1,00000020,"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1,00000000,?,00000006,00000008,0000000A), ref: 00403379
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 00403476
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 00403487
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403493
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004034A7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004034AF
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 004034C0
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004034C8
DeleteFileA.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 004034DC

Part of subcall function 004063A8: GetModuleHandleA.KERNEL32(?,?,?,004032DE,0000000A), ref: 004063BA
Part of subcall function 004063A8: GetProcAddress.KERNEL32(00000000,?), ref: 004063D5

Part of subcall function 0040382D: lstrlenA.KERNEL32("post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,?,?,?,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,00000000,C:\Program Files (x86)\Windows Provisioning,1033,0042A870,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A870,00000000,00000002,75923410), ref: 0040391D
Part of subcall function 0040382D: lstrcmpiA.KERNEL32(?,.exe), ref: 00403930
Part of subcall function 0040382D: GetFileAttributesA.KERNEL32("post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0), ref: 0040393B
Part of subcall function 0040382D: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\Windows Provisioning), ref: 00403984
Part of subcall function 0040382D: RegisterClassA.USER32(0042EBA0), ref: 004039C1

ExitProcess.KERNEL32(?,?,00000006,00000008,0000000A), ref: 00403585

Part of subcall function 00403753: CloseHandle.KERNEL32(FFFFFFFF,0040358A,?,?,00000006,00000008,0000000A), ref: 0040375E

OleUninitialize.OLE32(?,?,00000006,00000008,0000000A), ref: 0040358A
ExitProcess.KERNEL32 ref: 004035AB
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 004036C8
OpenProcessToken.ADVAPI32(00000000), ref: 004036CF
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004036E7
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403706
ExitWindowsEx.USER32(00000002,80040002), ref: 0040372A
ExitProcess.KERNEL32 ref: 0040374D

Part of subcall function 0040572C: MessageBoxIndirectA.USER32(0040A218), ref: 00405787

Strings

1033, xrefs: 004034D7
\Temp, xrefs: 0040348D
SeShutdownPrivilege, xrefs: 004036E1
Windows Provisioning Setup, xrefs: 00403333
C:\Program Files (x86)\Windows Provisioning, xrefs: 0040345B, 0040355C, 00403606, 0040360F
"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1, xrefs: 00403343, 00403349, 00403500
.tmp, xrefs: 004035D2
C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 004035DD, 004035E2, 0040360E
NSIS Error, xrefs: 0040332E
TEMP, xrefs: 004034BB
C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe, xrefs: 00403668
", xrefs: 0040339E
C:\Program Files (x86)\Windows Provisioning, xrefs: 00403567
~nsu, xrefs: 004035B6
TMP, xrefs: 004034C3
Error launching installer, xrefs: 00403542
Low, xrefs: 004034A9
UXTHEME, xrefs: 004032BD, 004032C2, 004032C8
C:\Users\user\AppData\Local\Temp\, xrefs: 0040346B, 00403470, 00403486, 00403492, 004034A1, 004034AE, 004034BA, 004034C2, 004035BB, 004035CC, 004035D7, 004035E3, 004035F0, 004035FF, 004036AE

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Process$Exit$File$EnvironmentHandlePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
String ID: "$"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1$.tmp$1033$C:\Program Files (x86)\Windows Provisioning$C:\Program Files (x86)\Windows Provisioning$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Windows Provisioning$C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$Windows Provisioning Setup$\Temp$~nsu
API String ID: 562314493-1040447263
Opcode ID: 4775c68527fbb917aecb0a7c801f737b56a4a891fa957fa25b7ad5f6c3460015
Instruction ID: c488d4947f624a60ea111d8e8e2b3f6be1d3d76fce8bfd42f4ae142e8cae794f
Opcode Fuzzy Hash: 4775c68527fbb917aecb0a7c801f737b56a4a891fa957fa25b7ad5f6c3460015
Instruction Fuzzy Hash: 9EC10570104741AAD7216F759D49B2F3EA8AF4570AF44443FF582B61E2CB7C8A198B2F

Uniqueness

Uniqueness Score: -1.00%

Function 004057D8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405801
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsmE645.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsmE645.tmp\*.*,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405849
lstrcatA.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsmE645.tmp\*.*,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040586A
lstrlenA.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsmE645.tmp\*.*,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405870
FindFirstFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsmE645.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsmE645.tmp\*.*,?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405881
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 0040592E
FindClose.KERNEL32(00000000), ref: 0040593F

Strings

"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1, xrefs: 004057D8
\*.*, xrefs: 00405843
C:\Users\user\AppData\Local\Temp\nsmE645.tmp\*.*, xrefs: 00405831, 00405837, 00405848, 0040587E
C:\Users\user\AppData\Local\Temp\, xrefs: 004057E5

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsmE645.tmp\*.*$\*.*
API String ID: 2035342205-4050246052
Opcode ID: 1028c0a1378fe67f5cfd0213f93084011618ac7fb180f8f6d485c044da562b3f
Instruction ID: b1b2ef924c21ee39ce724be99c412cdb4e11523259fae964be374fa5306f8f12
Opcode Fuzzy Hash: 1028c0a1378fe67f5cfd0213f93084011618ac7fb180f8f6d485c044da562b3f
Instruction Fuzzy Hash: 9A51A171800A04EADB216B618C45BBF7AB8DF42728F14807BF845B51D1C73C4982DE6A

Uniqueness

Uniqueness Score: -1.00%

Function 00406313 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(75923410,0042C0C0,C:\,00405AD9,C:\,C:\,00000000,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 0040631E
FindClose.KERNELBASE(00000000), ref: 0040632A

Strings

C:\, xrefs: 00406313

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: 1839775ab65f4c7429e333cf5f3a5f1104f42c23ffe018d7624b5080913ebc3e
Instruction ID: f1da5dbc8fb4190b670de1866088b9aea297c62f24eccc1d76d376cb4bf46ee5
Opcode Fuzzy Hash: 1839775ab65f4c7429e333cf5f3a5f1104f42c23ffe018d7624b5080913ebc3e
Instruction Fuzzy Hash: A8D0123250A030ABC350177C7E0C88F7A989F163347218A36F4A6F21E0C7348C2286DC

Uniqueness

Uniqueness Score: -1.00%

Function 0040382D Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004063A8: GetModuleHandleA.KERNEL32(?,?,?,004032DE,0000000A), ref: 004063BA
Part of subcall function 004063A8: GetProcAddress.KERNEL32(00000000,?), ref: 004063D5

lstrcatA.KERNEL32(1033,0042A870,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A870,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1,00000000), ref: 004038A8
lstrlenA.KERNEL32("post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,?,?,?,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,00000000,C:\Program Files (x86)\Windows Provisioning,1033,0042A870,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042A870,00000000,00000002,75923410), ref: 0040391D
lstrcmpiA.KERNEL32(?,.exe), ref: 00403930
GetFileAttributesA.KERNEL32("post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0), ref: 0040393B
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\Windows Provisioning), ref: 00403984

Part of subcall function 00405F6E: wsprintfA.USER32 ref: 00405F7B

RegisterClassA.USER32(0042EBA0), ref: 004039C1
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004039D9
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A0E
ShowWindow.USER32(00000005,00000000), ref: 00403A44
GetClassInfoA.USER32(00000000,RichEdit20A,0042EBA0), ref: 00403A70
GetClassInfoA.USER32(00000000,RichEdit,0042EBA0), ref: 00403A7D
RegisterClassA.USER32(0042EBA0), ref: 00403A86
DialogBoxParamA.USER32(?,00000000,00403BCA,00000000), ref: 00403AA5

Strings

1033, xrefs: 0040384D, 004038A3
_Nb, xrefs: 004039A0, 00403A08
C:\Program Files (x86)\Windows Provisioning, xrefs: 004038B7, 004038BF, 00403957, 0040395D, 0040396D
"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1, xrefs: 00403831
"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0, xrefs: 004038EB, 004038F3, 00403900, 0040394A, 00403950
RichEd20, xrefs: 00403A4A
Control Panel\Desktop\ResourceLocale, xrefs: 00403861
.exe, xrefs: 0040392A
.DEFAULT\Control Panel\International, xrefs: 00403893
RichEdit, xrefs: 00403A77
RichEdit20A, xrefs: 00403A68, 00403A6E
C:\Users\user\AppData\Local\Temp\, xrefs: 00403832
RichEd32, xrefs: 00403A58

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1$"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0$.DEFAULT\Control Panel\International$.exe$1033$C:\Program Files (x86)\Windows Provisioning$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-1409242338
Opcode ID: 15822f17e376e41266fbf8a251ac5c412d7bb8a3b85e81a9d7c16052a8cecaf4
Instruction ID: 5bdd09b32da2b5bd11ad56600dd1adb443959310d265eb20ccced3f07ac4f103
Opcode Fuzzy Hash: 15822f17e376e41266fbf8a251ac5c412d7bb8a3b85e81a9d7c16052a8cecaf4
Instruction Fuzzy Hash: B461C770340201AED620BB669D45F2B3E6CEB54749F80447FF981B22E2CB7D9D469B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402DC4 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DD5
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,00000400), ref: 00402DF1

Part of subcall function 00405BA9: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,80000000,00000003), ref: 00405BAD
Part of subcall function 00405BA9: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BCF

GetFileSize.KERNEL32(00000000,00000000,00437000,00000000,C:\Users\user\AppData\Roaming\Windows Provisioning,C:\Users\user\AppData\Roaming\Windows Provisioning,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,80000000,00000003), ref: 00402E3D
GlobalAlloc.KERNELBASE(00000040,00000020), ref: 00402F73

Strings

C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe, xrefs: 00402DDB, 00402DEA, 00402DFE, 00402E1E
Inst, xrefs: 00402EA9
soft, xrefs: 00402EB2
Error launching installer, xrefs: 00402E14
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F9A
"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1, xrefs: 00402DC4
C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 00402E1F, 00402E24, 00402E2A
TA, xrefs: 00402E52
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DCB
Null, xrefs: 00402EBB

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: TA$"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Windows Provisioning$C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2918105217
Opcode ID: a6173edc5218a8736919d7ec244e80ad4ff8d0a671bf7eda1f584d4bdf14a1ba
Instruction ID: 027006cf2d98db9fa9c400e5027e86f3261d974ae097fd254c994c4dc937b6e6
Opcode Fuzzy Hash: a6173edc5218a8736919d7ec244e80ad4ff8d0a671bf7eda1f584d4bdf14a1ba
Instruction Fuzzy Hash: FF51E471900215ABCB20AF64DE89B9F7BB8EB14359F50403BF500B32D1C6BC9E459AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00406032 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32("post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,00000400), ref: 0040615D
GetWindowsDirectoryA.KERNEL32("post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,00000400,?,0042A050,00000000,0040516F,0042A050,00000000), ref: 00406170
SHGetSpecialFolderLocation.SHELL32(0040516F,759223A0,?,0042A050,00000000,0040516F,0042A050,00000000), ref: 004061AC
SHGetPathFromIDListA.SHELL32(759223A0,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0), ref: 004061BA
CoTaskMemFree.OLE32(759223A0), ref: 004061C6
lstrcatA.KERNEL32("post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,\Microsoft\Internet Explorer\Quick Launch), ref: 004061EA
lstrlenA.KERNEL32("post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,?,0042A050,00000000,0040516F,0042A050,00000000,00000000,0042277C,759223A0), ref: 0040623C

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040612C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004061E4
"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0, xrefs: 0040605C, 00406129, 0040612A, 0040612B, 00406147, 0040615C, 0040616F, 0040618B, 004061B6, 004061E9, 004061EF, 00406207, 0040621A, 00406235, 0040623B, 00406243, 0040626D

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: "post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1788430709
Opcode ID: b5f21783dff86301b55f28ea11f9c7815398c55a2ca1ca21ed943f87329636d9
Instruction ID: 0eb145c1bee873094c14c85ea59bbbcbcc52f889deb60e0de917f7e6e63be494
Opcode Fuzzy Hash: b5f21783dff86301b55f28ea11f9c7815398c55a2ca1ca21ed943f87329636d9
Instruction Fuzzy Hash: F1610171900114AEDF24AF64CC84BBE3BA5AB15314F52417FE913BA2D2C77C49A2CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,C:\Program Files (x86)\Windows Provisioning,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,00000000,00000000,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,C:\Program Files (x86)\Windows Provisioning,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406010: lstrcpynA.KERNEL32(?,?,00000400,0040333D,Windows Provisioning Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 0040601D

Part of subcall function 00405137: lstrlenA.KERNEL32(0042A050,00000000,0042277C,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000,?), ref: 00405170
Part of subcall function 00405137: lstrlenA.KERNEL32(00403156,0042A050,00000000,0042277C,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000), ref: 00405180
Part of subcall function 00405137: lstrcatA.KERNEL32(0042A050,00403156,00403156,0042A050,00000000,0042277C,759223A0), ref: 00405193
Part of subcall function 00405137: SetWindowTextA.USER32(0042A050,0042A050), ref: 004051A5
Part of subcall function 00405137: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051CB
Part of subcall function 00405137: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051E5
Part of subcall function 00405137: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051F3

Strings

C:\Program Files (x86)\Windows Provisioning, xrefs: 00401826, 00401842
C:\Program Files (x86)\Windows Provisioning, xrefs: 00401786
"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0$C:\Program Files (x86)\Windows Provisioning$C:\Program Files (x86)\Windows Provisioning
API String ID: 1941528284-387393673
Opcode ID: d2d4c9be4c77887772f7a063183bc6da9d3610935c72e1bf3270bbb4a4cc9717
Instruction ID: fcac4804817dd72ce497849c2c59a0292666c96c0e268c836f952ab8254f0f2b
Opcode Fuzzy Hash: d2d4c9be4c77887772f7a063183bc6da9d3610935c72e1bf3270bbb4a4cc9717
Instruction Fuzzy Hash: 5941E571900114BACF10BBB5CD45E9F3A79EF45369F20823BF412F20E2DA7C8A519A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402FFB Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403062
GetTickCount.KERNEL32 ref: 00403109
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00403132
wsprintfA.USER32 ref: 00403142

Strings

|'B, xrefs: 004030E6, 00403101, 00403178
... %d%%, xrefs: 0040313C

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$|'B
API String ID: 551687249-769249321
Opcode ID: fadbfff98126c3f33fc218ff52c7570f2bc54738a50a490896210387b9f65f46
Instruction ID: 2f86f0e091d903dd4c8dc1f0d7d1d97a23866136c8ad304ef4da6da149bc5d25
Opcode Fuzzy Hash: fadbfff98126c3f33fc218ff52c7570f2bc54738a50a490896210387b9f65f46
Instruction Fuzzy Hash: D2518D71801219EBDB10DF65DA44A9E7FB8EF08316F10817BE810B72E1C7789B44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004055FD Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405640
GetLastError.KERNEL32 ref: 00405654
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405669
GetLastError.KERNEL32 ref: 00405673

Strings

C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 004055FD
C:\Users\user\AppData\Local\Temp\, xrefs: 00405623

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Windows Provisioning
API String ID: 3449924974-980186624
Opcode ID: 3f07113bbed92aa299f899006a5ac68722d9e9d13463f273e10feef126da3ab7
Instruction ID: eb9787142c6b7489d22a19a099e3bfbf20428df61be735a73e08cf58b85abbae
Opcode Fuzzy Hash: 3f07113bbed92aa299f899006a5ac68722d9e9d13463f273e10feef126da3ab7
Instruction Fuzzy Hash: 89010871C00219EAEF009FA1C904BEFBBB8EB14354F00847AD545B6290DB7996088FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040633A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406351
wsprintfA.USER32 ref: 0040638A
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040639E

Strings

\, xrefs: 00406362
UXTHEME, xrefs: 00406343
%s%s.dll, xrefs: 00406384

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 99878a05f639d6717cee7e73d8174e66263622090e4b33b6bcde024c159c7dc8
Instruction ID: 4d0fdf3fe302aa3e605d302367287b0bc06203fc89102858e08200231af957cf
Opcode Fuzzy Hash: 99878a05f639d6717cee7e73d8174e66263622090e4b33b6bcde024c159c7dc8
Instruction Fuzzy Hash: 9EF0F670510609ABEB24AB74DD0DFEB366CAB08305F14057AAA86E11D1EA78D9358BDC

Uniqueness

Uniqueness Score: -1.00%

Function 00405BD8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BEC
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405C06

Strings

"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1, xrefs: 00405BD8
nsa, xrefs: 00405BE3
C:\Users\user\AppData\Local\Temp\, xrefs: 00405BDB

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3809531280
Opcode ID: 81a8a72dc23b4af90602e2553ee1124644ae594fa0167b908fb3a738e8e2aa10
Instruction ID: 7981c9ddf24778652055132877b92488972f9a5eb9cf132aa873dca7e4a118a1
Opcode Fuzzy Hash: 81a8a72dc23b4af90602e2553ee1124644ae594fa0167b908fb3a738e8e2aa10
Instruction Fuzzy Hash: 0FF082363183046BEB109F56DD04B9B7BA9DFD2750F14803BFA489B290D6B4A9548B58

Uniqueness

Uniqueness Score: -1.00%

Function 00405A96 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406010: lstrcpynA.KERNEL32(?,?,00000400,0040333D,Windows Provisioning Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 0040601D

Part of subcall function 00405A41: CharNextA.USER32(?,?,C:\,?,00405AAD,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A4F
Part of subcall function 00405A41: CharNextA.USER32(00000000), ref: 00405A54
Part of subcall function 00405A41: CharNextA.USER32(00000000), ref: 00405A68

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405AE9
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\), ref: 00405AF9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A96
C:\, xrefs: 00405A9C, 00405AA1, 00405AA7, 00405AE2, 00405AE8, 00405AF0, 00405AF8

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-1964270705
Opcode ID: a0e90dbc06f1550ade5f4dfcb0fddeac6c7db65a8ba4490088ce0944d0043635
Instruction ID: 19c9bca0149f7da3aa3ccb8fe98c792d35a3de88cc2685bd8f8020a319c38c36
Opcode Fuzzy Hash: a0e90dbc06f1550ade5f4dfcb0fddeac6c7db65a8ba4490088ce0944d0043635
Instruction Fuzzy Hash: 94F0F425305D6116DA22323A5D85AAF2A44CED632471A073BF852B12C3DB3C89439DFE

Uniqueness

Uniqueness Score: -1.00%

Function 0040206A Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00402095

Part of subcall function 00405137: lstrlenA.KERNEL32(0042A050,00000000,0042277C,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000,?), ref: 00405170
Part of subcall function 00405137: lstrlenA.KERNEL32(00403156,0042A050,00000000,0042277C,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000), ref: 00405180
Part of subcall function 00405137: lstrcatA.KERNEL32(0042A050,00403156,00403156,0042A050,00000000,0042277C,759223A0), ref: 00405193
Part of subcall function 00405137: SetWindowTextA.USER32(0042A050,0042A050), ref: 004051A5
Part of subcall function 00405137: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051CB
Part of subcall function 00405137: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051E5
Part of subcall function 00405137: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051F3

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020A5
GetProcAddress.KERNEL32(00000000,?), ref: 004020B5
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040211F

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 9ad9ce2a502c8eb59803e63aa1a3e0a6c3f0f64fdee950c1b1f2159af15bdaac
Instruction ID: 166643d80e3f452ca3a3677f95ea327ecca8534a485506fba34b2def260d9046
Opcode Fuzzy Hash: 9ad9ce2a502c8eb59803e63aa1a3e0a6c3f0f64fdee950c1b1f2159af15bdaac
Instruction Fuzzy Hash: EA21C671900214ABCF217FA4CF89AAE7A74AF15318F20413BF601B62D0D6FD49829A5E

Uniqueness

Uniqueness Score: -1.00%

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405A41: CharNextA.USER32(?,?,C:\,?,00405AAD,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A4F
Part of subcall function 00405A41: CharNextA.USER32(00000000), ref: 00405A54
Part of subcall function 00405A41: CharNextA.USER32(00000000), ref: 00405A68

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004055FD: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405640

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Program Files (x86)\Windows Provisioning,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Program Files (x86)\Windows Provisioning, xrefs: 00401631

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Program Files (x86)\Windows Provisioning
API String ID: 1892508949-401443821
Opcode ID: 5f753e0658c4706503074469e71019f2b9f731883a19c30285f75084ce00b664
Instruction ID: 1afb8a6b6fc663fc0b529d5452f3d1f5a7876e1f873962654dbae4e79628cbca
Opcode Fuzzy Hash: 5f753e0658c4706503074469e71019f2b9f731883a19c30285f75084ce00b664
Instruction Fuzzy Hash: 08112731508141EBCB217FB54D41A7F36B4AE96324F68093FE4D1B22E2D63D4842AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00405EF7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,0042A050,?,?,?,00000002,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,?,0040613B,80000002), ref: 00405F3D
RegCloseKey.KERNELBASE(?,?,0040613B,80000002,Software\Microsoft\Windows\CurrentVersion,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,?,0042A050), ref: 00405F48

Strings

"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0, xrefs: 00405EFA, 00405F2E

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CloseQueryValue
String ID: "post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0
API String ID: 3356406503-2912109781
Opcode ID: 074503bd4819f587f33d8f4257f8029770edcc3592d90d126d241b317bef6944
Instruction ID: 2ff6a7a209fcbf00177f68e0cac6a7fed3d2e9df1b1dc864ec66af95abe17f1f
Opcode Fuzzy Hash: 074503bd4819f587f33d8f4257f8029770edcc3592d90d126d241b317bef6944
Instruction Fuzzy Hash: 63017C7250060AABDF228F61CD09FDB3FA8EF59364F04403AF955E2190D2B8DA54CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004056AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0042C078,Error launching installer), ref: 004056D8
CloseHandle.KERNEL32(?), ref: 004056E5

Strings

Error launching installer, xrefs: 004056C2

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: a2b9ecb8406674d5a7d1aded78611502900df459338db245270d40db8d5eaf79
Instruction ID: d682804100e664e073205113f6b11307167482a28e2818ee20dd6d85df95f7a7
Opcode Fuzzy Hash: a2b9ecb8406674d5a7d1aded78611502900df459338db245270d40db8d5eaf79
Instruction Fuzzy Hash: CFE046F0640209BFEB109FA0EE49F7F7AADEB00704F404521BD00F2190EA7498088A7C

Uniqueness

Uniqueness Score: -1.00%

Function 00403798 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,75923410,00000000,C:\Users\user\AppData\Local\Temp\,00403770,0040358A,?,?,00000006,00000008,0000000A), ref: 004037B2
GlobalFree.KERNEL32(00000000), ref: 004037B9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403798

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 248c780681ff10c09d9810c58c710ba8abcca500869ff380da07a7f320702544
Instruction ID: 06ba742c3ad1fb67bc09d12af4c86e1058789e05b1a36190638fabe2eea0851a
Opcode Fuzzy Hash: 248c780681ff10c09d9810c58c710ba8abcca500869ff380da07a7f320702544
Instruction Fuzzy Hash: EAE0C27352212097C7312F15EE04B1AB7A86F86F22F09403AE8407B2A087741C438BCC

Uniqueness

Uniqueness Score: -1.00%

Function 0040243D Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040AC18,00000023,00000011,00000002), ref: 00402488
RegSetValueExA.KERNELBASE(?,?,?,?,0040AC18,00000000,00000011,00000002), ref: 004024C5
RegCloseKey.ADVAPI32(?,?,?,0040AC18,00000000,00000011,00000002), ref: 004025A9

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: 4e63be427a74e043a8ca9afa508d3f5c36f16e597551305d3883f145c9c59f91
Instruction ID: 559559637a649bcd28a1cc64439ef7fed2494afba8ff337a7fe29a68e97d1b61
Opcode Fuzzy Hash: 4e63be427a74e043a8ca9afa508d3f5c36f16e597551305d3883f145c9c59f91
Instruction Fuzzy Hash: 26115E71E00218AFEB01AFA58E49EAE7AB4EB48314F21443BF504B71C1D6F95D419B68

Uniqueness

Uniqueness Score: -1.00%

Function 00405790 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405B84: GetFileAttributesA.KERNELBASE(?,?,0040579C,?,?,00000000,0040597F,?,?,?,?), ref: 00405B89
Part of subcall function 00405B84: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405B9D

RemoveDirectoryA.KERNELBASE(?,?,?,00000000,0040597F), ref: 004057AB
DeleteFileA.KERNELBASE(?,?,?,00000000,0040597F), ref: 004057B3
SetFileAttributesA.KERNEL32(?,00000000), ref: 004057CB

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 1b58439dbc4d5c75e8d4a1b60800a1a05f091bf10d9841f58e7402e1275724a5
Instruction ID: 506f0000beea922c53fa0ef56bc3bb9d2703a559d1119bf8978eeb103538cabb
Opcode Fuzzy Hash: 1b58439dbc4d5c75e8d4a1b60800a1a05f091bf10d9841f58e7402e1275724a5
Instruction Fuzzy Hash: 6CE0E531115AA197D61057308E0CB5B3AA8DF86328F19093BF992B31D0C7784446DA7E

Uniqueness

Uniqueness Score: -1.00%

Function 004024DA Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040250A
RegCloseKey.ADVAPI32(?,?,?,0040AC18,00000000,00000011,00000002), ref: 004025A9

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 96c36fbc50e44a3ebb07383f364263b9dc7d5f2eede6118d18d4b03762f6bff5
Instruction ID: 8c7c89e59df7b4709da067e0fd7ec9be99446db0afc11a297a964fac99c2b4a6
Opcode Fuzzy Hash: 96c36fbc50e44a3ebb07383f364263b9dc7d5f2eede6118d18d4b03762f6bff5
Instruction Fuzzy Hash: E5116A71901205EEDB11CF64CA599AEBAB4AB19348F60447FE042B62C0D6B88A45DB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ffebd5fca59fb87aab51f7597ede924ce92eaed1a0ec0a619fe9c5b1ad01a7d
Instruction ID: 5ed4d9c38c73c282456bb639181f16eab54b9a7fb1a82fe129ff52a3f74c88ba
Opcode Fuzzy Hash: 3ffebd5fca59fb87aab51f7597ede924ce92eaed1a0ec0a619fe9c5b1ad01a7d
Instruction Fuzzy Hash: B101F4317242109BE7199B399D04B6A3698E710719F54823FF852F61F1D678EC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 004063A8 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,004032DE,0000000A), ref: 004063BA
GetProcAddress.KERNEL32(00000000,?), ref: 004063D5

Part of subcall function 0040633A: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406351
Part of subcall function 0040633A: wsprintfA.USER32 ref: 0040638A
Part of subcall function 0040633A: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040639E

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: dd9300423111a071ed2c714751f7876f95e5d132df45129638b184150075da19
Instruction ID: 650a49b09a3c495eabc0f371936d9c907298e200c4f2363c251d84495e191d7a
Opcode Fuzzy Hash: dd9300423111a071ed2c714751f7876f95e5d132df45129638b184150075da19
Instruction Fuzzy Hash: B4E08C32604220ABD2106A74AE0493B72A89E94710302083EF947F2240DB389C3697AD

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA9 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,80000000,00000003), ref: 00405BAD
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BCF

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 80243517f436f95d2d00e5b5224d95f101b34955670c918b0becce4e09b30ec3
Instruction ID: 6905ba7dec075751c4c8bdaf1e97cd52a4ed4154a0977e2bcfee25d1bc4df630
Opcode Fuzzy Hash: 80243517f436f95d2d00e5b5224d95f101b34955670c918b0becce4e09b30ec3
Instruction Fuzzy Hash: F5D09E31254201EFEF098F20DE16F2EBBA2EB94B00F11952CB682944E1DA715819AB19

Uniqueness

Uniqueness Score: -1.00%

Function 00405B84 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,0040579C,?,?,00000000,0040597F,?,?,?,?), ref: 00405B89
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405B9D

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a53a5738952024e77fe51bdf82e6835a24f68a8863f167a8e3b3ad13dd9f075c
Instruction ID: 89bb1c08115ccb47c9876ad1094a3663263f91dea81084495bed50ebcc9a35d2
Opcode Fuzzy Hash: a53a5738952024e77fe51bdf82e6835a24f68a8863f167a8e3b3ad13dd9f075c
Instruction Fuzzy Hash: B7D0C972504421ABD2102728AE0889BBBA5DB542717028A36F9A5A22B1DB304C569A99

Uniqueness

Uniqueness Score: -1.00%

Function 00403753 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,0040358A,?,?,00000006,00000008,0000000A), ref: 0040375E

Strings

C:\Users\user\AppData\Local\Temp\nsmE645.tmp\, xrefs: 00403772

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsmE645.tmp\
API String ID: 2962429428-1972978657
Opcode ID: 4bfc4a86c4512e3107b8fb86be471d5238cf24995b86bfa467bc0e008276a2a3
Instruction ID: fc3c4bd29221364ca44687d693abbcbbd121fb750d4ff3e3919dc32638d5829b
Opcode Fuzzy Hash: 4bfc4a86c4512e3107b8fb86be471d5238cf24995b86bfa467bc0e008276a2a3
Instruction Fuzzy Hash: F6C012B0540700B6C5647F799E8F9053A545B41736F608726B0B8F20F1C73C4659556F

Uniqueness

Uniqueness Score: -1.00%

Function 0040567A Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,0040325E,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 00405680
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 0040568E

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: f012ed4f2e447eb03a7c1a9074efbf4aa4d4dcf66ab1e3e2b7403bfb804529af
Instruction ID: cb450b3a329ff4c2b820c3640ee2c86a22e1ba63869c3c930ac7c2b00640337e
Opcode Fuzzy Hash: f012ed4f2e447eb03a7c1a9074efbf4aa4d4dcf66ab1e3e2b7403bfb804529af
Instruction Fuzzy Hash: B3C04C302145029EDA515B319E08B1B7A59AB90781F528839654AE81B0DE768455DD2E

Uniqueness

Uniqueness Score: -1.00%

Function 00405EC4 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402BDD,00000000,?,?), ref: 00405EED

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 1d4fb08659ff36ace7b23f5759770be8a1f2413d8495cc917bdfefdc51ec9cff
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: 64E0E67201050DBEDF195F50DD0AD7B371DE704304F10492EFA45D5150E6B5AA716B78

Uniqueness

Uniqueness Score: -1.00%

Function 00405C50 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031D6,00000000,0041D428,000000FF,0041D428,000000FF,000000FF,00000004,00000000), ref: 00405C64

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d47d29d2c4ad98e9097244963089aa7711ad8f9da7a01510603535aa68a2578c
Instruction ID: df976955bb7b77361248817f919be03bb6bd2f6f3b4dc1c0c3d16748aaf5f5c5
Opcode Fuzzy Hash: d47d29d2c4ad98e9097244963089aa7711ad8f9da7a01510603535aa68a2578c
Instruction Fuzzy Hash: 65E0EC3221476EABEF509F559D04EEB7B6CEB06360F004436FE25E2550D631E9219BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405C21 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403220,00000000,00000000,0040304A,000000FF,00000004,00000000,00000000,00000000), ref: 00405C35

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c828ac78080eafadef002e80ceae40fa9d69551b6ff84e56452d6cc727993955
Instruction ID: 6d14d449f293f6f00ca5a49b865ea561f53b7d8d8b79739f6419f9b8fb6d3ad5
Opcode Fuzzy Hash: c828ac78080eafadef002e80ceae40fa9d69551b6ff84e56452d6cc727993955
Instruction Fuzzy Hash: 9EE0EC3221476AABEF109E559C00EEB7B6CEB05361F008836F915E3150D631E8219FA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405E96 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,?,0042A050,?,?,00405F24,0042A050,?,?,?,00000002,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0), ref: 00405EBA

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 4562f56e26d1b405a4b2aa3aa7a0366252bc09d65f2ff82b9814b1ce5e7315b9
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 19D0EC3200020DBADF115F90DD05FAB3B2EEB04310F004426FA45A50A0D775D630AA58

Uniqueness

Uniqueness Score: -1.00%

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e96fbec41495e15a4c7bae773e545c4494f3eb1603eb57e13be7f4f976825ac0
Instruction ID: 4f8ec7b4fa93eeb61d23c1d92a418e90caec6e25b57ca3d9eeae261b5adaa5a1
Opcode Fuzzy Hash: e96fbec41495e15a4c7bae773e545c4494f3eb1603eb57e13be7f4f976825ac0
Instruction Fuzzy Hash: 0FD012727042009BCB11EFA8AB08A5E7775EB54324F600537D101F21D1D2B885459759

Uniqueness

Uniqueness Score: -1.00%

Function 00403223 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F89,?), ref: 00403231

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: af556f1437a27586b8d302be8c6d190c2fb2fb51029204f11d8d070fc2108142
Instruction ID: 81fdcbbc46e9ac73494c3809a02cbb86869920566b24394b282a4516d046c7b0
Opcode Fuzzy Hash: af556f1437a27586b8d302be8c6d190c2fb2fb51029204f11d8d070fc2108142
Instruction Fuzzy Hash: 32B01231140300BFDA214F00DF09F057B21AB90700F10C034B384780F086711075EB0D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404AA3 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404ABA
GetDlgItem.USER32(?,00000408), ref: 00404AC7
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B16
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404B2D
SetWindowLongA.USER32(?,000000FC,004050AB), ref: 00404B47
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B59
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404B6D
SendMessageA.USER32(?,00001109,00000002), ref: 00404B83
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B8F
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B9F
DeleteObject.GDI32(00000110), ref: 00404BA4
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404BCF
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BDB
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C75
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404CA5

Part of subcall function 004040D3: SendMessageA.USER32(00000028,?,00000001,00403F03), ref: 004040E1

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404CB9
GetWindowLongA.USER32(?,000000F0), ref: 00404CE7
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CF5
ShowWindow.USER32(?,00000005), ref: 00404D05
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404E00
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E65
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E7A
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E9E
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404EBE
ImageList_Destroy.COMCTL32(?), ref: 00404ED3
GlobalFree.KERNEL32(?), ref: 00404EE3
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F5C
SendMessageA.USER32(?,00001102,?,?), ref: 00405005
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00405014
InvalidateRect.USER32(?,00000000,00000001), ref: 00405034
ShowWindow.USER32(?,00000000), ref: 00405082
GetDlgItem.USER32(?,000003FE), ref: 0040508D
ShowWindow.USER32(00000000), ref: 00405094

Strings

M, xrefs: 00404C5D
N, xrefs: 00404D3E
, xrefs: 0040506C

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 7979eb89c2ba789210c478efbd40ca5770d0cf58fb7a2a7deeb4f629e08dd5c3
Instruction ID: b93138f0eedc2449d1e9bfda9be5258a8e47cdb0f0c7c2118b7039f3366b9e37
Opcode Fuzzy Hash: 7979eb89c2ba789210c478efbd40ca5770d0cf58fb7a2a7deeb4f629e08dd5c3
Instruction Fuzzy Hash: AA026EB0900209AFEB20DFA5DD45AAE7BB5FB44314F14813AF614B62E0C7799D52CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405275 Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004052D4
GetDlgItem.USER32(?,000003EE), ref: 004052E3
GetClientRect.USER32(?,?), ref: 00405320
GetSystemMetrics.USER32(00000002), ref: 00405327
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405348
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405359
SendMessageA.USER32(?,00001001,00000000,?), ref: 0040536C
SendMessageA.USER32(?,00001026,00000000,?), ref: 0040537A
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040538D
ShowWindow.USER32(00000000,?,0000001B,?), ref: 004053AF
ShowWindow.USER32(?,00000008), ref: 004053C3
GetDlgItem.USER32(?,000003EC), ref: 004053E4
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053F4
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040540D
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405419
GetDlgItem.USER32(?,000003F8), ref: 004052F2

Part of subcall function 004040D3: SendMessageA.USER32(00000028,?,00000001,00403F03), ref: 004040E1

GetDlgItem.USER32(?,000003EC), ref: 00405435
CreateThread.KERNEL32(00000000,00000000,Function_00005209,00000000), ref: 00405443
CloseHandle.KERNEL32(00000000), ref: 0040544A
ShowWindow.USER32(00000000), ref: 0040546D
ShowWindow.USER32(?,00000008), ref: 00405474
ShowWindow.USER32(00000008), ref: 004054BA
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054EE
CreatePopupMenu.USER32 ref: 004054FF
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405514
GetWindowRect.USER32(?,000000FF), ref: 00405534
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040554D
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405589
OpenClipboard.USER32(00000000), ref: 00405599
EmptyClipboard.USER32 ref: 0040559F
GlobalAlloc.KERNEL32(00000042,?), ref: 004055A8
GlobalLock.KERNEL32(00000000), ref: 004055B2
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004055C6
GlobalUnlock.KERNEL32(00000000), ref: 004055DF
SetClipboardData.USER32(00000001,00000000), ref: 004055EA
CloseClipboard.USER32 ref: 004055F0

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: 850865324eda7255bc617561a744910c99d6829a0b955d2a94bbb97841d7110d
Instruction ID: 66d789517199d7de7cfadb6731c275bc9a2b232ae8febcf914e4846c803f5e83
Opcode Fuzzy Hash: 850865324eda7255bc617561a744910c99d6829a0b955d2a94bbb97841d7110d
Instruction Fuzzy Hash: A3A147B0900608BFDB119F61DE89AAF7F79FB08354F40403AFA41BA1A0C7755E519F68

Uniqueness

Uniqueness Score: -1.00%

Function 00403BCA Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C06
ShowWindow.USER32(?), ref: 00403C23
DestroyWindow.USER32 ref: 00403C37
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C53
GetDlgItem.USER32(?,?), ref: 00403C74
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403C88
IsWindowEnabled.USER32(00000000), ref: 00403C8F
GetDlgItem.USER32(?,00000001), ref: 00403D3D
GetDlgItem.USER32(?,00000002), ref: 00403D47
SetClassLongA.USER32(?,000000F2,?), ref: 00403D61
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403DB2
GetDlgItem.USER32(?,00000003), ref: 00403E58
ShowWindow.USER32(00000000,?), ref: 00403E79
EnableWindow.USER32(?,?), ref: 00403E8B
EnableWindow.USER32(?,?), ref: 00403EA6
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403EBC
EnableMenuItem.USER32(00000000), ref: 00403EC3
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403EDB
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403EEE
lstrlenA.KERNEL32(0042A870,?,0042A870,00000000), ref: 00403F18
SetWindowTextA.USER32(?,0042A870), ref: 00403F27
ShowWindow.USER32(?,0000000A), ref: 0040405B

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 5ffd1eee2a53c0bce8439eebe02f74cc0bfe9fdaa9e9cbb129ddddf772baf92f
Instruction ID: 8391a727dd330e9af47019fb45b898bbd0b6ec160f5193fdc8e4d7e88c7c5567
Opcode Fuzzy Hash: 5ffd1eee2a53c0bce8439eebe02f74cc0bfe9fdaa9e9cbb129ddddf772baf92f
Instruction Fuzzy Hash: 39C1B171600704AFDB20AF62EE45E2B3AA9FB95706F40043EF642B51E1CB799852DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00404209 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404294
GetDlgItem.USER32(00000000,000003E8), ref: 004042A8
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004042C6
GetSysColor.USER32(?), ref: 004042D7
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004042E6
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004042F5
lstrlenA.KERNEL32(?), ref: 004042F8
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404307
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040431C
GetDlgItem.USER32(?,0000040A), ref: 0040437E
SendMessageA.USER32(00000000), ref: 00404381
GetDlgItem.USER32(?,000003E8), ref: 004043AC
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004043EC
LoadCursorA.USER32(00000000,00007F02), ref: 004043FB
SetCursor.USER32(00000000), ref: 00404404
LoadCursorA.USER32(00000000,00007F00), ref: 0040441A
SetCursor.USER32(00000000), ref: 0040441D
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404449
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040445D

Strings

N, xrefs: 0040439A
"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0, xrefs: 004043D7

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: "post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0$N
API String ID: 3103080414-2896922254
Opcode ID: 448c26d367fa4ce24fea73f86f3c1ebcb169a2680b3cc918c82a0762cc84cb42
Instruction ID: e1855738532d9be41fcebd9a9c4146cd0e241e622fdf0fb061f71f1fb699f553
Opcode Fuzzy Hash: 448c26d367fa4ce24fea73f86f3c1ebcb169a2680b3cc918c82a0762cc84cb42
Instruction Fuzzy Hash: 2661A4B1A40208BFDB109F61DD45F6A7B69FB84314F00803AFB057A1D1C7B8A952CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Windows Provisioning Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Windows Provisioning Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Windows Provisioning Setup
API String ID: 941294808-1343353702
Opcode ID: 7b2e9886d4a0a86190cfd2eb73994447d751dd60ad8b28ccd238e082d53d4ecc
Instruction ID: a83fe4be3842045fa55e49ef5e4516223b86fcdf0b70f1128ddfc4a40beffe79
Opcode Fuzzy Hash: 7b2e9886d4a0a86190cfd2eb73994447d751dd60ad8b28ccd238e082d53d4ecc
Instruction Fuzzy Hash: 48418C71400209AFCB058FA5DE459BF7BB9FF45314F00842EF9A1AA1A0C7749955DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00404530 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040457F
SetWindowTextA.USER32(00000000,?), ref: 004045A9
SHBrowseForFolderA.SHELL32(?,00429C48,?), ref: 0040465A
CoTaskMemFree.OLE32(00000000), ref: 00404665
lstrcmpiA.KERNEL32("post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0,0042A870), ref: 00404697
lstrcatA.KERNEL32(?,"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0), ref: 004046A3
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004046B5

Part of subcall function 00405710: GetDlgItemTextA.USER32(?,?,00000400,004046EC), ref: 00405723

Part of subcall function 0040627A: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1,75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062D2
Part of subcall function 0040627A: CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062DF
Part of subcall function 0040627A: CharNextA.USER32(?,"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1,75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062E4
Part of subcall function 0040627A: CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062F4

GetDiskFreeSpaceA.KERNEL32(00429840,?,?,0000040F,?,00429840,00429840,?,00000001,00429840,?,?,000003FB,?), ref: 00404773
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040478E

Part of subcall function 004048E7: lstrlenA.KERNEL32(0042A870,0042A870,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404802,000000DF,00000000,00000400,?), ref: 00404985
Part of subcall function 004048E7: wsprintfA.USER32 ref: 0040498D
Part of subcall function 004048E7: SetDlgItemTextA.USER32(?,0042A870), ref: 004049A0

Strings

C:\Program Files (x86)\Windows Provisioning, xrefs: 00404680
A, xrefs: 00404653
"post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0, xrefs: 00404691, 00404696, 004046A1

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "post_install.exe" exe=C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe|inst=C:\Program Files (x86)\Windows Provisioning|s=1|k=|p=|r=0$A$C:\Program Files (x86)\Windows Provisioning
API String ID: 2624150263-1516350515
Opcode ID: f8c5b323b79a30612e5f20638997160abd30a80c2805ffb51c5d0b55a3138d2a
Instruction ID: 05eea3de79cf24fe9bb33e9012793c4f482d3b98f46f23a5f19240ee3c7d349e
Opcode Fuzzy Hash: f8c5b323b79a30612e5f20638997160abd30a80c2805ffb51c5d0b55a3138d2a
Instruction Fuzzy Hash: 78A160B1900218ABDB11AFA6CD45AAF77B8AF85314F14843BF601B62D1D77C8A418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00405C7F Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405E10,?,?), ref: 00405CB0
GetShortPathNameA.KERNEL32(?,0042C600,00000400), ref: 00405CB9

Part of subcall function 00405B0E: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1E
Part of subcall function 00405B0E: lstrlenA.KERNEL32(00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B50

GetShortPathNameA.KERNEL32(?,0042CA00,00000400), ref: 00405CD6
wsprintfA.USER32 ref: 00405CF4
GetFileSize.KERNEL32(00000000,00000000,0042CA00,C0000000,00000004,0042CA00,?,?,?,?,?), ref: 00405D2F
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D3E
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D76
SetFilePointer.KERNEL32(0040A3B8,00000000,00000000,00000000,00000000,0042C200,00000000,-0000000A,0040A3B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405DCC
GlobalFree.KERNEL32(00000000), ref: 00405DDD
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DE4

Part of subcall function 00405BA9: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,80000000,00000003), ref: 00405BAD
Part of subcall function 00405BA9: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BCF

Strings

%s=%s, xrefs: 00405CEA
[Rename], xrefs: 00405D5E, 00405D70

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: f77fbfde1968c6cc6d109ac9641d83ed14e9d60a65f6ef3fc352fd67b9dcf635
Instruction ID: 5f10e72b046bb4c3808544f3b96a1b07f09bbbda3d3e46611c613b54f85f09c3
Opcode Fuzzy Hash: f77fbfde1968c6cc6d109ac9641d83ed14e9d60a65f6ef3fc352fd67b9dcf635
Instruction Fuzzy Hash: F631F231600B15ABD2207BA59D4DFAB3A6CDF42754F14443BFA01F62D2DA7CE8058ABD

Uniqueness

Uniqueness Score: -1.00%

Function 0040627A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1,75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062D2
CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062DF
CharNextA.USER32(?,"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1,75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062E4
CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,00403246,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004062F4

Strings

"C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1, xrefs: 004062B6
*?|<>/":, xrefs: 004062C2
C:\Users\user\AppData\Local\Temp\, xrefs: 0040627B

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe" -s=1$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3813556669
Opcode ID: a4ab23b94a56fbb4e4ab915d6a0181bd243ee2e30b5e95404a857257d08c8b81
Instruction ID: 6247d5b4c7038ff51e561e9c2f84ae45375c8bcee8d01d3c6d5c321a6abb2e6d
Opcode Fuzzy Hash: a4ab23b94a56fbb4e4ab915d6a0181bd243ee2e30b5e95404a857257d08c8b81
Instruction Fuzzy Hash: 2211E95180479029EB3226246C40BBB7F884F97751F1A00BFE8C2722C1C67C5C52867D

Uniqueness

Uniqueness Score: -1.00%

Function 00404105 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404122
GetSysColor.USER32(00000000), ref: 00404160
SetTextColor.GDI32(?,00000000), ref: 0040416C
SetBkMode.GDI32(?,?), ref: 00404178
GetSysColor.USER32(?), ref: 0040418B
SetBkColor.GDI32(?,?), ref: 0040419B
DeleteObject.GDI32(?), ref: 004041B5
CreateBrushIndirect.GDI32(?), ref: 004041BF

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2fd397ab70c88e7053abfa2b1889d7e6adf273714bf8f91ffd366fbe1d5efa4b
Instruction ID: 549509973aaa983cd2a57f184cdff44cbcc336d3318ba047a0b32752f088f93e
Opcode Fuzzy Hash: 2fd397ab70c88e7053abfa2b1889d7e6adf273714bf8f91ffd366fbe1d5efa4b
Instruction Fuzzy Hash: 7D2162715007049BCB219F68DD4CB5BBBF8AF91714B048A3EEA96A66E0C734E984CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405137 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A050,00000000,0042277C,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000,?), ref: 00405170
lstrlenA.KERNEL32(00403156,0042A050,00000000,0042277C,759223A0,?,?,?,?,?,?,?,?,?,00403156,00000000), ref: 00405180
lstrcatA.KERNEL32(0042A050,00403156,00403156,0042A050,00000000,0042277C,759223A0), ref: 00405193
SetWindowTextA.USER32(0042A050,0042A050), ref: 004051A5
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051CB
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051E5
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051F3

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 2f522a59394b9be444cbcacf3a1b4d18be92345b96de9eacb0d1f76aaf85f54b
Instruction ID: 7d4789c60296e211bada9a9e2a19d16c38d622f2d1b0cadef69f4b7d7b7d07eb
Opcode Fuzzy Hash: 2f522a59394b9be444cbcacf3a1b4d18be92345b96de9eacb0d1f76aaf85f54b
Instruction Fuzzy Hash: CE21A971900118BFDB119FA5CD85ADEBFA9EF08354F04807AF844A6291C7398E408FA8

Uniqueness

Uniqueness Score: -1.00%

Function 004049F1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404A0C
GetMessagePos.USER32 ref: 00404A14
ScreenToClient.USER32(?,?), ref: 00404A2E
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A40
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A66

Strings

f, xrefs: 00404A42

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b233b2991907e98a40282691d164461162982266b543cde43f51771bab81e11a
Instruction ID: dd2724b276b0829887a11dc4f26b79c7971af77995a7330ace4ae867cc8e4813
Opcode Fuzzy Hash: b233b2991907e98a40282691d164461162982266b543cde43f51771bab81e11a
Instruction Fuzzy Hash: 4B018071940218BADB00DB94DD81BFEBBB8AF95711F10412BBA11B61C0C7B455018FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402CDD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402CF8
MulDiv.KERNEL32(00F62612,00000064,00F62616), ref: 00402D23
wsprintfA.USER32 ref: 00402D33
SetWindowTextA.USER32(?,?), ref: 00402D43
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402D55

Strings

verifying installer: %d%%, xrefs: 00402D2D

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: f8f7fb574b01a37347c2b5a7030e5195f98b1542352a9ab3f35e70a1f9b9ac5a
Instruction ID: 025fba79a5afffe449226ec8edfc98a8674e121caf39d96b1da50a976b993c92
Opcode Fuzzy Hash: f8f7fb574b01a37347c2b5a7030e5195f98b1542352a9ab3f35e70a1f9b9ac5a
Instruction Fuzzy Hash: AA01FF71640209FBEF249F60DE49FAE37A9FB04345F008039FA06B61D0DBB599568F59

Uniqueness

Uniqueness Score: -1.00%

Function 004027A3 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027F7
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402813
GlobalFree.KERNEL32(?), ref: 0040284C
GlobalFree.KERNEL32(00000000), ref: 0040285F
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402877
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040288B

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: a2aa54484539e5cf0e08f909926563fd1753a777fa44bb9cc822b41f9e16e333
Instruction ID: 78559feecc0fcc9b474bd36237e9e6194516f5e07b3510cecd676cf0fe7807ca
Opcode Fuzzy Hash: a2aa54484539e5cf0e08f909926563fd1753a777fa44bb9cc822b41f9e16e333
Instruction Fuzzy Hash: A4217C72C00224ABCF217FA5CD49DAE7F79EF09364B10823AF520762E1CA7959419F98

Uniqueness

Uniqueness Score: -1.00%

Function 00401D41 Relevance: 7.6, APIs: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D58
GetClientRect.USER32(?,?), ref: 00401D9F
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DCD
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401DDD
DeleteObject.GDI32(00000000), ref: 00401DF4

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 2a9a2f0378a9de6d229bce7b6285a7761bf43c3532daafe5d1da7bdf280b3250
Instruction ID: 7a7dd6c208c7a4d57f36c402fdb0fe657614a2e015b6db45afd3f1aca9992802
Opcode Fuzzy Hash: 2a9a2f0378a9de6d229bce7b6285a7761bf43c3532daafe5d1da7bdf280b3250
Instruction Fuzzy Hash: 30215172E00109AFDB05DF98DE44AEEBBB9FB58310F10403AF945F62A1CB789941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401DFF Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E02
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E1C
MulDiv.KERNEL32(00000000,00000000), ref: 00401E24
ReleaseDC.USER32(?,00000000), ref: 00401E35
CreateFontIndirectA.GDI32(0040B818), ref: 00401E84

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 4e2ac4968fbcfc45df335883300c5f964cad547b4711af948e6fa709055a9030
Instruction ID: a7e809a5f5c9b27870585acda152ffb90eb46fec6a88876af75f69e410eeec04
Opcode Fuzzy Hash: 4e2ac4968fbcfc45df335883300c5f964cad547b4711af948e6fa709055a9030
Instruction Fuzzy Hash: A6015672544240AFD7016B74AE4ABA93FB8EB59305F108839F141B61F2C7750505CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C7A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C92

Strings

!, xrefs: 00401C46

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: d1a5455d7aacc09bf912e97d7887ce2258fe7abf1a6a230a252a42dd7e2e40c1
Instruction ID: f2250e9d7a54984aac42e0f48c7b57cae310fb8b86675e6ff90c870375dfe4cb
Opcode Fuzzy Hash: d1a5455d7aacc09bf912e97d7887ce2258fe7abf1a6a230a252a42dd7e2e40c1
Instruction Fuzzy Hash: 4D216BB1944208BEEF06AFA4D98AAAD7FB5EB44304F10447EF501B61D1C7B88640DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004048E7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042A870,0042A870,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404802,000000DF,00000000,00000400,?), ref: 00404985
wsprintfA.USER32 ref: 0040498D
SetDlgItemTextA.USER32(?,0042A870), ref: 004049A0

Strings

%u.%u%s%s, xrefs: 0040496F

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 8f52a3d2b7158611b8ddfee5cd82df9920a420a3de20037d500134a76e905cd2
Instruction ID: e3696489e73bdb8ba2be03c53b0d6a47c9a41464d55e6eab91935fd2637341d8
Opcode Fuzzy Hash: 8f52a3d2b7158611b8ddfee5cd82df9920a420a3de20037d500134a76e905cd2
Instruction Fuzzy Hash: 0E11E473A441286BDB10A57D9C41EAF329CDB85374F254237FA26F31D1E978CC2282A9

Uniqueness

Uniqueness Score: -1.00%

Function 004059A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004059AE
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040347D,?,00000006,00000008,0000000A), ref: 004059B7
lstrcatA.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 004059C8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004059A8

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: dfed55a16eab86d89f3af7970decdd3a6c9dbbcd65d2cf450bad9cf681275afb
Instruction ID: 62df29c05e3eff7e61c48a1ee3c1863d20e1198667f6a1bd608fcc747cda2104
Opcode Fuzzy Hash: dfed55a16eab86d89f3af7970decdd3a6c9dbbcd65d2cf450bad9cf681275afb
Instruction Fuzzy Hash: 90D0A9B2211A30BAE20266259E09ECF2E088F06310B060037F200B21A1CA3D0D1287FE

Uniqueness

Uniqueness Score: -1.00%

Function 00402C2E Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402C93
RegCloseKey.ADVAPI32(?,?,?), ref: 00402C9C
RegCloseKey.ADVAPI32(?,?,?), ref: 00402CBD

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: effb832a44eae474ef75c518ed00afd6638a3a1b55d5a88c518eff5d822b0912
Instruction ID: 2c23bb11d6ae01cf130d195ddd5538b48d854d6e1d77fd04796d14e07e1bb179
Opcode Fuzzy Hash: effb832a44eae474ef75c518ed00afd6638a3a1b55d5a88c518eff5d822b0912
Instruction Fuzzy Hash: 70116A32504109FBEF129F90DF09B9E7B6DEB54340F204036BD45B61E0E7B59E15ABA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405A41 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,?,00405AAD,C:\,C:\,75923410,?,C:\Users\user\AppData\Local\Temp\,004057F8,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A4F
CharNextA.USER32(00000000), ref: 00405A54
CharNextA.USER32(00000000), ref: 00405A68

Strings

C:\, xrefs: 00405A42

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: b0e8f5e89ebadb76a027bec09a8a2b8523dc58ec169e45d2c78276560c1d622b
Instruction ID: 984e8433726efb403dd44e64a223cc5f2fc3fa985c42d0e1b55ccc4b068145f6
Opcode Fuzzy Hash: b0e8f5e89ebadb76a027bec09a8a2b8523dc58ec169e45d2c78276560c1d622b
Instruction Fuzzy Hash: F9F06251B04F656AFB2292744C94B7B5B8CCB55361F184667D980662C282784C418FAA

Uniqueness

Uniqueness Score: -1.00%

Function 00402D60 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F3E,00000001), ref: 00402D73
GetTickCount.KERNEL32 ref: 00402D91
CreateDialogParamA.USER32(0000006F,00000000,00402CDD,00000000), ref: 00402DAE
ShowWindow.USER32(00000000,00000005), ref: 00402DBC

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 92830607251259d7b21fa7f6a4b037c479e5f1f9739c9a057c3e932900ba9aab
Instruction ID: 761b86bf19c83071f88326f4280a43ff42c19d235faedd25f12e3078a496723d
Opcode Fuzzy Hash: 92830607251259d7b21fa7f6a4b037c479e5f1f9739c9a057c3e932900ba9aab
Instruction Fuzzy Hash: 62F0F431A05621ABC6217B64BE4C9DF7A64BB04B11B51047AF545B22E4DB744C878BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00402138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040851C,?,00000001,0040850C,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021BA
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,0040850C,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402269

Strings

C:\Program Files (x86)\Windows Provisioning, xrefs: 004021FA

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Program Files (x86)\Windows Provisioning
API String ID: 123533781-401443821
Opcode ID: cf4befc47563f774fc358faa8388fb8f5b1703afdd10f80262d3b658bae61c2e
Instruction ID: 754b6e0833e3014b2c682637ef6945f2e05814b0a8fe180c789646af90cdafbf
Opcode Fuzzy Hash: cf4befc47563f774fc358faa8388fb8f5b1703afdd10f80262d3b658bae61c2e
Instruction Fuzzy Hash: DD510771A00209AFCB04DFE4C988A9D7BB5EF48314F2045BAF515EB2D1DB799941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004050AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004050DA
CallWindowProcA.USER32(?,?,?,?), ref: 0040512B

Part of subcall function 004040EA: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004040FC

Strings

, xrefs: 004050BB

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: e888eab98be9719f5677808cf14d784dfa63dd3181dd39c0deeb7150e6d77b2f
Instruction ID: 77e6a5b3f6bfc6627eb61d09ca0671ae0e6a579f7b3ef645513b94fc1d41cd39
Opcode Fuzzy Hash: e888eab98be9719f5677808cf14d784dfa63dd3181dd39c0deeb7150e6d77b2f
Instruction Fuzzy Hash: FD017171600648ABDF206F11DD81A5B3B65EB84750F144036FA417A1D2D73A8C629F6E

Uniqueness

Uniqueness Score: -1.00%

Function 004059EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Roaming\Windows Provisioning,00402E30,C:\Users\user\AppData\Roaming\Windows Provisioning,C:\Users\user\AppData\Roaming\Windows Provisioning,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,80000000,00000003), ref: 004059F5
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Roaming\Windows Provisioning,00402E30,C:\Users\user\AppData\Roaming\Windows Provisioning,C:\Users\user\AppData\Roaming\Windows Provisioning,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,C:\Users\user\AppData\Roaming\Windows Provisioning\main_installer.exe,80000000,00000003), ref: 00405A03

Strings

C:\Users\user\AppData\Roaming\Windows Provisioning, xrefs: 004059EF

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Roaming\Windows Provisioning
API String ID: 2709904686-2535408887
Opcode ID: 4402843b33e5109e67992b99d0281bb7e81fac819ebae0ac34b6d7d52c4d849b
Instruction ID: 7185998fb8cc4c4ccda179d560b4c8302004e2739ffdff7e1043df3a51136750
Opcode Fuzzy Hash: 4402843b33e5109e67992b99d0281bb7e81fac819ebae0ac34b6d7d52c4d849b
Instruction Fuzzy Hash: E6D0C7B3519DB06EE30392549D04B9F6A48DF16710F094566E181A6195C6784D424BED

Uniqueness

Uniqueness Score: -1.00%

Function 00405B0E Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1E
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405B36
CharNextA.USER32(00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B47
lstrlenA.KERNEL32(00000000,?,00000000,00405D69,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B50

Memory Dump Source

Source File: 00000003.00000002.2119588577.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2119573088.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119605481.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.000000000042B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000430000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119624475.0000000000435000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2119692686.000000000043F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_main_installer.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: dddc0b46adaff912d9c321cf48e41736a02eed0190ef2a74250491e495455120
Instruction ID: 0197496b5d832c36441f5dd9a15c5c44ab4bce902fcb82863052ee0cfca36748
Opcode Fuzzy Hash: dddc0b46adaff912d9c321cf48e41736a02eed0190ef2a74250491e495455120
Instruction Fuzzy Hash: C9F0C231600418BFC7029BA5DD00D9EBBB8DF06250B2540BAE840F7210D634FE019BA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: post_install.exePID: 3304, Parent PID: 1864COMMON

Execution Graph

Execution Coverage:	24.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	9

Executed Functions

Function 005B26B0 Relevance: 135.9, APIs: 48, Strings: 29, Instructions: 1130sleepstringcomCOMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005B270C

Part of subcall function 005CE041: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE068

Part of subcall function 005B52A0: GetFileAttributesA.KERNELBASE(0000001C,.txt,00000004,postinstall,0000000B,7'[,?,3A04C82C,?,?), ref: 005B53BA
Part of subcall function 005B52A0: _mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(0000001C,?,?), ref: 005B53D2
Part of subcall function 005B52A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B53DF

new.LIBCMT ref: 005B2748

Part of subcall function 005CE041: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE049

Part of subcall function 005B6A80: new.LIBCMT ref: 005B6ADD
Part of subcall function 005B6A80: InitializeCriticalSection.KERNEL32(00000004), ref: 005B6AF4

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 005B27C2
wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,00000000,00000000,?,?), ref: 005B27D5
strtok.API-MS-WIN-CRT-STRING-L1-1-0(?,005D350C,005D34F6,00000000,005D34F6,00000000,005D34F6,00000000), ref: 005B286C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,exe=,00000004,post_install,%d) token %s,00000000,00000000), ref: 005B28A0
Sleep.KERNELBASE(000007D0), ref: 005B28AE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,inst=,00000005), ref: 005B28E4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,005D3540,00000002), ref: 005B2930
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000002), ref: 005B293D
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,005D350C), ref: 005B2A3D
OleInitialize.OLE32(00000000), ref: 005B2A67
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(shutdown.dat,?,post_install,Ole init result: %d,00000000), ref: 005B2A8F
remove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(shutdown.dat), ref: 005B2A9D
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,inst.dat,00000008), ref: 005B2B14
OleUninitialize.OLE32(00000000,00000011), ref: 005B2B65
new.LIBCMT ref: 005B2BA8
memset.VCRUNTIME140(00000000,00000000,00000088), ref: 005B2BC1
CreateEventW.KERNEL32(00000000,00000001,00000000,Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a), ref: 005B2C3D
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000088), ref: 005B2C54
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000088), ref: 005B2C5C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000088), ref: 005B2C64

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

CreateEventW.KERNEL32(00000000,00000001,00000000,Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a), ref: 005B2CBC
GetLastError.KERNEL32 ref: 005B2CCC
SetEvent.KERNEL32(00000000), ref: 005B2CE8
Sleep.KERNELBASE(000001F4), ref: 005B2CEF
CloseHandle.KERNEL32(?), ref: 005B2CFB
CreateEventW.KERNEL32(00000000,00000001,00000000,Global\KNIT_NFS_EXIT_CD1DF70D-8191-4840-B884-76C2620B8ED3), ref: 005B2D11
GetLastError.KERNEL32 ref: 005B2D21
SetEvent.KERNEL32(00000000), ref: 005B2D43
Sleep.KERNELBASE(000001F4), ref: 005B2D50
CloseHandle.KERNEL32(?), ref: 005B2D58
Sleep.KERNELBASE(000003E8), ref: 005B2D63
Sleep.KERNELBASE(000001F4), ref: 005B2D9F
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005B2DD0
Process32FirstW.KERNEL32(00000000,?), ref: 005B2DF7
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 005B2ECC
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list<T> too long,00000000,?,?,?,?), ref: 005B30D4
Process32NextW.KERNEL32(?,0000022C), ref: 005B3114
FindCloseChangeNotification.KERNELBASE(?), ref: 005B3128
WinExec.KERNEL32(00000000,00000000), ref: 005B31B6
Sleep.KERNEL32(000003E8), ref: 005B3249
Sleep.KERNEL32(000003E8), ref: 005B3266

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a, xrefs: 005B2C32, 005B2CB1
Failed to launch process monitor, xrefs: 005B3903
#, xrefs: 005B3890
cannot initialize network exit event (%d), xrefs: 005B2D28
STARTUP SET GU TYPE : %d, xrefs: 005B37C3, 005B37F8
list<T> too long, xrefs: 005B30CF
Reinstall : %d, xrefs: 005B2B90
post_install, xrefs: 005B288E, 005B2A73, 005B2AA9, 005B2B7C, 005B2B95, 005B2C0E, 005B3210, 005B378E, 005B37C8, 005B37FD, 005B383D, 005B38EB, 005B3908, 005B3925
inst.dat, xrefs: 005B2AC8
Failed to launch startup service, xrefs: 005B38E6
Show dialog: %d, xrefs: 005B3838
Failed to launch Update Service, xrefs: 005B2C09
shutdown.dat, xrefs: 005B2A8A, 005B2A98
stealth_manager, xrefs: 005B2C70
STARTUP GU TYPE : %d, xrefs: 005B3789
lic.dat, xrefs: 005B3754
taskkill /F /PID , xrefs: 005B3179
Failed to launch system service, xrefs: 005B3920
uninstall_util, xrefs: 005B2CD8, 005B2D2D
Ole init result: %d, xrefs: 005B2A6E
w, xrefs: 005B2B10
Install path: %s, xrefs: 005B2B77
%d) token %s, xrefs: 005B2889
inst=, xrefs: 005B28DE
retry cp dll, xrefs: 005B320B
cannot initialized app exit event (%d), xrefs: 005B2C6B, 005B2CD3
delete 'shutdown.dat': %d, xrefs: 005B2AA4
Global\KNIT_NFS_EXIT_CD1DF70D-8191-4840-B884-76C2620B8ED3, xrefs: 005B2D06
exe=, xrefs: 005B289A

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Sleep$Event$CloseCreate_invalid_parameter_noinfo_noreturn$ErrorHandleLaststrncmp$InitializeProcess32_stat64i32memsetstrtok$AttributesChangeCriticalExecFileFindFirstNextNotificationSectionSnapshotToolhelp32UninitializeXlength_error@std@@_callnewh_errno_mkdiratoimallocremovetolowerwcstombs
String ID: #$%d) token %s$Failed to launch Update Service$Failed to launch process monitor$Failed to launch startup service$Failed to launch system service$Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4a$Global\KNIT_NFS_EXIT_CD1DF70D-8191-4840-B884-76C2620B8ED3$Install path: %s$Ole init result: %d$Reinstall : %d$STARTUP GU TYPE : %d$STARTUP SET GU TYPE : %d$Show dialog: %d$cannot initialize network exit event (%d)$cannot initialized app exit event (%d)$delete 'shutdown.dat': %d$exe=$inst.dat$inst=$lic.dat$list<T> too long$post_install$retry cp dll$shutdown.dat$stealth_manager$taskkill /F /PID $uninstall_util$w
API String ID: 1867157247-3166035333
Opcode ID: 1fdc082be18e6eb29192be33e4e116f15534e24b5a183baffd4f6c0b298dea34
Instruction ID: e628d30d082a724082685c8a406e3606dc095f3675b94c74ee0e7ed3cb760b4d
Opcode Fuzzy Hash: 1fdc082be18e6eb29192be33e4e116f15534e24b5a183baffd4f6c0b298dea34
Instruction Fuzzy Hash: 4592B370E002559FDB25AF68DC0ABEDBFB4BF55300F14419AE405AB282DB716B45CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C2100 Relevance: 38.6, APIs: 12, Strings: 10, Instructions: 140
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,75920F00,00000000,?,?,?,?,?,?,00000000,005D0A48,000000FF,?,005B2D79), ref: 005C2152
OpenServiceA.ADVAPI32(00000000,?,00010002), ref: 005C217D
ChangeServiceConfig2W.ADVAPI32(00000000), ref: 005C21C0
DeleteService.ADVAPI32(00000000), ref: 005C21C7
CloseServiceHandle.ADVAPI32(00000000), ref: 005C21D6
CloseServiceHandle.ADVAPI32(00000000), ref: 005C21FB
GetLastError.KERNEL32 ref: 005C2202
CloseServiceHandle.ADVAPI32(00000000), ref: 005C221C
GetLastError.KERNEL32 ref: 005C222B
CloseServiceHandle.ADVAPI32(00000000), ref: 005C224C
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,005D0A48,000000FF,?,005B2D79), ref: 005C2269
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,005D0A48,000000FF,?,005B2D79), ref: 005C226D

Strings

Can't find service, xrefs: 005C2250
Can't delete the service %d, xrefs: 005C2209
Error can't open service %s for deleting: %d, xrefs: 005C2233
%s enter {, xrefs: 005C2130
y-[, xrefs: 005C2122, 005C22B1
OpenSCManager failed (%d), xrefs: 005C2274
Successfully delete (or pending delete) Service %s, xrefs: 005C21E8
CStealthManager::deleteService, xrefs: 005C212B, 005C2286
%s exit }, xrefs: 005C228B
stealth_manager, xrefs: 005C2135, 005C21ED, 005C220E, 005C2238, 005C2255, 005C2279, 005C2290

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$CloseHandle$ErrorLast$Open$ChangeConfig2DeleteManager
String ID: %s enter {$%s exit }$CStealthManager::deleteService$Can't delete the service %d$Can't find service$Error can't open service %s for deleting: %d$OpenSCManager failed (%d)$Successfully delete (or pending delete) Service %s$stealth_manager$y-[
API String ID: 219838797-1123794500
Opcode ID: 9d108cd8b2427bc40793c7329d861f3c0008f6fd97e38f2765c973f758a9f380
Instruction ID: b990a164dbdf2e2284858a46f026c3d24ba7eb72c7bf54a1e08230dcc71bda04
Opcode Fuzzy Hash: 9d108cd8b2427bc40793c7329d861f3c0008f6fd97e38f2765c973f758a9f380
Instruction Fuzzy Hash: 16416475D45209AFCB209F99DC4AEAEBFB8FF58700F004457F905A7251E770AA048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C6A90 Relevance: 35.4, APIs: 11, Strings: 9, Instructions: 419
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005CC150: WTSEnumerateSessionsA.WTSAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 005CC172
Part of subcall function 005CC150: WTSFreeMemory.WTSAPI32(?), ref: 005CC199

WTSQueryUserToken.WTSAPI32(00000000,00000000,005D39AC,00000000,3A04C82C,00000000), ref: 005C6B37
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005C6B58
CloseHandle.KERNEL32(00000000,?), ref: 005C6C03
GetLastError.KERNEL32 ref: 005C6C0B
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,005D39AC,00000000,3A04C82C,00000000), ref: 005C6C36
FindFirstFileW.KERNELBASE(?,?,?,?,?), ref: 005C6E83
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,extensions.json,0000000F,005D3808,00000001,?,00000000,000000FF,00000000,-00000002,?,?,005D39AC,005D39AC), ref: 005C6FDD
FindNextFileW.KERNELBASE(00000000,00000010,005D39AC,005D39AC,?,?,?), ref: 005C701D
GetLastError.KERNEL32(?,?,?), ref: 005C702B
FindClose.KERNEL32(00000000,?,?,?), ref: 005C704A
GetLastError.KERNEL32(?,?,?), ref: 005C709F

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

Strings

Roaming\, xrefs: 005C6DB0
Query user token error = %d, xrefs: 005C6C0E
Error in FindFirstFile : %d, xrefs: 005C70A2
extensions.json, xrefs: 005C6FAC
Mozilla\Firefox\Profiles\, xrefs: 005C6DC7, 005C6DD8
Directory path is too long., xrefs: 005C6BD9
Error in FindNextFile : %d, xrefs: 005C7037
\AppData\, xrefs: 005C6CC2
stealth_manager, xrefs: 005C6BDE, 005C6C13, 005C703C, 005C70A7

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ErrorFindLast$CloseFileFolderPath$EnumerateFirstFreeHandleMemoryNextQuerySessionsSpecialTokenUser_stat64i32
String ID: Directory path is too long.$Error in FindFirstFile : %d$Error in FindNextFile : %d$Mozilla\Firefox\Profiles\$Query user token error = %d$Roaming\$\AppData\$extensions.json$stealth_manager
API String ID: 420821120-1158375998
Opcode ID: 45646c55b844c023e5f8a085c552a0bcd461fb86c807e2f2d28653a2c8454f1c
Instruction ID: 358e8fd83557ed66838cae961f60afd58dcb32543ce05909f01daf664d6e72ef
Opcode Fuzzy Hash: 45646c55b844c023e5f8a085c552a0bcd461fb86c807e2f2d28653a2c8454f1c
Instruction Fuzzy Hash: 540269709042299EDB24DB64CC9DBEEBBB8FF54304F1001DAE40AA6191EB756F85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 005C1160 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 194
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,3A04C82C,00000000,00000000), ref: 005C11AF
_CxxThrowException.VCRUNTIME140(?,005DCC24,00000011,Error on service control manager), ref: 005C1208
GetLastError.KERNEL32 ref: 005C11BB

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

CreateServiceA.ADVAPI32(00000000,?,?,C0000012,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 005C12D4
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000005,?,00000004,?,00000003), ref: 005C12E0
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000005,?,00000004,?,00000003), ref: 005C12E9
ChangeServiceConfig2W.ADVAPI32(00000000,00000002,00000004,?,?,?,?,?,?,?,00000005,?), ref: 005C1384
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000005,?), ref: 005C1391
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000005,?), ref: 005C1394

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

Service Display name: %s, xrefs: 005C1285
CStealthManager::setupStartUpService, xrefs: 005C118F, 005C1396
%s enter {, xrefs: 005C1194
Service name: %s, xrefs: 005C126A
ServiceExe path: %s, xrefs: 005C124F
Error Creating services, xrefs: 005C1310
Error Creating services %d, xrefs: 005C12FC
Error on service control manager: %d, xrefs: 005C11C2
Error on service control manager, xrefs: 005C11E2
%s exit }, xrefs: 005C139B
stealth_manager, xrefs: 005C1199, 005C11C7, 005C1254, 005C126F, 005C128A, 005C1301, 005C13A0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$_invalid_parameter_noinfo_noreturn$CloseHandle$ErrorLast$ChangeConfig2CreateExceptionManagerOpenThrow
String ID: %s enter {$%s exit }$CStealthManager::setupStartUpService$Error Creating services$Error Creating services %d$Error on service control manager$Error on service control manager: %d$Service Display name: %s$Service name: %s$ServiceExe path: %s$stealth_manager
API String ID: 1505281203-3321287816
Opcode ID: 71183ec9ede4dfc5e56008f9eb1cecb66b56fbb94dca1772c8e4876267837717
Instruction ID: b9301befffa4c85cf60a9ab25178552fdc744000060138f5eccff1a36730a694
Opcode Fuzzy Hash: 71183ec9ede4dfc5e56008f9eb1cecb66b56fbb94dca1772c8e4876267837717
Instruction Fuzzy Hash: 91715070A40248EEEB20EBA8CC4AFDE7FB5FB45704F50005BE505A72C2D7B569458F66

Uniqueness

Uniqueness Score: -1.00%

Function 005C0B50 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 194
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,3A04C82C,00000000,00000000), ref: 005C0B9F
_CxxThrowException.VCRUNTIME140(?,005DCC24,00000011,Error on service control manager), ref: 005C0BF8
GetLastError.KERNEL32 ref: 005C0BAB

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

CreateServiceA.ADVAPI32(00000000,?,?,C0000012,00000010,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 005C0CC1
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000012,?,00000011,?,00000010), ref: 005C0CCD
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000012,?,00000011,?,00000010), ref: 005C0CD6
ChangeServiceConfig2W.ADVAPI32(00000000,00000002,00000011,?,?,?,?,?,?,?,00000012,?), ref: 005C0D71
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000012,?), ref: 005C0D7E
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000012,?), ref: 005C0D81

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

Service Display name: %s, xrefs: 005C0C75
%s enter {, xrefs: 005C0B84
Service name: %s, xrefs: 005C0C5A
ServiceExe path: %s, xrefs: 005C0C3F
Error Creating services, xrefs: 005C0CFD
Error Creating services %d, xrefs: 005C0CE9
Error on service control manager: %d, xrefs: 005C0BB2
CStealthManager::setupNetworkFilterService, xrefs: 005C0B7F, 005C0D83
Error on service control manager, xrefs: 005C0BD2
%s exit }, xrefs: 005C0D88
stealth_manager, xrefs: 005C0B89, 005C0BB7, 005C0C44, 005C0C5F, 005C0C7A, 005C0CEE, 005C0D8D

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$_invalid_parameter_noinfo_noreturn$CloseHandle$ErrorLast$ChangeConfig2CreateExceptionManagerOpenThrow
String ID: %s enter {$%s exit }$CStealthManager::setupNetworkFilterService$Error Creating services$Error Creating services %d$Error on service control manager$Error on service control manager: %d$Service Display name: %s$Service name: %s$ServiceExe path: %s$stealth_manager
API String ID: 1505281203-1686654831
Opcode ID: 7ef3a44d3391b716f12dd154ed5fead23ba4a8f303ba14e936fde78c31663667
Instruction ID: 265e73f9b30bd0c52d06f242415cd2d6bec205ab2c7cd7f4ec534ce9231c3a15
Opcode Fuzzy Hash: 7ef3a44d3391b716f12dd154ed5fead23ba4a8f303ba14e936fde78c31663667
Instruction Fuzzy Hash: F7715E70A44209EEEB20EB98CC4AFEEBFB5FB48704F50005BE505A72C2D7B569458F61

Uniqueness

Uniqueness Score: -1.00%

Function 005C1820 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 212serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,3A04C82C,00000000,00000000), ref: 005C186F
CreateServiceA.ADVAPI32(00000000,?,?,C0000012,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 005C1946
GetLastError.KERNEL32(?,?,?,?,?,?,?,0000000B,?,0000000A,?,00000009), ref: 005C1956
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0000000B,?,0000000A,?,00000009), ref: 005C195F

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

_CxxThrowException.VCRUNTIME140(?,005DCC24,?,00000000,?,?,?,?,?,?,?,?,?,?,0000000B,?), ref: 005C1999
ChangeServiceConfig2W.ADVAPI32(00000000,00000002,0000000A,?,?,?,?,?,?,?,0000000B,?), ref: 005C1A78
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0000000B,?), ref: 005C1A85
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0000000B,?), ref: 005C1A88
GetLastError.KERNEL32 ref: 005C1B07

Strings

Service path: %s, xrefs: 005C18C1
%s enter {, xrefs: 005C1854
Service name: %s, xrefs: 005C18DC
Error Creating services %d, xrefs: 005C196E
Error on service control manager: %d, xrefs: 005C1B10
CStealthManager::setupProcessMonitorService, xrefs: 005C184F, 005C1AEB
%s exit }, xrefs: 005C1AF0
stealth_manager, xrefs: 005C1859, 005C18C6, 005C18E1, 005C18FC, 005C1973, 005C1AF5
Service display name: %s, xrefs: 005C18F7

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$CloseHandle$ErrorLast$ChangeConfig2CreateExceptionManagerOpenThrow
String ID: %s enter {$%s exit }$CStealthManager::setupProcessMonitorService$Error Creating services %d$Error on service control manager: %d$Service display name: %s$Service name: %s$Service path: %s$stealth_manager
API String ID: 2238952430-1689939351
Opcode ID: 51707b9357dfbf966e744fac1b3e5990d8b769712b1500145359a8229f9162ab
Instruction ID: 186a3ce80e9248e10f0c7667e1a314465a4d10ee1b5bdb6a751873de83b89499
Opcode Fuzzy Hash: 51707b9357dfbf966e744fac1b3e5990d8b769712b1500145359a8229f9162ab
Instruction Fuzzy Hash: A0812B70940219EEEB20DB98CC4AFEEBFB9FB09700F50405AE415B7282D7B56945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 005C1E20 Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 201serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.SECHOST(00000000,00000000,000F003F,3A04C82C,750292F0,00000000), ref: 005C1E6F
CreateServiceA.ADVAPI32(00000000,?,?,C0000012,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000,?,0000000F,?), ref: 005C1EF2
GetLastError.KERNEL32 ref: 005C1F02
_CxxThrowException.VCRUNTIME140(?,005DCC24,00000011,Error Creating services), ref: 005C1F51
CloseServiceHandle.ADVAPI32(00000000), ref: 005C1F0B

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

ChangeServiceConfig2W.ADVAPI32 ref: 005C2030
CloseServiceHandle.ADVAPI32(00000000), ref: 005C203D
CloseServiceHandle.ADVAPI32(00000000), ref: 005C2040
GetLastError.KERNEL32 ref: 005C20BF

Strings

%s enter {, xrefs: 005C1E54
Error Creating services, xrefs: 005C1F2E
CStealthManager::setupUpdateService, xrefs: 005C1E4F, 005C20A3
Error Creating services %d, xrefs: 005C1F1A
Error on service control manager: %d, xrefs: 005C20C6
Error on service control manager, xrefs: 005C20EA
%s exit }, xrefs: 005C20A8
stealth_manager, xrefs: 005C1E59, 005C1F1F, 005C20AD, 005C20CB

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$CloseHandle$ErrorLast$ChangeConfig2CreateExceptionManagerOpenThrow
String ID: %s enter {$%s exit }$CStealthManager::setupUpdateService$Error Creating services$Error Creating services %d$Error on service control manager$Error on service control manager: %d$stealth_manager
API String ID: 2238952430-3493398701
Opcode ID: 390a95121a52eb91a50e9255026248ef2208a74f440a4703bfda6834c159959e
Instruction ID: e9a3cfd416d26ba0b13a281cd65fccf9dc49caeb0a3e441959726578eb557690
Opcode Fuzzy Hash: 390a95121a52eb91a50e9255026248ef2208a74f440a4703bfda6834c159959e
Instruction Fuzzy Hash: 18716F70900209AFEB20EBA8CC4ABEEBFB5FB45700F50005AE515BB2D2D7B56945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 005C1B20 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 122serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.ADVAPI32(00000000,00000000,000F0001,00000000,00000000), ref: 005C1B8E
OpenServiceA.ADVAPI32(00000000,?,A0000012), ref: 005C1BB0
ChangeServiceConfig2W.ADVAPI32(00000000), ref: 005C1C13
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 005C1C1E
GetLastError.KERNEL32 ref: 005C1C2A

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

CloseServiceHandle.ADVAPI32(00000000), ref: 005C1C44
CloseServiceHandle.ADVAPI32(00000000), ref: 005C1C51
GetLastError.KERNEL32 ref: 005C1C59
CloseServiceHandle.ADVAPI32(00000000), ref: 005C1C75
GetLastError.KERNEL32 ref: 005C1C7D

Strings

Launching process monitor service: %s, xrefs: 005C1B73
Cannot open service, error code: %d, xrefs: 005C1C60
Failed to start the service, error code: %d, xrefs: 005C1C31
Cannot open OpenSCManager error code %d, xrefs: 005C1C84
stealth_manager, xrefs: 005C1B78, 005C1C36, 005C1C65, 005C1C89

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$CloseErrorHandleLast$Open$ChangeConfig2ManagerStart
String ID: Cannot open OpenSCManager error code %d$Cannot open service, error code: %d$Failed to start the service, error code: %d$Launching process monitor service: %s$stealth_manager
API String ID: 845704753-3905018406
Opcode ID: c2f6a58910efbf22787aa60db7e2ee1e5e4ed69ff5c00ae6ea016a7debef8055
Instruction ID: 25788b66679380bb482e8294f9c2c42ef9787492e951e9edc6c965b007213bbf
Opcode Fuzzy Hash: c2f6a58910efbf22787aa60db7e2ee1e5e4ed69ff5c00ae6ea016a7debef8055
Instruction Fuzzy Hash: A6416E71941209EFDB209FD4DC4EBEEBBB8FB59704F10001BF501A6281E7B55A08CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 005CADA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,3A04C82C,?,?,005CAD27,00000000,?,005CA9A5,005C862E,00000009), ref: 005CADC1
OpenProcessToken.ADVAPI32(00000000,?,?,005CAD27,00000000,?,005CA9A5,005C862E,00000009), ref: 005CADC8
LookupPrivilegeValueW.ADVAPI32(00000000), ref: 005CAE07
AdjustTokenPrivileges.KERNELBASE(00000000,00000000,?,00000010,00000000,00000000,?,?,?,SeDebugPrivilege,?), ref: 005CAE42
CloseHandle.KERNEL32(?,?,?,?,SeDebugPrivilege,?), ref: 005CAE4B

Strings

SeDebugPrivilege, xrefs: 005CADDF

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 4c5dca51d5d4ecf5796287406efa943db3caee81104373efdb028f64183956d2
Instruction ID: dd7e4e65de98ab9a6f52f74e90bebd67a2834145ecea534626a479499b67fe60
Opcode Fuzzy Hash: 4c5dca51d5d4ecf5796287406efa943db3caee81104373efdb028f64183956d2
Instruction Fuzzy Hash: 3F112871509301AFE320DFA0D84AB1BBBE8FB98704F004A1EF59496290D7B5E648DB93

Uniqueness

Uniqueness Score: -1.00%

Function 005CA980 Relevance: 3.1, APIs: 2, Instructions: 60nativeCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000030,005C862E,00000009), ref: 005CA9B2
NtWow64QueryInformationProcess64.NTDLL(00000000,00000000,?,00000030,?,?,005C862E,00000009), ref: 005CA9DB

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: InformationProcess64QueryWow64memset
String ID:
API String ID: 2094615266-0
Opcode ID: d66d6f013f7d27627efda06f44133b1097979aecb005ec38dd079f757229f2b1
Instruction ID: a98ca0e82321ed938b5557f05da38204c34b6c045642f82554fd07f8add8aa17
Opcode Fuzzy Hash: d66d6f013f7d27627efda06f44133b1097979aecb005ec38dd079f757229f2b1
Instruction Fuzzy Hash: A111A0316143065BD314EF64DC92B6BB7E8AFC5310F00061EB94687280EBB0A804C6A3

Uniqueness

Uniqueness Score: -1.00%

Function 005CBC70 Relevance: 3.0, APIs: 2, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,000000C0,?,?,005C862E,?,?,?,?,?,?,005C862E,00000009,00000000), ref: 005CBC9D
NtWow64ReadVirtualMemory64.NTDLL(?,?,005C862E,?,000000C8,00000000,?,?,?,005C862E,?,?,?), ref: 005CBCDD

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Memory64ReadVirtualWow64memset
String ID:
API String ID: 1380373875-0
Opcode ID: 6767dc732231929b6ab2684e555c533e1cf28ab061db0c7b738e39f9a75a23d7
Instruction ID: 3742f9978b46b1d4696300e3dbc2f2c34c662713a1959fd010c1c55533e93dc8
Opcode Fuzzy Hash: 6767dc732231929b6ab2684e555c533e1cf28ab061db0c7b738e39f9a75a23d7
Instruction Fuzzy Hash: 6501A272601306ABE7209F55DC42F96BBA8FF86715F00422DF918A76C0E771A914C796

Uniqueness

Uniqueness Score: -1.00%

Function 005CAA20 Relevance: 3.0, APIs: 2, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(0000000A,00000000,000003B7,00000000,3F800000,005C862E,005C862E,00000009,00000000), ref: 005CAA43
NtWow64ReadVirtualMemory64.NTDLL(?,005C862E,005C862E,00000009,000003B8,00000000,?,00000000,3F800000,005C862E,005C862E,00000009,00000000), ref: 005CAA83

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Memory64ReadVirtualWow64memset
String ID:
API String ID: 1380373875-0
Opcode ID: 388e583dbb92507e85687b7984d6907a559d287b51236e33666b878a41317b21
Instruction ID: ea688a6573ce8bf163181888f0e9eedb7ec471d8a1e0c8a976ea95bb3d729fb2
Opcode Fuzzy Hash: 388e583dbb92507e85687b7984d6907a559d287b51236e33666b878a41317b21
Instruction Fuzzy Hash: 0F01D632704305ABD7219F55DC42F97BFA9FF86714F04022DF954AB280E771EA14C692

Uniqueness

Uniqueness Score: -1.00%

Function 005CBBF0 Relevance: 3.0, APIs: 2, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000009,00000000,00000044,?,00000000,005C862E,?,?,?,005C862E,00000009,00000000), ref: 005CBC13
NtWow64ReadVirtualMemory64.NTDLL(?,?,005C862E,?,00000048,00000000,?,?,00000000,005C862E,?,?,?,005C862E,00000009,00000000), ref: 005CBC50

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Memory64ReadVirtualWow64memset
String ID:
API String ID: 1380373875-0
Opcode ID: 0f9b1c5d014d21dcac4424441e6e4045057cc533a05022515a09efa951c1516d
Instruction ID: 3043963733ae7e0aa23f9d2139b9b1c134d0243c45d0316eb9781a651ef74cbb
Opcode Fuzzy Hash: 0f9b1c5d014d21dcac4424441e6e4045057cc533a05022515a09efa951c1516d
Instruction Fuzzy Hash: 9401D6727003066BD7109F55DC46F9BBBA8FF85714F00422DFA18A72C0E770AA18C696

Uniqueness

Uniqueness Score: -1.00%

Function 005CAAA0 Relevance: 1.6, APIs: 1, Instructions: 86nativeCOMMON

Download Yara Rule

APIs

NtWow64ReadVirtualMemory64.NTDLL(?,?,?,?,?,00000000,005D1728,?,3A04C82C,?,00000000,005C862E,005D1728,000000FF), ref: 005CAB4C

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Memory64ReadVirtualWow64
String ID:
API String ID: 3357887247-0
Opcode ID: e15879e9e10abbb6a02116d9f2f1abd3435a20a2c441bba6f7b27aac4595470f
Instruction ID: 60355c007942ea922bfed63b1fa6eb5f11496d3c1055723eb31e789f132aa780
Opcode Fuzzy Hash: e15879e9e10abbb6a02116d9f2f1abd3435a20a2c441bba6f7b27aac4595470f
Instruction Fuzzy Hash: 05216D72A006099FDB11CF99D845BAEBBF8FF49714F10461EE814A7640DB75A9048BA1

Uniqueness

Uniqueness Score: -1.00%

Function 005C49A0 Relevance: 93.8, APIs: 19, Strings: 34, Instructions: 1095fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

GetFileAttributesA.KERNELBASE(?,?,?,?,3A04C82C,00000000,00000000), ref: 005C4A98
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C4BC8
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000,?,?,?,?,?,?,?,3A04C82C,00000000,00000000), ref: 005C4CCB
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C4D8C
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,?,?,?,?,3A04C82C,00000000,00000000), ref: 005C4B01

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

PocoCrypto.dll, xrefs: 005C4AAF
\PocoXML.dll, xrefs: 005C5553
PocoNetSSL.dll, xrefs: 005C51B9
libssl.dll, xrefs: 005C58B1
Update poco crypto dll, xrefs: 005C4B96
Update poco foundation dll, xrefs: 005C4D60
libcrypto.dll, xrefs: 005C56F3
8, xrefs: 005C59B1
PocoXML.dll, xrefs: 005C5535
%s enter {, xrefs: 005C49D8
Update poco netssl dll, xrefs: 005C529A
Update poco xml dll, xrefs: 005C5616
%s exit }, xrefs: 005C5ACB
stealth_manager, xrefs: 005C49DD, 005C4B9B, 005C4D65, 005C4F23, 005C50E1, 005C529F, 005C545D, 005C561B, 005C57D9, 005C59C6, 005C5AB5, 005C5AD0
PocoFoundation.dll, xrefs: 005C4C7F
libs\, xrefs: 005C4A63
CStealthManager::checkAndUpdatePocoLibrary, xrefs: 005C49D3, 005C5AC6
PocoUtil.dll, xrefs: 005C5377
\libssl.dll, xrefs: 005C58CF
\PocoJSON.dll, xrefs: 005C4E5B
\libcrypto.dll, xrefs: 005C5711
Update libcrypto dll, xrefs: 005C57D4
\PocoFoundation.dll, xrefs: 005C4C9D
PocoJSON.dll, xrefs: 005C4E3D
\PocoNetSSL.dll, xrefs: 005C51D7
Update poco util dll, xrefs: 005C5458
Update libssl dll, xrefs: 005C59C1
PocoNet.dll, xrefs: 005C4FFB
Update poco json dll, xrefs: 005C4F1E
\PocoUtil.dll, xrefs: 005C5395
[%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C5AB0
\PocoCrypto.dll, xrefs: 005C4ACD
Update poco net dll, xrefs: 005C50DC
\PocoNet.dll, xrefs: 005C5019

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$File$Copy_stat64i32$Attributes
String ID: %s enter {$%s exit }$8$CStealthManager::checkAndUpdatePocoLibrary$PocoCrypto.dll$PocoFoundation.dll$PocoJSON.dll$PocoNet.dll$PocoNetSSL.dll$PocoUtil.dll$PocoXML.dll$Update libcrypto dll$Update libssl dll$Update poco crypto dll$Update poco foundation dll$Update poco json dll$Update poco net dll$Update poco netssl dll$Update poco util dll$Update poco xml dll$[%d][%d][%d][%d][%d][%d][%d][%d][%d]$\PocoCrypto.dll$\PocoFoundation.dll$\PocoJSON.dll$\PocoNet.dll$\PocoNetSSL.dll$\PocoUtil.dll$\PocoXML.dll$\libcrypto.dll$\libssl.dll$libcrypto.dll$libs\$libssl.dll$stealth_manager
API String ID: 3217670562-2732279055
Opcode ID: b9ce5914f25a73dd296144c4407cade073c31ed6ae32cf402bc3bf648d23ccb1
Instruction ID: 681fdf5f87af6cc91e111584f27e929486cbb39f30c451557d13510cdc9743cc
Opcode Fuzzy Hash: b9ce5914f25a73dd296144c4407cade073c31ed6ae32cf402bc3bf648d23ccb1
Instruction Fuzzy Hash: 7FA28470D04248DEEF14DFA8D849BEE7FB4BB05304F60449DD451AB282D7B5AA45CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C22D0 Relevance: 79.0, APIs: 30, Strings: 15, Instructions: 266
servicesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,750292F0,00000000), ref: 005C2322
OpenServiceA.ADVAPI32(00000000,?,00000026), ref: 005C234E
ChangeServiceConfig2W.ADVAPI32(00000000), ref: 005C23B1
GetTickCount.KERNEL32 ref: 005C23BD
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 005C23CF
Sleep.KERNEL32(?,?), ref: 005C2424
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?,?,?), ref: 005C2437
GetTickCount.KERNEL32 ref: 005C245F
ControlService.ADVAPI32(00000000,00000001,?), ref: 005C2489
Sleep.KERNEL32(?), ref: 005C24AA
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 005C24B9
GetTickCount.KERNEL32 ref: 005C24D1
CloseServiceHandle.ADVAPI32(00000000), ref: 005C24ED
CloseServiceHandle.ADVAPI32(?), ref: 005C24F0
GetLastError.KERNEL32(?,?), ref: 005C250E
CloseServiceHandle.ADVAPI32(00000000), ref: 005C2531
CloseServiceHandle.ADVAPI32(00000000), ref: 005C2534
CloseServiceHandle.ADVAPI32(00000000), ref: 005C2557
CloseServiceHandle.ADVAPI32(?), ref: 005C255A
CloseServiceHandle.ADVAPI32(00000000), ref: 005C257D
CloseServiceHandle.ADVAPI32(?), ref: 005C2580
GetLastError.KERNEL32 ref: 005C25A6
CloseServiceHandle.ADVAPI32(00000000), ref: 005C25C6
CloseServiceHandle.ADVAPI32(00000000), ref: 005C25C9
GetLastError.KERNEL32 ref: 005C25D8
CloseServiceHandle.ADVAPI32(00000000), ref: 005C25F9
CloseServiceHandle.ADVAPI32(00000000), ref: 005C2616
GetLastError.KERNEL32 ref: 005C261A

Strings

/,[, xrefs: 005C22F2, 005C265C
Can't find service, xrefs: 005C25FD
Wait timed out, xrefs: 005C253B
Service stop timed out., xrefs: 005C24F7
OpenService [%s] failed (%d), xrefs: 005C25E0
Service stopped successfully., xrefs: 005C244B, 005C2561
QueryServiceStatusEx 2 failed (%d), xrefs: 005C258E
ControlService failed (%d), xrefs: 005C259C
QueryServiceStatusEx 1 failed (%d), xrefs: 005C2515
%s enter {, xrefs: 005C2300
OpenSCManager failed (%d), xrefs: 005C2621
QueryServiceStatusEx 3 failed (%d), xrefs: 005C25AD
CStealthManager::stopService, xrefs: 005C22FB, 005C2633
%s exit }, xrefs: 005C2638
stealth_manager, xrefs: 005C2305, 005C2450, 005C24FC, 005C251A, 005C2540, 005C2566, 005C25B2, 005C25E5, 005C2602, 005C2626, 005C263D

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$CloseHandle$ErrorLast$CountQueryStatusTick$OpenSleep$ChangeConfig2ControlManager
String ID: %s enter {$%s exit }$/,[$CStealthManager::stopService$Can't find service$ControlService failed (%d)$OpenSCManager failed (%d)$OpenService [%s] failed (%d)$QueryServiceStatusEx 1 failed (%d)$QueryServiceStatusEx 2 failed (%d)$QueryServiceStatusEx 3 failed (%d)$Service stop timed out.$Service stopped successfully.$Wait timed out$stealth_manager
API String ID: 656698291-3649251010
Opcode ID: 9cbb77da90088b4ef825f1d3026012949de504c9cf4cb9fe3390eedbe2b75d9d
Instruction ID: e32986275f6c999e0dad5e23bb1611baae33c437b5c19e406f91f9b23c8a1849
Opcode Fuzzy Hash: 9cbb77da90088b4ef825f1d3026012949de504c9cf4cb9fe3390eedbe2b75d9d
Instruction Fuzzy Hash: CC914071A45219AFDB209BD4DC4AFAE7F78FF18700F104417E505AB291E7745A44CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C4C66 Relevance: 77.8, APIs: 16, Strings: 28, Instructions: 833fileCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000,?,?,?,?,?,?,?,3A04C82C,00000000,00000000), ref: 005C4CCB
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C4D8C
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,3A04C82C), ref: 005C4E89

Strings

\PocoXML.dll, xrefs: 005C5553
PocoNetSSL.dll, xrefs: 005C51B9
libssl.dll, xrefs: 005C58B1
Update poco foundation dll, xrefs: 005C4D60
libcrypto.dll, xrefs: 005C56F3
PocoXML.dll, xrefs: 005C5535
Update poco netssl dll, xrefs: 005C529A
Update poco xml dll, xrefs: 005C5616
%s exit }, xrefs: 005C5ACB
stealth_manager, xrefs: 005C4D65, 005C4F23, 005C50E1, 005C529F, 005C545D, 005C561B, 005C57D9, 005C5AB5, 005C5AD0
PocoFoundation.dll, xrefs: 005C4C7F
CStealthManager::checkAndUpdatePocoLibrary, xrefs: 005C5AC6
PocoUtil.dll, xrefs: 005C5377
\libssl.dll, xrefs: 005C58CF
\PocoJSON.dll, xrefs: 005C4E5B
\libcrypto.dll, xrefs: 005C5711
8, xrefs: 005C58E6
Update libcrypto dll, xrefs: 005C57D4
\PocoFoundation.dll, xrefs: 005C4C9D
PocoJSON.dll, xrefs: 005C4E3D
\PocoNetSSL.dll, xrefs: 005C51D7
Update poco util dll, xrefs: 005C5458
PocoNet.dll, xrefs: 005C4FFB
Update poco json dll, xrefs: 005C4F1E
\PocoUtil.dll, xrefs: 005C5395
[%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C5AB0
Update poco net dll, xrefs: 005C50DC
\PocoNet.dll, xrefs: 005C5019

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _stat64i32$CopyFile
String ID: %s exit }$8$CStealthManager::checkAndUpdatePocoLibrary$PocoFoundation.dll$PocoJSON.dll$PocoNet.dll$PocoNetSSL.dll$PocoUtil.dll$PocoXML.dll$Update libcrypto dll$Update poco foundation dll$Update poco json dll$Update poco net dll$Update poco netssl dll$Update poco util dll$Update poco xml dll$[%d][%d][%d][%d][%d][%d][%d][%d][%d]$\PocoFoundation.dll$\PocoJSON.dll$\PocoNet.dll$\PocoNetSSL.dll$\PocoUtil.dll$\PocoXML.dll$\libcrypto.dll$\libssl.dll$libcrypto.dll$libssl.dll$stealth_manager
API String ID: 3823094038-755406834
Opcode ID: d6a4be9c9bf3ef4db91ea005b64541d697ffd51a2e97b7672f97ecda5f37d757
Instruction ID: 36365920433c03602684e04ffa4b6a3a292b4e6eb555d65284cad9914876d9cc
Opcode Fuzzy Hash: d6a4be9c9bf3ef4db91ea005b64541d697ffd51a2e97b7672f97ecda5f37d757
Instruction Fuzzy Hash: 51729E70D04248DEEF14DFE8D849BEE7FB4BB05304F604499E4516B282E775AA49CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C4E24 Relevance: 69.0, APIs: 14, Strings: 25, Instructions: 734
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,3A04C82C), ref: 005C4E89
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C4F4A
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C5047

Strings

\PocoXML.dll, xrefs: 005C5553
PocoNetSSL.dll, xrefs: 005C51B9
libssl.dll, xrefs: 005C58B1
libcrypto.dll, xrefs: 005C56F3
PocoXML.dll, xrefs: 005C5535
Update poco netssl dll, xrefs: 005C529A
Update poco xml dll, xrefs: 005C5616
%s exit }, xrefs: 005C5ACB
stealth_manager, xrefs: 005C4F23, 005C50E1, 005C529F, 005C545D, 005C561B, 005C57D9, 005C5AB5, 005C5AD0
CStealthManager::checkAndUpdatePocoLibrary, xrefs: 005C5AC6
PocoUtil.dll, xrefs: 005C5377
\libssl.dll, xrefs: 005C58CF
\PocoJSON.dll, xrefs: 005C4E5B
\libcrypto.dll, xrefs: 005C5711
8, xrefs: 005C58E6
Update libcrypto dll, xrefs: 005C57D4
PocoJSON.dll, xrefs: 005C4E3D
\PocoNetSSL.dll, xrefs: 005C51D7
Update poco util dll, xrefs: 005C5458
PocoNet.dll, xrefs: 005C4FFB
Update poco json dll, xrefs: 005C4F1E
\PocoUtil.dll, xrefs: 005C5395
[%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C5AB0
Update poco net dll, xrefs: 005C50DC
\PocoNet.dll, xrefs: 005C5019

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _stat64i32$CopyFile
String ID: %s exit }$8$CStealthManager::checkAndUpdatePocoLibrary$PocoJSON.dll$PocoNet.dll$PocoNetSSL.dll$PocoUtil.dll$PocoXML.dll$Update libcrypto dll$Update poco json dll$Update poco net dll$Update poco netssl dll$Update poco util dll$Update poco xml dll$[%d][%d][%d][%d][%d][%d][%d][%d][%d]$\PocoJSON.dll$\PocoNet.dll$\PocoNetSSL.dll$\PocoUtil.dll$\PocoXML.dll$\libcrypto.dll$\libssl.dll$libcrypto.dll$libssl.dll$stealth_manager
API String ID: 3823094038-1151765924
Opcode ID: 96bf4321ad0d6165b97833dcac369b23e38b84f73cd24822abb9d125c4bd11a3
Instruction ID: 597dfc72cddc24d4c92668a7a4e4bd40a96d82ee3543897af0fd0ffc3b29357a
Opcode Fuzzy Hash: 96bf4321ad0d6165b97833dcac369b23e38b84f73cd24822abb9d125c4bd11a3
Instruction Fuzzy Hash: 81629070D04248DEEF14DFE8D849BEE7FB4BB05304F604499E4516B282E775AA49CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C8220 Relevance: 68.4, APIs: 23, Strings: 16, Instructions: 187
registrywindowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,Global\Exit_5491c4d3-0a5f-4898-bec4-cd906998e306,00000000,?,?,?,?,005B2D06), ref: 005C823C
GetLastError.KERNEL32(?,?,?,?,005B2D06), ref: 005C8248

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

SetEvent.KERNEL32(00000000,?,?,?,?,005B2D06), ref: 005C8271
CloseHandle.KERNEL32(00000000,?,?,?,?,005B2D06), ref: 005C8278
RegisterWindowMessageW.USER32(UWM_END_WINDOW_MSG_86A92825_6B57_423E_AAB1_13C85778886F,?,?,?,?,005B2D06), ref: 005C8283
FindWindowW.USER32(W64StubClss_27b3f5cc,00000000), ref: 005C8292
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005C82A5
OpenMutexW.KERNEL32(00100000,00000000,APP_5491c4d3-0a5f-4898-bec4-cd906998e306,75923080,?,?,?,?,?,?,005B2D06), ref: 005C82CC
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,005B2D06), ref: 005C82F1
Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,005B2D06), ref: 005C82F8
RegGetValueW.KERNELBASE(80000002,SOFTWARE\Classes\CLSID\{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}\MiscStatus\1,PID,00000010,00000000,FFFFFFFF,?), ref: 005C8354
OpenProcess.KERNEL32(00000001,00000000,FFFFFFFF), ref: 005C8381
TerminateProcess.KERNEL32(00000000,00000000), ref: 005C8390
GetLastError.KERNEL32 ref: 005C8398
CloseHandle.KERNEL32(?), ref: 005C83B5
GetWindowThreadProcessId.USER32(?,FFFFFFFF), ref: 005C83E9

Strings

Global\Exit_5491c4d3-0a5f-4898-bec4-cd906998e306, xrefs: 005C8231
uninstall_util, xrefs: 005C8254, 005C82B0, 005C82DD, 005C8318, 005C8365, 005C83A5, 005C83C5, 005C8424, 005C8453
PID, xrefs: 005C8345
terminate 2 result: %d, err: %d, xrefs: 005C841F
Waiting for process to die, xrefs: 005C82AB
Get reg value: %d, pid: %d, xrefs: 005C8360
W64StubClss_27b3f5cc, xrefs: 005C828B
The process is still running, continue waiting, xrefs: 005C82D8
cannot initialized app exit event (%d), xrefs: 005C824F
Open process error: %d, xrefs: 005C83C0
terminate result: %d, err: %d, xrefs: 005C83A0
Cannot create mutex. The process might have been dead, Error %d. break, xrefs: 005C8313
UWM_END_WINDOW_MSG_86A92825_6B57_423E_AAB1_13C85778886F, xrefs: 005C827E
APP_5491c4d3-0a5f-4898-bec4-cd906998e306, xrefs: 005C82C0
SOFTWARE\Classes\CLSID\{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}\MiscStatus\1, xrefs: 005C834A
terminate 2, err: %d, xrefs: 005C844E

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CloseHandleProcessWindow$ErrorEventLastMessageOpen$CreateFindMutexPostRegisterSleepTerminateThreadValue
String ID: APP_5491c4d3-0a5f-4898-bec4-cd906998e306$Cannot create mutex. The process might have been dead, Error %d. break$Get reg value: %d, pid: %d$Global\Exit_5491c4d3-0a5f-4898-bec4-cd906998e306$Open process error: %d$PID$SOFTWARE\Classes\CLSID\{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}\MiscStatus\1$The process is still running, continue waiting$UWM_END_WINDOW_MSG_86A92825_6B57_423E_AAB1_13C85778886F$W64StubClss_27b3f5cc$Waiting for process to die$cannot initialized app exit event (%d)$terminate 2 result: %d, err: %d$terminate 2, err: %d$terminate result: %d, err: %d$uninstall_util
API String ID: 736561401-2473979389
Opcode ID: 65d24f2b17959cc070d64432e5003e7fb3264cb2bd37771c87439d929d21ea72
Instruction ID: 93e2f8c8452273d2e613d26ccc230df41e828c839664a6a1fff9bfa4ca2cd022
Opcode Fuzzy Hash: 65d24f2b17959cc070d64432e5003e7fb3264cb2bd37771c87439d929d21ea72
Instruction Fuzzy Hash: 91517675A41206BBD7307BE59C0EFBF7F69FB64B11F004057F915A62C1DEB099048AA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C4FE2 Relevance: 60.1, APIs: 12, Strings: 22, Instructions: 635
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C5047
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C5108
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C5205

Strings

\PocoXML.dll, xrefs: 005C5553
PocoNetSSL.dll, xrefs: 005C51B9
CStealthManager::checkAndUpdatePocoLibrary, xrefs: 005C5AC6
libssl.dll, xrefs: 005C58B1
PocoUtil.dll, xrefs: 005C5377
\libssl.dll, xrefs: 005C58CF
\libcrypto.dll, xrefs: 005C5711
libcrypto.dll, xrefs: 005C56F3
8, xrefs: 005C58E6
Update libcrypto dll, xrefs: 005C57D4
\PocoNetSSL.dll, xrefs: 005C51D7
Update poco util dll, xrefs: 005C5458
PocoNet.dll, xrefs: 005C4FFB
PocoXML.dll, xrefs: 005C5535
Update poco netssl dll, xrefs: 005C529A
\PocoUtil.dll, xrefs: 005C5395
[%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C5AB0
Update poco xml dll, xrefs: 005C5616
%s exit }, xrefs: 005C5ACB
Update poco net dll, xrefs: 005C50DC
stealth_manager, xrefs: 005C50E1, 005C529F, 005C545D, 005C561B, 005C57D9, 005C5AB5, 005C5AD0
\PocoNet.dll, xrefs: 005C5019

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _stat64i32$CopyFile
String ID: %s exit }$8$CStealthManager::checkAndUpdatePocoLibrary$PocoNet.dll$PocoNetSSL.dll$PocoUtil.dll$PocoXML.dll$Update libcrypto dll$Update poco net dll$Update poco netssl dll$Update poco util dll$Update poco xml dll$[%d][%d][%d][%d][%d][%d][%d][%d][%d]$\PocoNet.dll$\PocoNetSSL.dll$\PocoUtil.dll$\PocoXML.dll$\libcrypto.dll$\libssl.dll$libcrypto.dll$libssl.dll$stealth_manager
API String ID: 3823094038-160391532
Opcode ID: 47bb444cc39cf94c5b8207916d0323b83a3c2abb60ea0bac2e3da490ecc9cd36
Instruction ID: c1a53361f283f632361179fff6784bcdb2ea561ce8a889a559f8ad7278b27447
Opcode Fuzzy Hash: 47bb444cc39cf94c5b8207916d0323b83a3c2abb60ea0bac2e3da490ecc9cd36
Instruction Fuzzy Hash: 3342A070D04248DEEF14DFE8D849BEE7FB4BB05304F604499E4516B282E775AA85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C51A0 Relevance: 51.3, APIs: 10, Strings: 19, Instructions: 536
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C5205
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C52C6
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C53C3

Strings

\PocoXML.dll, xrefs: 005C5553
PocoNetSSL.dll, xrefs: 005C51B9
CStealthManager::checkAndUpdatePocoLibrary, xrefs: 005C5AC6
libssl.dll, xrefs: 005C58B1
PocoUtil.dll, xrefs: 005C5377
\libssl.dll, xrefs: 005C58CF
\libcrypto.dll, xrefs: 005C5711
libcrypto.dll, xrefs: 005C56F3
8, xrefs: 005C58E6
Update libcrypto dll, xrefs: 005C57D4
\PocoNetSSL.dll, xrefs: 005C51D7
Update poco util dll, xrefs: 005C5458
PocoXML.dll, xrefs: 005C5535
Update poco netssl dll, xrefs: 005C529A
\PocoUtil.dll, xrefs: 005C5395
[%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C5AB0
Update poco xml dll, xrefs: 005C5616
%s exit }, xrefs: 005C5ACB
stealth_manager, xrefs: 005C529F, 005C545D, 005C561B, 005C57D9, 005C5AB5, 005C5AD0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _stat64i32$CopyFile
String ID: %s exit }$8$CStealthManager::checkAndUpdatePocoLibrary$PocoNetSSL.dll$PocoUtil.dll$PocoXML.dll$Update libcrypto dll$Update poco netssl dll$Update poco util dll$Update poco xml dll$[%d][%d][%d][%d][%d][%d][%d][%d][%d]$\PocoNetSSL.dll$\PocoUtil.dll$\PocoXML.dll$\libcrypto.dll$\libssl.dll$libcrypto.dll$libssl.dll$stealth_manager
API String ID: 3823094038-530629532
Opcode ID: cf05ac0671ea9879d9662d32b3315ef7cdb751f01206da34d3adb7bfb3e02598
Instruction ID: 2fc53569d96edfd56883f32d772159f40c8a820709576ab335bfcd17fe7c4b4d
Opcode Fuzzy Hash: cf05ac0671ea9879d9662d32b3315ef7cdb751f01206da34d3adb7bfb3e02598
Instruction Fuzzy Hash: 5622A170D04248DEEF14DFE8D849BEE7FB4BB05304F604489E4516B282E775AA85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C535E Relevance: 42.4, APIs: 8, Strings: 16, Instructions: 437
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C53C3
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C5484
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C5581

Strings

\PocoXML.dll, xrefs: 005C5553
CStealthManager::checkAndUpdatePocoLibrary, xrefs: 005C5AC6
libssl.dll, xrefs: 005C58B1
PocoUtil.dll, xrefs: 005C5377
\libssl.dll, xrefs: 005C58CF
\libcrypto.dll, xrefs: 005C5711
libcrypto.dll, xrefs: 005C56F3
8, xrefs: 005C58E6
Update libcrypto dll, xrefs: 005C57D4
Update poco util dll, xrefs: 005C5458
PocoXML.dll, xrefs: 005C5535
\PocoUtil.dll, xrefs: 005C5395
[%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C5AB0
Update poco xml dll, xrefs: 005C5616
%s exit }, xrefs: 005C5ACB
stealth_manager, xrefs: 005C545D, 005C561B, 005C57D9, 005C5AB5, 005C5AD0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _stat64i32$CopyFile
String ID: %s exit }$8$CStealthManager::checkAndUpdatePocoLibrary$PocoUtil.dll$PocoXML.dll$Update libcrypto dll$Update poco util dll$Update poco xml dll$[%d][%d][%d][%d][%d][%d][%d][%d][%d]$\PocoUtil.dll$\PocoXML.dll$\libcrypto.dll$\libssl.dll$libcrypto.dll$libssl.dll$stealth_manager
API String ID: 3823094038-412040896
Opcode ID: 5323dbb57c46f0dff51c1b47ffb9d0cb5f541148d14e57b8464d42da5fa654f0
Instruction ID: b10844c10e6cff21ea0b6add07d45ade5554dafaf543d1a4bf8ff52cafb4c653
Opcode Fuzzy Hash: 5323dbb57c46f0dff51c1b47ffb9d0cb5f541148d14e57b8464d42da5fa654f0
Instruction Fuzzy Hash: FE029070D04249DEEF14DFE8D849BEEBFB4BB05304F604489E45167282E775AA85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C1510 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 221
stringserviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.ADVAPI32(00000000,00000000,000F0001,00000004,3A04C82C,00000000,00000000), ref: 005C1582
lstrcpyW.KERNEL32(?,NoPath), ref: 005C177D
lstrcpyW.KERNEL32(?,NoPath), ref: 005C17B0
StartServiceW.ADVAPI32(?,00000003,00000000), ref: 005C17BC
GetLastError.KERNEL32 ref: 005C17C8
GetLastError.KERNEL32 ref: 005C1595

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

OpenServiceA.ADVAPI32(00000000,?,A0000012), ref: 005C163E
GetLastError.KERNEL32 ref: 005C164B
CloseServiceHandle.ADVAPI32(00000000), ref: 005C1665
ChangeServiceConfig2W.ADVAPI32 ref: 005C16C9
lstrcpyW.KERNEL32(?,HideForm), ref: 005C174A
lstrcpyW.KERNEL32(?,00000000), ref: 005C1769
lstrcpyW.KERNEL32(?,00000000), ref: 005C179C
CloseServiceHandle.ADVAPI32(?), ref: 005C17E8
CloseServiceHandle.ADVAPI32(?), ref: 005C17ED

Strings

ShowForm, xrefs: 005C173B
Launching service: %s, showdialog: %d, xrefs: 005C1567
Cannot open service, error code: %d, xrefs: 005C1652
Failed to start the service, error code: %d, xrefs: 005C17CF
NoPath, xrefs: 005C1775, 005C17A8
Cannot open OpenSCManager error code %d, xrefs: 005C159C
stealth_manager, xrefs: 005C156C, 005C15A1, 005C1657, 005C17D4
HideForm, xrefs: 005C1742

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$lstrcpy$CloseErrorHandleLast$Open$ChangeConfig2ManagerStart
String ID: Cannot open OpenSCManager error code %d$Cannot open service, error code: %d$Failed to start the service, error code: %d$HideForm$Launching service: %s, showdialog: %d$NoPath$ShowForm$stealth_manager
API String ID: 4158861149-887355719
Opcode ID: 6303a06d021554b4b9ad437db98e1fe8718d5967ae636bb7f772e069440ad04d
Instruction ID: 74d4fcc99a9b1ef28ffd0a9098eb70b5b06d6834f7a62033afcf5b1ca687e5f0
Opcode Fuzzy Hash: 6303a06d021554b4b9ad437db98e1fe8718d5967ae636bb7f772e069440ad04d
Instruction Fuzzy Hash: 16914B70D01209AFDB21EF94DC4ABAEBFB5FF45304F10405AE811AB292D7B56A45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005C4510 Relevance: 38.8, APIs: 1, Strings: 21, Instructions: 324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

GetFileAttributesA.KERNELBASE(?,?,?,?,?,3A04C82C,00000000), ref: 005C45FB

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Part of subcall function 005C4110: _stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 005C4263

Part of subcall function 005C4110: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C428E

Part of subcall function 005B4270: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B42E3
Part of subcall function 005B4270: memmove.VCRUNTIME140(?,00000000,0000023A,?,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B4337

Strings

libs\, xrefs: 005C45C6
nss\nssckbi.dll, xrefs: 005C4785
CStealthManager::checkAndUpdateNetFilterSDK2, xrefs: 005C453C, 005C48DF
nss\nssutil3.dll, xrefs: 005C47DD
nss\freebl3.dll, xrefs: 005C46A9
nss\certutil.exe, xrefs: 005C467D
nss\libplc4.dll, xrefs: 005C4701
nss\nss3.dll, xrefs: 005C4759
nfdrive 1 : [%d][%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C48A9
nss\smime3.dll, xrefs: 005C4809
nss\sqlite3.dll, xrefs: 005C4861
%s enter {, xrefs: 005C4541
nss\libplds4.dll, xrefs: 005C472D
nss\nssdbm3.dll, xrefs: 005C47B1
nfdrive 2 : [%d][%d][%d][%d], xrefs: 005C48CD
%s exit }, xrefs: 005C48E4
nss\libnspr4.dll, xrefs: 005C46D5
nss\softokn3.dll, xrefs: 005C4835
stealth_manager, xrefs: 005C4546, 005C48AE, 005C48D2, 005C48E9
ProtocolFilters.dll, xrefs: 005C4627
libprotobuf-lite.dll, xrefs: 005C4652

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$File$AttributesCopyXlength_error@std@@_stat64i32memmove
String ID: %s enter {$%s exit }$CStealthManager::checkAndUpdateNetFilterSDK2$ProtocolFilters.dll$libprotobuf-lite.dll$libs\$nfdrive 1 : [%d][%d][%d][%d][%d][%d][%d][%d][%d][%d]$nfdrive 2 : [%d][%d][%d][%d]$nss\certutil.exe$nss\freebl3.dll$nss\libnspr4.dll$nss\libplc4.dll$nss\libplds4.dll$nss\nss3.dll$nss\nssckbi.dll$nss\nssdbm3.dll$nss\nssutil3.dll$nss\smime3.dll$nss\softokn3.dll$nss\sqlite3.dll$stealth_manager
API String ID: 1857767709-241988061
Opcode ID: a09aa7eb80cd87b7091d6cd1be8a37a927afe019fa0beef7ba0e7127e08f9971
Instruction ID: 568479cd152eeabea1abb93463b887f648d0cf9719017e2ba1a021066b72af02
Opcode Fuzzy Hash: a09aa7eb80cd87b7091d6cd1be8a37a927afe019fa0beef7ba0e7127e08f9971
Instruction Fuzzy Hash: 66C16870A05295AEDB35ABF8D81ABEE7E717B52304F24008DE4402B2D3C7B65549DF92

Uniqueness

Uniqueness Score: -1.00%

Function 005C2F50 Relevance: 35.8, APIs: 12, Strings: 8, Instructions: 768
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

GetFileAttributesA.KERNELBASE(?,?,?,?,?,3A04C82C,00000000), ref: 005C303E
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEA10), ref: 005C319E
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEAD0), ref: 005C329D
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEB18), ref: 005C339C
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DE9B0), ref: 005C359A
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEA58), ref: 005C3696
CopyFileA.KERNEL32(?,00000000,00000000), ref: 005C36D6
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,005DEB90), ref: 005C373F
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C3779
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEA88), ref: 005C37F6
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEA40), ref: 005C349B

Part of subcall function 005B4370: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B438A
Part of subcall function 005B4370: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B43AB

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEBA8,stealth_manager,flag delete : %d,00000000,?,?,?,?,3A04C82C,00000000), ref: 005C309F

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

copy hookDll32 : %d, xrefs: 005C36E6
%s enter {, xrefs: 005C2F84
flag delete : %d, xrefs: 005C3057
temp\, xrefs: 005C3009
%s exit }, xrefs: 005C38D3
copy hookDll64 : %d, xrefs: 005C3789
CStealthManager::checkAndUpdateNewBinary, xrefs: 005C2F7F, 005C38CE
stealth_manager, xrefs: 005C2F89, 005C305C, 005C36EB, 005C378E, 005C38D8

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _stat64i32$_invalid_parameter_noinfo_noreturn$File$CopyXout_of_range@std@@$Attributes
String ID: %s enter {$%s exit }$CStealthManager::checkAndUpdateNewBinary$copy hookDll32 : %d$copy hookDll64 : %d$flag delete : %d$stealth_manager$temp\
API String ID: 3183754490-2088693739
Opcode ID: 631432ecae668c9b02241b331e7a7a865f556c6c1e4656a41ea8617db1ab603c
Instruction ID: d7c7d8caaa973e0f9699d4ab8d4f11e1fce8c490f95441c9a95614634e162d9e
Opcode Fuzzy Hash: 631432ecae668c9b02241b331e7a7a865f556c6c1e4656a41ea8617db1ab603c
Instruction Fuzzy Hash: 5D624F70900249DEEF14DF98CC49BEE7FB5BB01304F604599E0456B292D7B5AB8ACFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005B55B0 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 386
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,3A04C82C,?,?,?,?,005CF878,000000FF), ref: 005B5694
GetFileAttributesA.KERNEL32(00000000,00000000,00000000,000000FF,?,00000000,000000FF), ref: 005B575E
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,005D37AC), ref: 005B57A8
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,00000000), ref: 005B580C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 005B5813
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,000000FF), ref: 005B5882
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,005D37AC,?,?,?,?,?,000000FF), ref: 005B59E0
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 005B5A01
_wsplitpath_s.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,00000000,00000000,00000000,?,00000104,?,00000100), ref: 005B5A2E
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000105,?), ref: 005B5A47
GetCurrentProcessId.KERNEL32(DEBUG,?), ref: 005B5ABE
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,00000000,?,?,?,?,?,?,?,?,?), ref: 005B5B24
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,?), ref: 005B5B2B

Strings

ERROR, xrefs: 005B5AAA
DEBUG, xrefs: 005B5AB5, 005B5ABD
%s %s [%d] <%s> [%s]: %s, xrefs: 005B5AC7
windows_hook_manager, xrefs: 005B55E7
windows_hook_helper, xrefs: 005B5633
%s Continue on next file -->, xrefs: 005B57CB

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: File_stat64i32fclosefopenfwrite$AttributesCurrentModuleNameProcess_wsplitpath_swcscat_s
String ID: %s Continue on next file -->$%s %s [%d] <%s> [%s]: %s$DEBUG$ERROR$windows_hook_helper$windows_hook_manager
API String ID: 3352214153-4226532283
Opcode ID: cb75af55a168257b9d1cd4b822b30228bd17606e88440aca052e7dca09c8df14
Instruction ID: 8144ffb10068f0053a7965a75657e390002454ebfff5d584f13cf555d953733d
Opcode Fuzzy Hash: cb75af55a168257b9d1cd4b822b30228bd17606e88440aca052e7dca09c8df14
Instruction Fuzzy Hash: 78F19070910159DBDF28DF54CC99BE9BBB9BF54300F5401DAE40A67182EB71AB88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005C551C Relevance: 33.6, APIs: 6, Strings: 13, Instructions: 338
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C5581
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C5642
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C573F

Strings

\PocoXML.dll, xrefs: 005C5553
CStealthManager::checkAndUpdatePocoLibrary, xrefs: 005C5AC6
libssl.dll, xrefs: 005C58B1
\libssl.dll, xrefs: 005C58CF
\libcrypto.dll, xrefs: 005C5711
libcrypto.dll, xrefs: 005C56F3
8, xrefs: 005C58E6
Update libcrypto dll, xrefs: 005C57D4
PocoXML.dll, xrefs: 005C5535
[%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C5AB0
Update poco xml dll, xrefs: 005C5616
%s exit }, xrefs: 005C5ACB
stealth_manager, xrefs: 005C561B, 005C57D9, 005C5AB5, 005C5AD0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _stat64i32$CopyFile
String ID: %s exit }$8$CStealthManager::checkAndUpdatePocoLibrary$PocoXML.dll$Update libcrypto dll$Update poco xml dll$[%d][%d][%d][%d][%d][%d][%d][%d][%d]$\PocoXML.dll$\libcrypto.dll$\libssl.dll$libcrypto.dll$libssl.dll$stealth_manager
API String ID: 3823094038-3867193674
Opcode ID: 7bba6a2c9dae26728892b53859552500800a7e8c39386c5e88f69129b0e75ace
Instruction ID: 05d1c3feba4be9cbd62f546b85f6c1bce284c69777d50a1fd7e43c78894e1166
Opcode Fuzzy Hash: 7bba6a2c9dae26728892b53859552500800a7e8c39386c5e88f69129b0e75ace
Instruction Fuzzy Hash: 1BD19070D04348DEEF15CBE8D849BEEBFB4BB05304F644489E45167282E775AA85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005C2680 Relevance: 32.1, APIs: 12, Strings: 6, Instructions: 587fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00000000,00000000), ref: 005C2785
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEA40), ref: 005C28F1
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,nt_system_service.exe), ref: 005C29FC
CopyFileA.KERNEL32(?,?,005DEA10), ref: 005C2AFB
CopyFileA.KERNEL32(?,?,00000000), ref: 005C2B85
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEBA8), ref: 005C2BC4
CopyFileA.KERNEL32(?,?,00000000), ref: 005C2C48
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEA58), ref: 005C2C93
CopyFileA.KERNEL32(?,00000000,00000000), ref: 005C2CE9
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEB90), ref: 005C2D54
CopyFileA.KERNEL32(?,?,00000000), ref: 005C2D9A
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEB18,stealth_manager,flag delete : %d,00000000,?,00000000,00000000), ref: 005C27E6

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

copy hookDll32 : %d, xrefs: 005C2CF5
flag delete : %d, xrefs: 005C279E
temp\, xrefs: 005C2744
copy hookDll64 : %d, xrefs: 005C2DA6
stealth_manager, xrefs: 005C27A3, 005C2CFA, 005C2DAB
nt_system_service.exe, xrefs: 005C29C9, 005C2A09

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: File_stat64i32$Copy$_invalid_parameter_noinfo_noreturn$Attributes
String ID: copy hookDll32 : %d$copy hookDll64 : %d$flag delete : %d$nt_system_service.exe$stealth_manager$temp\
API String ID: 468188498-3430577748
Opcode ID: 587b5a84c31659bd94bf566e74ba5c53ab769890380e23504fb38b9f29ff3bae
Instruction ID: 9eeef70cfe5eab4a0535e70d5a3500adb1f8014d4d4047b3afc7a23de63c986b
Opcode Fuzzy Hash: 587b5a84c31659bd94bf566e74ba5c53ab769890380e23504fb38b9f29ff3bae
Instruction Fuzzy Hash: AB428170900249DEEF24DBA8CC49BED7FB5FB11304F504499E045AB192DBB5AE89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005C76C0 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 298registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

Part of subcall function 005B5120: __stdio_common_vsprintf_s.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000014,00000000,?,?,005B5BA1,?,00000014,%04d-%02d,?,?), ref: 005B513D

_CxxThrowException.VCRUNTIME140(?,005DCC24,0000000F,00000000,00000001,?,?), ref: 005C7765
RegOpenKeyExW.KERNELBASE(00000007,?,00000000,00000201,00000000,3A04C82C,750292F0,00000000,00000000), ref: 005C77DA
GetLastError.KERNEL32 ref: 005C77F4
GetLastError.KERNEL32 ref: 005C7809
_CxxThrowException.VCRUNTIME140(?,005DCC24,0000000F,00000000,00000001), ref: 005C7870
RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000), ref: 005C7899
RegQueryValueExW.ADVAPI32(00000000,?,00000000,00000000,00000000,00000000), ref: 005C78D5
GetLastError.KERNEL32(?,LoadRepo: RegOpenKey failed (%d),00000000), ref: 005C78E1
GetLastError.KERNEL32(?,?,?,?,LoadRepo: RegOpenKey failed (%d),00000000), ref: 005C78F6
_CxxThrowException.VCRUNTIME140(?,005DCC24,0000000F,00000000,LoadRepo: RegQueryValueEx failed (%d),00000000,?,?,?,?,LoadRepo: RegOpenKey failed (%d),00000000), ref: 005C7930
memmove.VCRUNTIME140(00000000,?,?,00000000,LoadRepo: RegQueryValueEx failed (%d),00000000,?,?,?,?,LoadRepo: RegOpenKey failed (%d),00000000), ref: 005C79BB
new.LIBCMT ref: 005C79C2

Strings

LoadRepo: RegOpenKey failed (%d), xrefs: 005C77F7, 005C780C
LoadRepo: Invalid Registry Size, xrefs: 005C76E1, 005C76F0
LoadRepo: RegQueryValueEx failed (%d), xrefs: 005C78E4, 005C78F9
stealth_manager, xrefs: 005C76E6, 005C77FC, 005C78E9

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ErrorLast$ExceptionThrow$QueryValue$Open__stdio_common_vsprintf_smemmove
String ID: LoadRepo: Invalid Registry Size$LoadRepo: RegOpenKey failed (%d)$LoadRepo: RegQueryValueEx failed (%d)$stealth_manager
API String ID: 667390599-1403936554
Opcode ID: 3086c0b72b2e577b0df31e920d5d1c2204a5951012c85405e7fb95092bce861e
Instruction ID: 10c6f3146a7a4984d61945c8ddf94642cd76cf9259324bac072fd61b044a4006
Opcode Fuzzy Hash: 3086c0b72b2e577b0df31e920d5d1c2204a5951012c85405e7fb95092bce861e
Instruction Fuzzy Hash: 40B14471904219AFDF24DFA4CC4AFDA7FB8FB49700F00459AE509AB681DB71AA44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005C7770 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 227registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000007,?,00000000,00000201,00000000,3A04C82C,750292F0,00000000,00000000), ref: 005C77DA
GetLastError.KERNEL32 ref: 005C77F4
GetLastError.KERNEL32 ref: 005C7809
_CxxThrowException.VCRUNTIME140(?,005DCC24,0000000F,00000000,00000001), ref: 005C7870
RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000), ref: 005C7899
RegQueryValueExW.ADVAPI32(00000000,?,00000000,00000000,00000000,00000000), ref: 005C78D5
GetLastError.KERNEL32(?,LoadRepo: RegOpenKey failed (%d),00000000), ref: 005C78E1
GetLastError.KERNEL32(?,?,?,?,LoadRepo: RegOpenKey failed (%d),00000000), ref: 005C78F6

Strings

LoadRepo: RegOpenKey failed (%d), xrefs: 005C77F7, 005C780C
LoadRepo: RegQueryValueEx failed (%d), xrefs: 005C78E4, 005C78F9
stealth_manager, xrefs: 005C76E6, 005C77FC, 005C78E9

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ErrorLast$QueryValue$ExceptionOpenThrow
String ID: LoadRepo: RegOpenKey failed (%d)$LoadRepo: RegQueryValueEx failed (%d)$stealth_manager
API String ID: 698041737-4132295493
Opcode ID: 03a5ee3bb3a66e8701fa651a8127941249a831f2b8e9d1bbc1588a162e1a49ac
Instruction ID: c477ba1bee3628d4c8dca0db640b10d489bcff5ab749a5cbca434410a0a460e1
Opcode Fuzzy Hash: 03a5ee3bb3a66e8701fa651a8127941249a831f2b8e9d1bbc1588a162e1a49ac
Instruction Fuzzy Hash: FA812371905219AFDB20DFA4CC4AFDABFB8FB48700F00459AE509AB251DA71AE44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005C0FB0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 123serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.ADVAPI32(00000000,00000000,000F0001,00000000,00000000), ref: 005C1020
OpenServiceA.ADVAPI32(00000000,?,A0000012), ref: 005C1042
ChangeServiceConfig2W.ADVAPI32(00000000), ref: 005C10A5
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 005C10B0
GetLastError.KERNEL32 ref: 005C10C0

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

CloseServiceHandle.ADVAPI32(00000000), ref: 005C10E0
CloseServiceHandle.ADVAPI32(00000000), ref: 005C10E3
GetLastError.KERNEL32 ref: 005C10E7
CloseServiceHandle.ADVAPI32(00000000), ref: 005C1107
GetLastError.KERNEL32 ref: 005C110B

Strings

Cannot open service, error code: %d, xrefs: 005C10EE
Launching system service: %s, xrefs: 005C1005
Failed to start the service, error code: %d, xrefs: 005C10C7
Cannot open OpenSCManager error code %d, xrefs: 005C1112
stealth_manager, xrefs: 005C100A, 005C10CC, 005C10F3, 005C1117

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$CloseErrorHandleLast$Open$ChangeConfig2ManagerStart
String ID: Cannot open OpenSCManager error code %d$Cannot open service, error code: %d$Failed to start the service, error code: %d$Launching system service: %s$stealth_manager
API String ID: 845704753-265196682
Opcode ID: 52cd0de63c94157844f1800bd300943bcd526c1ceec62c44d31d4b16bb3f31eb
Instruction ID: 2c1a11b6134f7d6514a6bf7c72cc6a5b84a5cb603482151a74eae26fe7ab780d
Opcode Fuzzy Hash: 52cd0de63c94157844f1800bd300943bcd526c1ceec62c44d31d4b16bb3f31eb
Instruction Fuzzy Hash: E1417F71941209EFDB209BD4DC49BEEBFB8FB09704F14001BE901AB281E7B56949CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 005C56DA Relevance: 24.7, APIs: 4, Strings: 10, Instructions: 239fileCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C573F
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C5800
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C58FD
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C5920

Strings

CStealthManager::checkAndUpdatePocoLibrary, xrefs: 005C5AC6
libssl.dll, xrefs: 005C58B1
\libssl.dll, xrefs: 005C58CF
[%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C5AB0
\libcrypto.dll, xrefs: 005C5711
libcrypto.dll, xrefs: 005C56F3
8, xrefs: 005C58E6
Update libcrypto dll, xrefs: 005C57D4
%s exit }, xrefs: 005C5ACB
stealth_manager, xrefs: 005C57D9, 005C5AB5, 005C5AD0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CopyFile_stat64i32
String ID: %s exit }$8$CStealthManager::checkAndUpdatePocoLibrary$Update libcrypto dll$[%d][%d][%d][%d][%d][%d][%d][%d][%d]$\libcrypto.dll$\libssl.dll$libcrypto.dll$libssl.dll$stealth_manager
API String ID: 791829690-2389273652
Opcode ID: d667a95afe15ebf041bc5ed060e8843daac8bea85143a418847fcc0599846fb8
Instruction ID: fd78293388f9107137e4b37ed61a3dd3e5e2ef885d9166d6ae75282abdc0b2eb
Opcode Fuzzy Hash: d667a95afe15ebf041bc5ed060e8843daac8bea85143a418847fcc0599846fb8
Instruction Fuzzy Hash: 15A18070D04248DEEF25CBE8DC45BEEBFB4BB05304F64408AE45166292E775AA85CF62

Uniqueness

Uniqueness Score: -1.00%

Function 005C1CD0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 107serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

OpenSCManagerW.ADVAPI32(00000000,00000000,000F0001,750292F0,00000000), ref: 005C1D3E
OpenServiceA.ADVAPI32(00000000,?,A0000000), ref: 005C1D60
StartServiceW.ADVAPI32(00000000,00000000,00000000), ref: 005C1D71
GetLastError.KERNEL32 ref: 005C1D7D

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

CloseServiceHandle.ADVAPI32(00000000), ref: 005C1D9D
CloseServiceHandle.ADVAPI32(00000000), ref: 005C1DA6
GetLastError.KERNEL32 ref: 005C1DAA
CloseServiceHandle.ADVAPI32(00000000), ref: 005C1DCC
GetLastError.KERNEL32 ref: 005C1DD0

Strings

Launching Update service: %s, xrefs: 005C1D23
Cannot open service, error code: %d, xrefs: 005C1DB1
Failed to start the service, error code: %d, xrefs: 005C1D84
Cannot open OpenSCManager error code %d, xrefs: 005C1DD7
stealth_manager, xrefs: 005C1D28, 005C1D89, 005C1DB6, 005C1DDC

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$CloseErrorHandleLast$Open$ManagerStart
String ID: Cannot open OpenSCManager error code %d$Cannot open service, error code: %d$Failed to start the service, error code: %d$Launching Update service: %s$stealth_manager
API String ID: 2350709577-1495461891
Opcode ID: dd24fa1e6ec45444d28b74284b6ecb56b654d8092a9cac1aa0ef7248c5cdd241
Instruction ID: 803cfc3b3513a97d553d6d1ae66185c45dd879d094e1d996d4140f1d90b5148f
Opcode Fuzzy Hash: dd24fa1e6ec45444d28b74284b6ecb56b654d8092a9cac1aa0ef7248c5cdd241
Instruction Fuzzy Hash: 0631BB31645609AFD720ABE4DC4AFEE7F78FB59710F14001BF502662D2EB706944CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 005C3AD0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 227fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,3A04C82C,00000000), ref: 005C3BB9
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,3A04C82C,005DEA58,?,3A04C82C,00000000), ref: 005C3BFB
CopyFileA.KERNEL32(?,00000000,00000000), ref: 005C3C3C
GetLastError.KERNEL32 ref: 005C3C48
CopyFileA.KERNEL32(?,?,00000000), ref: 005C3CFD
GetLastError.KERNEL32 ref: 005C3D09

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,005DEB90), ref: 005C3CAC

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

cp dll 32 : %d, %d, xrefs: 005C3C53
temp\, xrefs: 005C3B81
cp dll no temp, xrefs: 005C3D84
stealth_manager, xrefs: 005C3C58, 005C3D19, 005C3D89
cp dll 64 : %d, %d, xrefs: 005C3D14

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$File$CopyErrorLast_stat64i32$Attributes
String ID: cp dll 32 : %d, %d$cp dll 64 : %d, %d$cp dll no temp$stealth_manager$temp\
API String ID: 2386109806-900647939
Opcode ID: a9ef8392dec30755193808337caf6068d4ad54802533fcb050ebd0df7cba948e
Instruction ID: bf0aeddfe96a5ba3c857ba92bc8dd27c71d6dd2e9db06804c7dc76c3a7a546dd
Opcode Fuzzy Hash: a9ef8392dec30755193808337caf6068d4ad54802533fcb050ebd0df7cba948e
Instruction Fuzzy Hash: 2B919F70900249DFEB20DBA8CC49BEEBFB5FB15300F94445AE406A7292DB756E49CF61

Uniqueness

Uniqueness Score: -1.00%

Function 005B32BF Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 275COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005B372A

Strings

post_install, xrefs: 005B378E, 005B37C8, 005B37FD, 005B383D, 005B38EB, 005B3908, 005B3925
Failed to launch system service, xrefs: 005B3920
Failed to launch startup service, xrefs: 005B38E6
Show dialog: %d, xrefs: 005B3838
Failed to launch process monitor, xrefs: 005B3903
#, xrefs: 005B3890
STARTUP SET GU TYPE : %d, xrefs: 005B37C3, 005B37F8
STARTUP GU TYPE : %d, xrefs: 005B3789
lic.dat, xrefs: 005B3754

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID:
String ID: #$Failed to launch process monitor$Failed to launch startup service$Failed to launch system service$STARTUP GU TYPE : %d$STARTUP SET GU TYPE : %d$Show dialog: %d$lic.dat$post_install
API String ID: 0-3207515809
Opcode ID: 382b5eae1d27f6cdd15b4cbce4ffd6de4f9fe141b2a67b47453bf59dbd5a82f0
Instruction ID: 7ce34399c8f9795380a2da1879326a002b10ae14f3cd1c06c6541a7476745c82
Opcode Fuzzy Hash: 382b5eae1d27f6cdd15b4cbce4ffd6de4f9fe141b2a67b47453bf59dbd5a82f0
Instruction Fuzzy Hash: 92B1A270E002459FEF25AF58D80ABAD7FB5BB41304F204199E4057B393DBB5AB858F92

Uniqueness

Uniqueness Score: -1.00%

Function 005B3434 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 268COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005B372A

Strings

post_install, xrefs: 005B378E, 005B37C8, 005B37FD, 005B383D, 005B38EB, 005B3908, 005B3925
Failed to launch system service, xrefs: 005B3920
Failed to launch startup service, xrefs: 005B38E6
Show dialog: %d, xrefs: 005B3838
Failed to launch process monitor, xrefs: 005B3903
#, xrefs: 005B3890
STARTUP SET GU TYPE : %d, xrefs: 005B37C3, 005B37F8
STARTUP GU TYPE : %d, xrefs: 005B3789
lic.dat, xrefs: 005B3754

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID:
String ID: #$Failed to launch process monitor$Failed to launch startup service$Failed to launch system service$STARTUP GU TYPE : %d$STARTUP SET GU TYPE : %d$Show dialog: %d$lic.dat$post_install
API String ID: 0-3207515809
Opcode ID: d8f98148c18b864c6d531e244d351d49e9f9b9e23cb85e6b1b20529e24a1e580
Instruction ID: e88dfb5bb1b2447aa20068a37db429d15b050a924d5cfeb6f901c579ac3f5085
Opcode Fuzzy Hash: d8f98148c18b864c6d531e244d351d49e9f9b9e23cb85e6b1b20529e24a1e580
Instruction Fuzzy Hash: D3B19270E002459FEB25AF58D80ABAD7FB5BB41304F204199E4057B393DBB5AB858F92

Uniqueness

Uniqueness Score: -1.00%

Function 005B357C Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 262COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005B372A

Strings

post_install, xrefs: 005B378E, 005B37C8, 005B37FD, 005B383D, 005B38EB, 005B3908, 005B3925
Failed to launch system service, xrefs: 005B3920
Failed to launch startup service, xrefs: 005B38E6
Show dialog: %d, xrefs: 005B3838
Failed to launch process monitor, xrefs: 005B3903
#, xrefs: 005B3890
STARTUP SET GU TYPE : %d, xrefs: 005B37C3, 005B37F8
STARTUP GU TYPE : %d, xrefs: 005B3789
lic.dat, xrefs: 005B3754

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID:
String ID: #$Failed to launch process monitor$Failed to launch startup service$Failed to launch system service$STARTUP GU TYPE : %d$STARTUP SET GU TYPE : %d$Show dialog: %d$lic.dat$post_install
API String ID: 0-3207515809
Opcode ID: fa5cab325dac74dde4ac212e1ed2962859213348e564098f587a9be341d60a7a
Instruction ID: cc118e2ba1c8abc1862aedcc7950e1256956893dcea78d2a9cebd4bb1466d5a3
Opcode Fuzzy Hash: fa5cab325dac74dde4ac212e1ed2962859213348e564098f587a9be341d60a7a
Instruction Fuzzy Hash: 8EA19270E002459FEB25AF58D80ABAD7FB5BB41304F204199E4057B393DBB5AF858F92

Uniqueness

Uniqueness Score: -1.00%

Function 005B52A0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 248COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(0000001C,.txt,00000004,postinstall,0000000B,7'[,?,3A04C82C,?,?), ref: 005B53BA
_mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(0000001C,?,?), ref: 005B53D2
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B53DF
GetFileAttributesA.KERNELBASE(0000001C,.txt,00000004,postinstall,0000000B,7'[,?,3A04C82C,?,?), ref: 005B53FE
GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,000000FF,0000001C,00000000,000000FF,.txt,00000004,postinstall,0000000B,7'[,?,3A04C82C,?,?), ref: 005B549B
_mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?), ref: 005B54B6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B54C3

Strings

.txt, xrefs: 005B5394
postinstall, xrefs: 005B5385, 005B54D8
7'[, xrefs: 005B52D0, 005B537B

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: AttributesFile$_errno_mkdir
String ID: .txt$7'[$postinstall
API String ID: 3316992066-282842050
Opcode ID: 5c9df6db215d48a62f34439cf9896718b488d03c89d8065ed68c46fa46bbebad
Instruction ID: 765fa29d6f2fe826d98c13176152a1cc59fafde0b234a7c00e59af8b950e6ab5
Opcode Fuzzy Hash: 5c9df6db215d48a62f34439cf9896718b488d03c89d8065ed68c46fa46bbebad
Instruction Fuzzy Hash: 4CA17E30900644DFEB28DF68D848BEEBFB5FB05310F540959E412A72D2D7B1BA84CB61

Uniqueness

Uniqueness Score: -1.00%

Function 005C8470 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 281sleepwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(0000FFFF,00000000,00000000,00000000,0000000A,000003E8,?), ref: 005C84B6
Sleep.KERNELBASE(00002710), ref: 005C84C1
memset.VCRUNTIME140(?,00000000,00000088), ref: 005C84D5

Part of subcall function 005BCAE0: GetCurrentProcess.KERNEL32(00000000,3A04C82C,750292F0,00000000), ref: 005BCBDC
Part of subcall function 005BCAE0: IsWow64Process.KERNEL32(00000000), ref: 005BCBE3

OpenProcess.KERNEL32(00000001,00000000,00000009,00000000,?,?,?,?,?,?,00000000,?,00000088), ref: 005C86CE

Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4720
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4734
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4741
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B474E
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4759

Strings

uninstall_util, xrefs: 005C8736
Terminating : %ws (%d)[%X]: %d, xrefs: 005C8731

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process$CurrentMessageOpenSendSleepTimeoutWow64memset
String ID: Terminating : %ws (%d)[%X]: %d$uninstall_util
API String ID: 2511561161-3982135322
Opcode ID: f8b67ba8499b21669a6e847a53af12376e65a15452296990d3178bc430e7e939
Instruction ID: edea9809c28b349c975e53f46ac471f76c88bc164864d57165880c965d7b98ea
Opcode Fuzzy Hash: f8b67ba8499b21669a6e847a53af12376e65a15452296990d3178bc430e7e939
Instruction Fuzzy Hash: C2C13930900219EEDF24DBA4CC89BEEBBB5FF55304F204199E409A7291EB756A89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005C5898 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 140fileCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,00000000), ref: 005C58FD
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C5920

Strings

CStealthManager::checkAndUpdatePocoLibrary, xrefs: 005C5AC6
libssl.dll, xrefs: 005C58B1
\libssl.dll, xrefs: 005C58CF
[%d][%d][%d][%d][%d][%d][%d][%d][%d], xrefs: 005C5AB0
8, xrefs: 005C58E6
%s exit }, xrefs: 005C5ACB
stealth_manager, xrefs: 005C5AB5, 005C5AD0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CopyFile_stat64i32
String ID: %s exit }$8$CStealthManager::checkAndUpdatePocoLibrary$[%d][%d][%d][%d][%d][%d][%d][%d][%d]$\libssl.dll$libssl.dll$stealth_manager
API String ID: 791829690-3826218177
Opcode ID: 60e40fdadfa863bcac571d071e76dfcdbd3e04ecfbc032f57bad1584c84f9b49
Instruction ID: 6079e7c7d55050f18e3918eabea48831bb5819f0bfd08ca37565f9eb5f19fdb2
Opcode Fuzzy Hash: 60e40fdadfa863bcac571d071e76dfcdbd3e04ecfbc032f57bad1584c84f9b49
Instruction Fuzzy Hash: 3451A470E04398AEEF25C7E4DC55BEEBFB4BB06304F54408AE48562292D7756E84CF22

Uniqueness

Uniqueness Score: -1.00%

Function 005CAD00 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,00000000,?,005CA9A5,005C862E,00000009), ref: 005CAD2C
GetProcAddress.KERNEL32(00000000,NtWow64QueryInformationProcess64), ref: 005CAD4D
GetProcAddress.KERNEL32(00000000,NtWow64ReadVirtualMemory64), ref: 005CAD67
GetProcAddress.KERNEL32(00000000,NtQueryInformationProcess), ref: 005CAD81

Strings

ntdll.dll, xrefs: 005CAD27
NtQueryInformationProcess, xrefs: 005CAD7B
NtWow64ReadVirtualMemory64, xrefs: 005CAD61
NtWow64QueryInformationProcess64, xrefs: 005CAD47

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: NtQueryInformationProcess$NtWow64QueryInformationProcess64$NtWow64ReadVirtualMemory64$ntdll.dll
API String ID: 667068680-1418883184
Opcode ID: 46304106ec5312de75cc7dbbe0dccfb749c20b00f47434d4e10c47ebec4824a0
Instruction ID: fc38fd0e1c063c2abe00ba34465799f28408607076b872dba32d054f50348719
Opcode Fuzzy Hash: 46304106ec5312de75cc7dbbe0dccfb749c20b00f47434d4e10c47ebec4824a0
Instruction Fuzzy Hash: 6701713050361BDDDB716BA9BC1AB953FA47B6032BF04012BE402965A0D7788C8EDE93

Uniqueness

Uniqueness Score: -1.00%

Function 005BD4F0 Relevance: 13.0, APIs: 2, Strings: 5, Instructions: 760COMMON

Download Yara Rule

APIs

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

GetFileAttributesA.KERNELBASE(?,?,?,750292F0,00000001,00000010,0000000D,0000000C,00000009,00000008,00000006,00000003,00000002,00000007,?,750292F0), ref: 005BDE5D
GetFileAttributesA.KERNEL32(?,?,?,?,?,750292F0,00000001,00000010,0000000D,0000000C,00000009,00000008,00000006,00000003,00000002,00000007), ref: 005BDEAF

Part of subcall function 005BA3E0: RemoveDirectoryA.KERNEL32(?,?,005BDECA,?,?,?,?,750292F0,00000001,00000010,0000000D,0000000C,00000009,00000008,00000006,00000003), ref: 005BA3E4
Part of subcall function 005BA3E0: MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 005BA3F2

Strings

NT System Service, xrefs: 005BDC84
\library\, xrefs: 005BDDF9
library\, xrefs: 005BDDBF
NtSys, xrefs: 005BDC50
nt_system_service.exe, xrefs: 005BDA53

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$File$Attributes$DirectoryMoveRemove
String ID: NT System Service$NtSys$\library\$library\$nt_system_service.exe
API String ID: 2810654569-3684818500
Opcode ID: 045dd6806cd48bb6e88d845ebcfd791f73518aa2ca130ab7d555dc9c16bf67f9
Instruction ID: cbeeb7b4cb21d0d39ac56f4907d51356b4fb727df2d635ed29ae6deba7ef4b14
Opcode Fuzzy Hash: 045dd6806cd48bb6e88d845ebcfd791f73518aa2ca130ab7d555dc9c16bf67f9
Instruction Fuzzy Hash: 19623B70900249DFEB24DB58CC49BEEBBB6FB45304F540599E405A7292DB70BE85CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005B8440 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 286comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(005D3410,00000000,00000001,005D3420,?), ref: 005B84AD

Part of subcall function 005B8100: new.LIBCMT ref: 005B8129
Part of subcall function 005B8100: SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 005B8162
Part of subcall function 005B8100: _com_issue_error.COMSUPP ref: 005B8173
Part of subcall function 005B8100: _com_issue_error.COMSUPP ref: 005B818C

SysFreeString.OLEAUT32(00000000), ref: 005B8514
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 005B855B
CoCreateInstance.OLE32(005D3A2C,00000000,00000001,005D3A3C,?), ref: 005B865C
_wtoi64.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 005B868F
SysFreeString.OLEAUT32(?), ref: 005B86A8

Strings

WQL, xrefs: 005B858D

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: String$CreateFreeInstance_com_issue_error$AllocBlanketProxy_wtoi64
String ID: WQL
API String ID: 1687189681-1249411209
Opcode ID: 182c2bee185c4ed8015cd918a8f43341193171007ea6c24f6d4a440d6d85027d
Instruction ID: 50ca6f553a59fcfa8f0d6804f94c086b18e4d086432034e3bbf772a05141e883
Opcode Fuzzy Hash: 182c2bee185c4ed8015cd918a8f43341193171007ea6c24f6d4a440d6d85027d
Instruction Fuzzy Hash: B4B14D70A00209AFEB20DFA4CC49BEEBFB9FF54704F244059E915AB291DB75B905CB51

Uniqueness

Uniqueness Score: -1.00%

Function 005BE9B0 Relevance: 12.5, APIs: 1, Strings: 7, Instructions: 466COMMON

Download Yara Rule

APIs

Part of subcall function 005B2620: new.LIBCMT ref: 005B2652

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Part of subcall function 005C7770: RegOpenKeyExW.KERNELBASE(00000007,?,00000000,00000201,00000000,3A04C82C,750292F0,00000000,00000000), ref: 005C77DA
Part of subcall function 005C7770: GetLastError.KERNEL32 ref: 005C77F4
Part of subcall function 005C7770: GetLastError.KERNEL32 ref: 005C7809
Part of subcall function 005C7770: _CxxThrowException.VCRUNTIME140(?,005DCC24,0000000F,00000000,00000001), ref: 005C7870
Part of subcall function 005C7770: RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000), ref: 005C7899

_CxxThrowException.VCRUNTIME140(?,005DCC24,00000010,Invalid repository data,005D34F6,00000000,005D34F6,00000000,005D34F6,00000000), ref: 005BECB7

Part of subcall function 005B4370: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B438A
Part of subcall function 005B4370: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B43AB

Part of subcall function 005BFD10: _stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,3A04C82C), ref: 005BFD4F

Strings

.dll, xrefs: 005BECF5, 005BEDCC
Invalid repository data, xrefs: 005BEC94
%s enter {, xrefs: 005BE9EE
.exe, xrefs: 005BEE59
%s exit }, xrefs: 005BEFC8
stealth_manager, xrefs: 005BE9F3, 005BEFCD
CStealthManager::deleteHookDllAndUninstallFile, xrefs: 005BE9E9, 005BEFC3

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorExceptionLastThrowXout_of_range@std@@$OpenQueryValue_stat64i32
String ID: %s enter {$%s exit }$.dll$.exe$CStealthManager::deleteHookDllAndUninstallFile$Invalid repository data$stealth_manager
API String ID: 3040068235-100804164
Opcode ID: 6d0d5a6e4f5210f2d7f9ee12ad9f4299011e62af5b1bcd78c442f8b264ab09a4
Instruction ID: 8451cecfdec7b901730f2054a686604726c41376673e7109cb845f67a6a9bf49
Opcode Fuzzy Hash: 6d0d5a6e4f5210f2d7f9ee12ad9f4299011e62af5b1bcd78c442f8b264ab09a4
Instruction Fuzzy Hash: D4128E30900259DFEB20EB68DC4ABEDBFB5BF51304F644099E00967292DB756E89CF52

Uniqueness

Uniqueness Score: -1.00%

Function 005C3E00 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 171fileCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,750292F0,3A04C82C,00000000,750292F0), ref: 005C3E41
remove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,stealth_manager,Delete file : %s,?), ref: 005C3F34
CopyFileA.KERNEL32(?,?,00000000), ref: 005C3F59
CopyFileA.KERNEL32(?,?,00000000), ref: 005C3FAF

Strings

Copy file %s to %s : %d, xrefs: 005C3F81
Delete file : %s, xrefs: 005C3F19
stealth_manager, xrefs: 005C3F1E, 005C3F86

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CopyFile$_stat64i32remove
String ID: Copy file %s to %s : %d$Delete file : %s$stealth_manager
API String ID: 4114102100-3378453047
Opcode ID: 98a386bb88e17d8d90741565ee9093831c6246f6e981292ee3d66952546889ef
Instruction ID: c200359152f07f730f001ff83d3720e36b37b9a88a291849ee1fd96a74629bfb
Opcode Fuzzy Hash: 98a386bb88e17d8d90741565ee9093831c6246f6e981292ee3d66952546889ef
Instruction Fuzzy Hash: 50619C70600249EFDF14DF68C848BEA3BB9FB19304F50855EF80697292D779EA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005C9640 Relevance: 12.3, APIs: 8, Instructions: 332stringCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,3A04C82C,00000000,?), ref: 005C969B
new.LIBCMT ref: 005C96AD

Part of subcall function 005CE041: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE068

memset.VCRUNTIME140(00000000,00000000,00000488,00000488), ref: 005C96BF
memset.VCRUNTIME140(00000000,00000000,00000001,00000001,00000000,00000000), ref: 005C9898
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000,00000000,00000000,00000001,00000001,00000000,00000000), ref: 005C98A4
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 005C9747

Part of subcall function 005CC710: __RTDynamicCast.VCRUNTIME140(005C9967,00000000,84],84],00000000,?,?,?,?,?,?,005C9967,00000000,00000000), ref: 005CC73F
Part of subcall function 005CC710: _CxxThrowException.VCRUNTIME140(?,005DCD08,Invalid Argument), ref: 005CC81C

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 005C99A5
memmove.VCRUNTIME140(00000000,?,?,00000000,00000000,?,?), ref: 005C99B7

Part of subcall function 005B4370: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B438A
Part of subcall function 005B4370: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B43AB

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: memset$Xout_of_range@std@@_stat64i32$CastDynamicExceptionThrowmallocmemmovestrncpy
String ID:
API String ID: 3854998649-0
Opcode ID: 4342bdbae0a82a8818a25253f5cf17ec73c0b37a2ba6b6dea81bec8bbf592802
Instruction ID: 1b3634b7fe6b5c363a75665caf6cf5c4317209c7df88544a977f4aabab23e9c0
Opcode Fuzzy Hash: 4342bdbae0a82a8818a25253f5cf17ec73c0b37a2ba6b6dea81bec8bbf592802
Instruction Fuzzy Hash: 88C13C70A002199FDB24DFA4C889FAEBBB5FF48304F14415DE505AB282DB75AD45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005CB1C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 197processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000018,00000009), ref: 005CB2CE
memset.VCRUNTIME140(?,00000000,00000424), ref: 005CB2F3
Module32FirstW.KERNEL32(00000000,00000428), ref: 005CB30D

Part of subcall function 005CC070: new.LIBCMT ref: 005CC075

Part of subcall function 005CB5A0: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,005C862E,00000009), ref: 005CB5CA

Strings

list<T> too long, xrefs: 005CB4B0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32Xlength_error@std@@memset
String ID: list<T> too long
API String ID: 2770869650-4027344264
Opcode ID: 9990106ab542464fb75da02f08c12f328a3797f62bb24138bfb28a19e0828bc7
Instruction ID: 99be868b7d86685d7dbd5da6a96365a0a3eaf71eb8397e546cf3e4450071e11a
Opcode Fuzzy Hash: 9990106ab542464fb75da02f08c12f328a3797f62bb24138bfb28a19e0828bc7
Instruction Fuzzy Hash: 77814EB0900219DFDB24DFA4CC89B9EBBB8FF44304F10859DE609A7291DB755A48CF65

Uniqueness

Uniqueness Score: -1.00%

Function 005C0E10 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 005C2100: OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,75920F00,00000000,?,?,?,?,?,?,00000000,005D0A48,000000FF,?,005B2D79), ref: 005C2152
Part of subcall function 005C2100: OpenServiceA.ADVAPI32(00000000,?,00010002), ref: 005C217D
Part of subcall function 005C2100: ChangeServiceConfig2W.ADVAPI32(00000000), ref: 005C21C0
Part of subcall function 005C2100: DeleteService.ADVAPI32(00000000), ref: 005C21C7
Part of subcall function 005C2100: CloseServiceHandle.ADVAPI32(00000000), ref: 005C21D6
Part of subcall function 005C2100: CloseServiceHandle.ADVAPI32(00000000), ref: 005C21FB

GetFileAttributesA.KERNELBASE(?,?,?,?,?,?,?,?,00000011), ref: 005C0F36

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

Strings

de_netfilter, xrefs: 005C0E68, 005C0E98
nfdrive, xrefs: 005C0EC8
Successfully deleted nf driver folder, xrefs: 005C0F59
Delete nf driver failed : %d, xrefs: 005C0F6E
stealth_manager, xrefs: 005C0F5E, 005C0F73

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Service$CloseHandleOpen$AttributesChangeConfig2DeleteFileManager
String ID: Delete nf driver failed : %d$Successfully deleted nf driver folder$de_netfilter$nfdrive$stealth_manager
API String ID: 197650353-3270424674
Opcode ID: 3c045edb9a3e3a34edd08b1b29fa37fff767d1d01790a25b58ac80d0c6192977
Instruction ID: 2078474bc004e57980366339ce5e6151471270d8dea04b3b9105fe51f0977498
Opcode Fuzzy Hash: 3c045edb9a3e3a34edd08b1b29fa37fff767d1d01790a25b58ac80d0c6192977
Instruction Fuzzy Hash: 1F418730A04249DFEF24EBA8D849BED7FB5FB05304F50055EE411AB2D2DB71A945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 005CC150 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

WTSEnumerateSessionsA.WTSAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 005CC172
WTSFreeMemory.WTSAPI32(?), ref: 005CC199
GetLastError.KERNEL32 ref: 005CC1B5

Strings

fxstd::fxwshelper, xrefs: 005CC1C1, 005CC1D5
CANNOT FIND REAL SESSION # GOT : %d, xrefs: 005CC1D0
GET SESSION ERROR : %d, xrefs: 005CC1BC

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: EnumerateErrorFreeLastMemorySessions
String ID: CANNOT FIND REAL SESSION # GOT : %d$GET SESSION ERROR : %d$fxstd::fxwshelper
API String ID: 1558365644-4019733835
Opcode ID: dbc3ba761991d064a50723c7f4b7742d806e76e383655102ea17fc2156edcb61
Instruction ID: 65cd60a7dd82543152477515d72a1ba160a9384055deed3739ae648f376daee6
Opcode Fuzzy Hash: dbc3ba761991d064a50723c7f4b7742d806e76e383655102ea17fc2156edcb61
Instruction Fuzzy Hash: 8D11CA31B0010A6FDB10ABE89C4AFAE7F68BB45710F14025FF815AB3C1DA716E05C791

Uniqueness

Uniqueness Score: -1.00%

Function 005C73A0 Relevance: 9.1, APIs: 6, Instructions: 71filetimeCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,75918B60,00000000,00000000), ref: 005C73CC
CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 005C73F5
GetFileTime.KERNEL32(00000000,00000000,?,?), ref: 005C740D
GetLastError.KERNEL32 ref: 005C7417
CloseHandle.KERNEL32(00000000), ref: 005C7420
GetLastError.KERNEL32 ref: 005C7428

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleTime_stat64i32
String ID:
API String ID: 3741799282-0
Opcode ID: b90cfa9c39767a8377d6cdac2b76635cc94be49af25871ade501f244743b1a8c
Instruction ID: e64bcf3319461c9ffe79f172604962e047c4aacb0fe71bbf0108993c60b056af
Opcode Fuzzy Hash: b90cfa9c39767a8377d6cdac2b76635cc94be49af25871ade501f244743b1a8c
Instruction Fuzzy Hash: B011C331205209AFDB209FA4DC89EAB7BACFB48350F10452AFD11C6190DB30EA05CFE2

Uniqueness

Uniqueness Score: -1.00%

Function 005C4110 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 267fileCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 005C4263
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 005C428E

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

libs\, xrefs: 005C41BB
Update %s, xrefs: 005C43C7
stealth_manager, xrefs: 005C43CC

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CopyFile_stat64i32
String ID: Update %s$libs\$stealth_manager
API String ID: 3048520692-1913737693
Opcode ID: 99e8a8efb1f6ab2a2a98725a96f12b0e9f66180dd645d7bc0a15d642e5a19ef9
Instruction ID: 244698ef5d191c890523daf6f352ff0f9dd14ca28bb8943aa602931f6a6d8eef
Opcode Fuzzy Hash: 99e8a8efb1f6ab2a2a98725a96f12b0e9f66180dd645d7bc0a15d642e5a19ef9
Instruction Fuzzy Hash: EDB18D70900249DEEF24DFA8D859FEEBFB5FB01304F604459E411AB292C775AA49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005C8D40 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,LicenseInfo,Get GU PATH : %s), ref: 005C8E27
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 005C8E56

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Part of subcall function 005BA4B0: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,000000FF,750292F0,?,?,?,005C975E), ref: 005BA4BA
Part of subcall function 005BA4B0: new.LIBCMT ref: 005BA4CB

Strings

LicenseInfo, xrefs: 005C8DFF
Get GU PATH : %s, xrefs: 005C8DFA
gutype.dat, xrefs: 005C8D94

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$_stat64i32$fopen
String ID: Get GU PATH : %s$LicenseInfo$gutype.dat
API String ID: 2269806401-3769785672
Opcode ID: c0298da9baddab6089b928828ccb6776deccca9eddeb98fd3c3c92f7992c3cdd
Instruction ID: a5603a1db2ff4a33c1a1863cf0b3c997aafcc5560382acd220da592330612f56
Opcode Fuzzy Hash: c0298da9baddab6089b928828ccb6776deccca9eddeb98fd3c3c92f7992c3cdd
Instruction Fuzzy Hash: BC416B70A10259DFDF20DBA8D849BEEBBB5FF14700F50005AE815A7282DB756A05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005C8ED0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,LicenseInfo,Set GU PATH : %s), ref: 005C8FC9

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

w, xrefs: 005C8FC5
LicenseInfo, xrefs: 005C8F8B
gutype.dat, xrefs: 005C8F20
Set GU PATH : %s, xrefs: 005C8F86

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$_stat64i32
String ID: LicenseInfo$Set GU PATH : %s$gutype.dat$w
API String ID: 1866921897-3515572238
Opcode ID: b198b9c7601735452f416baa0d9fe14f09af7fc07ba46f7c6fe0a7e30a7ea175
Instruction ID: 237f501200f85f51b512cb8207153a3b4e6a823982b90d69b345b15b9e4d87d9
Opcode Fuzzy Hash: b198b9c7601735452f416baa0d9fe14f09af7fc07ba46f7c6fe0a7e30a7ea175
Instruction Fuzzy Hash: 91417C30A04259EFEB20DFA8D849BEEBBB5FF54700F50005AE415A7382DB756A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 005B6220 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,00000058,00000040,00000000,?,005BCC58,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\,00000017), ref: 005B623A
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000058,00000040,00000000,?,005BCC58,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\,00000017), ref: 005B625D
memmove.VCRUNTIME140(?,?,00000000,?,?,00000058,00000040,00000000,?,005BCC58,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\), ref: 005B62A1

Strings

string too long, xrefs: 005B6258
invalid string position, xrefs: 005B6235

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@Xout_of_range@std@@memmove
String ID: invalid string position$string too long
API String ID: 1352685159-4289949731
Opcode ID: 13bef7cd41df7e140717e92bfdf16302f3fd95dda6c587ddebc45e3a34070b8c
Instruction ID: 0f4e60d46eca5c6931a14bd2ab11566d3ea2765591bd5901858401b336e53c5e
Opcode Fuzzy Hash: 13bef7cd41df7e140717e92bfdf16302f3fd95dda6c587ddebc45e3a34070b8c
Instruction Fuzzy Hash: DF21D0753002059F9B24CF9DE8809AAFBE9FF94700300043EE406C7211DB70F919CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 005BFD10 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,3A04C82C), ref: 005BFD4F

Part of subcall function 005BA430: remove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,750292F0,?,005BFD6C), ref: 005BA435
Part of subcall function 005BA430: MoveFileExA.KERNEL32(00000000,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 005BA449

Strings

Failed [%d] to delete %s, xrefs: 005BFD8F
Sucessfully delete or pending delete %s, xrefs: 005BFD7E
stealth_manager, xrefs: 005BFD94, 005BFDB4
File "%s" does not exists., xrefs: 005BFDAF

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: FileMove_stat64i32remove
String ID: Failed [%d] to delete %s$File "%s" does not exists.$Sucessfully delete or pending delete %s$stealth_manager
API String ID: 3784990336-3582675600
Opcode ID: 1d29f8cbadc501391741207775562a34c4db7742eb4aabb9ef1bca6a2fa88ff2
Instruction ID: 24f6102dd01d86a8301ef8b67fc686f7a147d85e998795b5b44923a54e0768d4
Opcode Fuzzy Hash: 1d29f8cbadc501391741207775562a34c4db7742eb4aabb9ef1bca6a2fa88ff2
Instruction Fuzzy Hash: E3213971600209EFDF14DF59DC45AEE7BA8FB18700F80452BFC2686281EB75AA55CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005B8100 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005B8129

Part of subcall function 005CE041: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE068

SysAllocString.OLEAUT32(ROOT\CIMV2), ref: 005B8162
_com_issue_error.COMSUPP ref: 005B8173
_com_issue_error.COMSUPP ref: 005B818C

Strings

ROOT\CIMV2, xrefs: 005B814F

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _com_issue_error$AllocStringmalloc
String ID: ROOT\CIMV2
API String ID: 2559737271-2786109267
Opcode ID: 91f113637a69285356572e6f9a0dc39434c648bf67847fd388a4d67dd24168a6
Instruction ID: 9fc36b1296cd806ba164c62f0b788a8ebba55db50cd3340534ec4f9e3c94e0a3
Opcode Fuzzy Hash: 91f113637a69285356572e6f9a0dc39434c648bf67847fd388a4d67dd24168a6
Instruction Fuzzy Hash: 6E11A571901756DBD3209F99C905B56FBE8FB54B20F10432FE855A7380D7F5A940C790

Uniqueness

Uniqueness Score: -1.00%

Function 005C9F80 Relevance: 7.7, APIs: 5, Instructions: 167processCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000228,3A04C82C,00000000,00000000), ref: 005C9FF9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005CA00F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 005CA028
Process32NextW.KERNEL32(00000000,0000022C), ref: 005CA1C3
FindCloseChangeNotification.KERNELBASE(00000000), ref: 005CA1D2

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32memset
String ID:
API String ID: 2518216231-0
Opcode ID: 982d3e8238a8cf002c192f52559d111b1f5bbe5a6bb3c46b4528829b776f1da8
Instruction ID: 86daab247f0e0737e835b45a0faab4f5e3741c6ab4b6a6c1e9cd595b25a5782a
Opcode Fuzzy Hash: 982d3e8238a8cf002c192f52559d111b1f5bbe5a6bb3c46b4528829b776f1da8
Instruction Fuzzy Hash: 74615A709002599FDB20DFA4C989B9EBBB8FF44308F14469EE419A7291DB74AA44CF51

Uniqueness

Uniqueness Score: -1.00%

Function 005B4A80 Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(3A04C82C,?,?,750292F0,?,750292F0), ref: 005B4B04
?_Xbad_alloc@std@@YAXXZ.MSVCP140(3A04C82C,?,?,750292F0,?,750292F0), ref: 005B4B1A
new.LIBCMT ref: 005B4B21
new.LIBCMT ref: 005B4B35

Part of subcall function 005CE041: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE068

memmove.VCRUNTIME140(00000000,?,?,750292F0,?,750292F0), ref: 005B4B83

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xbad_alloc@std@@$mallocmemmove
String ID:
API String ID: 186744070-0
Opcode ID: b31d686b1d21a757ed436de47ef3014b42e4116bed8c6ca0e3b90a9e43cbbc6e
Instruction ID: 32eee57d6f006ffb862bda065eb557aa85a80b29e98d0eef67bdbaa6d1b2ae85
Opcode Fuzzy Hash: b31d686b1d21a757ed436de47ef3014b42e4116bed8c6ca0e3b90a9e43cbbc6e
Instruction Fuzzy Hash: 3D41B671600601DBCB34DF64D985BAABFE5FB44750B204A2DE552C7292D730F904CB65

Uniqueness

Uniqueness Score: -1.00%

Function 005C8A70 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CA767,?,?,?,?,?,?,?,?,00000000,00000000), ref: 005C8A80
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CA767,?,?,?,?,?,?,?,?,00000000,00000000), ref: 005C8A95
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CA767,?,?,?,?,?,?,?,?,00000000,00000000), ref: 005C8AA2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CA767,?,?,?,?,?,?,?,?,00000000,00000000), ref: 005C8AAF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CA767,?,?,?,?,?,?,?,?,00000000,00000000), ref: 005C8ABA

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f7d6e7fb6c60e9c917435e6f6357f5ff66e938c826d25869cf539d6b406280a2
Instruction ID: 894a4bfd184a224c3659a71e415c9eaad7eda059c38d87a9a7f32520e023f28b
Opcode Fuzzy Hash: f7d6e7fb6c60e9c917435e6f6357f5ff66e938c826d25869cf539d6b406280a2
Instruction Fuzzy Hash: E7F082389020064FD7286BE4DE5CA7CBF65BB64321B14443FE94BC1215DE619A849973

Uniqueness

Uniqueness Score: -1.00%

Function 005CAFB0 Relevance: 6.1, APIs: 4, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 005CC070: new.LIBCMT ref: 005CC075

Part of subcall function 005CB5A0: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,005C862E,00000009), ref: 005CB5CA

GetCurrentProcess.KERNEL32(?,00000008,00000000,00000000,3A04C82C), ref: 005CB051
IsWow64Process.KERNEL32(00000000), ref: 005CB058
OpenProcess.KERNEL32(00000410,00000000,00000009), ref: 005CB07A
IsWow64Process.KERNEL32(00000000,00000000), ref: 005CB087

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Process$Wow64$CurrentOpenXlength_error@std@@
String ID:
API String ID: 2815037454-0
Opcode ID: 0cec4882d54ea69c943e3d243a204b02dfd61f58cd455c5faad2e04e6fb44695
Instruction ID: fd5c4e7e4687ef06b4ea850dbf98f00f81feb4c272866f9fd252df0ff8b4cf45
Opcode Fuzzy Hash: 0cec4882d54ea69c943e3d243a204b02dfd61f58cd455c5faad2e04e6fb44695
Instruction Fuzzy Hash: 80513DB0A0020AEFEB14DF94D95ABAFBFB5FF44304F14451EE515AB280D7B95908CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005CA670 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(3A04C82C,?,?,?,?,00000000,00000000,000000FF,?,00000000), ref: 005CA6AF
?_Xbad_alloc@std@@YAXXZ.MSVCP140(3A04C82C,?,?,?,?,00000000,00000000,000000FF,?,00000000), ref: 005CA6C6
new.LIBCMT ref: 005CA6CD

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xbad_alloc@std@@
String ID:
API String ID: 3815834350-0
Opcode ID: 51560e2f85f89d2fb44963701a9ed5986f8adc4ae6891a924f369691bf3066b2
Instruction ID: 74b198990fe2eede0fa0b0a08878af052f600b0bab0cb7421f4a7f7dd5e90de8
Opcode Fuzzy Hash: 51560e2f85f89d2fb44963701a9ed5986f8adc4ae6891a924f369691bf3066b2
Instruction Fuzzy Hash: 8431E972E001059FCB18DF98CD46B6EBFB5FB94304F19416EE805EB351E6309940C792

Uniqueness

Uniqueness Score: -1.00%

Function 005B4E90 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,005CA4FB,00000000,?,00000000,?,005CAB20,?,3A04C82C,?,00000000,005C862E,005D1728,000000FF), ref: 005B4EA9
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,005CA4FB,00000000,?,00000000,?,005CAB20,?,3A04C82C,?,00000000,005C862E,005D1728,000000FF), ref: 005B4EBF
new.LIBCMT ref: 005B4EC6

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xbad_alloc@std@@
String ID:
API String ID: 3815834350-0
Opcode ID: e21000bac1fea83cf85134ab3d95f09d8587252391f7ac4d6057ca82213f69b5
Instruction ID: 13cd9df58db094b2b2f0c1dad03ac16a7d657ba3f6a6e20896893126ca32dc3f
Opcode Fuzzy Hash: e21000bac1fea83cf85134ab3d95f09d8587252391f7ac4d6057ca82213f69b5
Instruction Fuzzy Hash: 38F027B36001000FD728E7B4A80BD6E3B8CBB64364704023FF11AC6292F631E9A4D65B

Uniqueness

Uniqueness Score: -1.00%

Function 005C7120 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

Part of subcall function 005C6A90: WTSQueryUserToken.WTSAPI32(00000000,00000000,005D39AC,00000000,3A04C82C,00000000), ref: 005C6B37
Part of subcall function 005C6A90: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 005C6B58
Part of subcall function 005C6A90: CloseHandle.KERNEL32(00000000,?), ref: 005C6C03
Part of subcall function 005C6A90: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,005D39AC,00000000,3A04C82C,00000000), ref: 005C6C36

GetFileAttributesA.KERNELBASE(?,\extensions,0000000B,3A04C82C,00000000,00000000), ref: 005C71A9

Part of subcall function 005B45B0: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D), ref: 005B45CA
Part of subcall function 005B45B0: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D), ref: 005B45ED
Part of subcall function 005B45B0: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D), ref: 005B4608
Part of subcall function 005B45B0: memmove.VCRUNTIME140(?,?,3A04C82D,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C), ref: 005B466F

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,00000000,000000FF,005D3638,00000001), ref: 005C71E3

Part of subcall function 005BA430: remove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,750292F0,?,005BFD6C), ref: 005BA435
Part of subcall function 005BA430: MoveFileExA.KERNEL32(00000000,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 005BA449

Strings

\extensions, xrefs: 005C718C

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: FileFolderPathXlength_error@std@@$AttributesCloseHandleMoveQuerySpecialTokenUserXout_of_range@std@@_stat64i32memmoveremove
String ID: \extensions
API String ID: 3934399924-794364624
Opcode ID: 1d5af55ebd0412627ae4a0fb94a5809f0d3f1944a022d34d1554443cec29e461
Instruction ID: 8a6851bc0ed72243a86f3beb22ed23ba941aa2837d7babf922bf6a71ffa83dc8
Opcode Fuzzy Hash: 1d5af55ebd0412627ae4a0fb94a5809f0d3f1944a022d34d1554443cec29e461
Instruction Fuzzy Hash: E7414C31E04209AFDF14DB94CC49BEEBBB9FB49310F544119E8157B282DB716E45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005CA4C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,?,00000000,?,005CAB20,?,3A04C82C,?,00000000,005C862E,005D1728,000000FF), ref: 005CA4EF
memset.VCRUNTIME140(?,00000000,00000000,00000000,?,00000000,?,005CAB20,?,3A04C82C,?,00000000,005C862E,005D1728,000000FF), ref: 005CA50E

Strings

vector<T> too long, xrefs: 005CA4EA

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@memset
String ID: vector<T> too long
API String ID: 1527646195-3788999226
Opcode ID: 3b97eec0bd57c631d1061188dfc02d3957273629d151992412f5a9deef4ead39
Instruction ID: ca30287ff2a03043e61332c59d369ee31aa30b6fedb93096d7de32042301f493
Opcode Fuzzy Hash: 3b97eec0bd57c631d1061188dfc02d3957273629d151992412f5a9deef4ead39
Instruction Fuzzy Hash: 5BF096B2901212AFC3105F98DC05B95FBE8BF44710F14811BF91483240E7B1A820CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 005CB8E0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

Part of subcall function 005CC070: new.LIBCMT ref: 005CC075

Part of subcall function 005CB5A0: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,005C862E,00000009), ref: 005CB5CA

Part of subcall function 005CAA20: memset.VCRUNTIME140(0000000A,00000000,000003B7,00000000,3F800000,005C862E,005C862E,00000009,00000000), ref: 005CAA43
Part of subcall function 005CAA20: NtWow64ReadVirtualMemory64.NTDLL(?,005C862E,005C862E,00000009,000003B8,00000000,?,00000000,3F800000,005C862E,005C862E,00000009,00000000), ref: 005CAA83

Part of subcall function 005CBBF0: memset.VCRUNTIME140(00000009,00000000,00000044,?,00000000,005C862E,?,?,?,005C862E,00000009,00000000), ref: 005CBC13
Part of subcall function 005CBBF0: NtWow64ReadVirtualMemory64.NTDLL(?,?,005C862E,?,00000048,00000000,?,?,00000000,005C862E,?,?,?,005C862E,00000009,00000000), ref: 005CBC50

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(list<T> too long,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,005C862E,00000009), ref: 005CBBA7

Part of subcall function 005CBC70: memset.VCRUNTIME140(?,00000000,000000C0,?,?,005C862E,?,?,?,?,?,?,005C862E,00000009,00000000), ref: 005CBC9D
Part of subcall function 005CBC70: NtWow64ReadVirtualMemory64.NTDLL(?,?,005C862E,?,000000C8,00000000,?,?,?,005C862E,?,?,?), ref: 005CBCDD

Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4720
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4734
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4741
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B474E
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4759

Strings

list<T> too long, xrefs: 005CBBA2

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Memory64ReadVirtualWow64memset$Xlength_error@std@@
String ID: list<T> too long
API String ID: 1356422784-4027344264
Opcode ID: 95a245a37ca1b53620c3558b0c30534915e1b8ef7aac41a0dd86b8373936a770
Instruction ID: 583d527911f2368cda285f5a6a61c5c88fa33c6558e475cb8601458b9bf84410
Opcode Fuzzy Hash: 95a245a37ca1b53620c3558b0c30534915e1b8ef7aac41a0dd86b8373936a770
Instruction Fuzzy Hash: 83813371C002099FEB20CF94C949BEEBBB9FF84304F148199E409AB251DB756E85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005CA5D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,00000000,?,00000000,005CA197,?,00000000,00000000,000000FF,?,00000000), ref: 005CA61F

Strings

vector<T> too long, xrefs: 005CA61A

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: vector<T> too long
API String ID: 1004598685-3788999226
Opcode ID: ea398cad3b59b5236bd4a94e7dde10d8790b1e977e5574cf42359f19a6e146bb
Instruction ID: a55f29b8914022dda3e367d573ef0afb6b1aa7109c02fda9b736f1470dff3da7
Opcode Fuzzy Hash: ea398cad3b59b5236bd4a94e7dde10d8790b1e977e5574cf42359f19a6e146bb
Instruction Fuzzy Hash: 9101F733B010280F475C486D5D5442D6987A7D922531EC33EE506EF3C9E861DC5295C4

Uniqueness

Uniqueness Score: -1.00%

Function 005B47C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,005B6273,?,?,00000058,00000040,00000000,?,005BCC58,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026), ref: 005B47D4

Strings

string too long, xrefs: 005B47CF

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: string too long
API String ID: 1004598685-2556327735
Opcode ID: eee653e46299738d390e4cbfe32f0b6fe4955660d559cf421cec81c8b51dfe27
Instruction ID: ca02be63c3eb84490be0c29efab96d0ceed88ba83a7047d69e3c3e03476c8b91
Opcode Fuzzy Hash: eee653e46299738d390e4cbfe32f0b6fe4955660d559cf421cec81c8b51dfe27
Instruction Fuzzy Hash: F4F05532C12331934B316FA4A4014EA3F19FF11B75322414BF8016F252CB22ED52CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 005C9070 Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005C90DF
memset.VCRUNTIME140(00000000,00000000,00000030,00000030,?,00000000,000000FF,3A04C82C,00000000,00000000), ref: 005C90EE

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 264e76b6d5b7524a7f31dbdaeac6c8d295b7d8d995b45b18b4823ef6ae7052bc
Instruction ID: 1e0ca4120a20ad142bccb7f866d6edaff5c44e232f8561e19006dcd386eb6092
Opcode Fuzzy Hash: 264e76b6d5b7524a7f31dbdaeac6c8d295b7d8d995b45b18b4823ef6ae7052bc
Instruction Fuzzy Hash: E6318AB0504246EFEB24DF98D80AB9ABFF4FB01704F20455EE0159B7C2C7B6AA05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005BA4B0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,000000FF,750292F0,?,?,?,005C975E), ref: 005BA4BA
new.LIBCMT ref: 005BA4CB

Part of subcall function 005CE041: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE068

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: fopenmalloc
String ID:
API String ID: 1458608084-0
Opcode ID: 318508b68c68dcc5ef9137b8d9898ce26482f60280b21d474e9e376cfbb728bb
Instruction ID: 3e8c5b68605fa42c623d5dac9cb4758d1ba950aa69c4f7a3396ed5e24722c608
Opcode Fuzzy Hash: 318508b68c68dcc5ef9137b8d9898ce26482f60280b21d474e9e376cfbb728bb
Instruction Fuzzy Hash: 140175729052145ADB304B2998057E6BF95AF52324F78829EDC0C5B341F2B3994286D2

Uniqueness

Uniqueness Score: -1.00%

Function 005BA430 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

remove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,750292F0,?,005BFD6C), ref: 005BA435
MoveFileExA.KERNEL32(00000000,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 005BA449

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: FileMoveremove
String ID:
API String ID: 1863355238-0
Opcode ID: b7a2bfab516ac3aace3d2c50f3437cd760a3dcb63c9064652958559678b39b6f
Instruction ID: a7171c505d63c66b16936d80e2794d9b9a9a5e6335eb2f59c0697591d07d5c30
Opcode Fuzzy Hash: b7a2bfab516ac3aace3d2c50f3437cd760a3dcb63c9064652958559678b39b6f
Instruction Fuzzy Hash: 1AD05E3274212167E730266A7C0DBAB9B98ABA1E71F090037FA04E6250EAD4DD4660A2

Uniqueness

Uniqueness Score: -1.00%

Function 005BC500 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,3A04C82C,?,?,?,?,?,?,000000FF,005D00D6,000000FF), ref: 005BC57E

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Init@locale@std@@Locimp@12@_
String ID:
API String ID: 28175708-0
Opcode ID: 7dc4a59f2956c1960a33e0ca247200f6410f6cbea6638a33465f78e3b5971353
Instruction ID: d1eacca54957cbdb87c4b66b1d39795c9b9928b47883175b89d403994512f233
Opcode Fuzzy Hash: 7dc4a59f2956c1960a33e0ca247200f6410f6cbea6638a33465f78e3b5971353
Instruction Fuzzy Hash: E7412970A01249DFCB18CFA8D985BEEBBB5FF49304F50816DE416AB291D770A904CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005B2590 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005B25C2

Part of subcall function 005CE041: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE068

Part of subcall function 005B6A80: new.LIBCMT ref: 005B6ADD
Part of subcall function 005B6A80: InitializeCriticalSection.KERNEL32(00000004), ref: 005B6AF4

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CriticalInitializeSectionmalloc
String ID:
API String ID: 4141300597-0
Opcode ID: 4a2eef5dcfd4d6838ef9e02d7a1f4ed100418a45b9ade920806248fc95a87bee
Instruction ID: 75ae69963eb9648bea88cbd3d11404e8622ad1741790881272b7fd85e36fc758
Opcode Fuzzy Hash: 4a2eef5dcfd4d6838ef9e02d7a1f4ed100418a45b9ade920806248fc95a87bee
Instruction Fuzzy Hash: BF11A171905749AFDB10DF54C845BAA7BA4FB55320F00436AF8159B290EB70E940C790

Uniqueness

Uniqueness Score: -1.00%

Function 005B2620 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005B2652

Part of subcall function 005CE041: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE068

Part of subcall function 005B6A80: new.LIBCMT ref: 005B6ADD
Part of subcall function 005B6A80: InitializeCriticalSection.KERNEL32(00000004), ref: 005B6AF4

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CriticalInitializeSectionmalloc
String ID:
API String ID: 4141300597-0
Opcode ID: d639118b530322290a5f1bee8f467bbeb531cf101f4d44d80c1da1b7f487d63d
Instruction ID: ebcca3e627a3c3a4c45660e8baa945ea9f345bba0811b9d65e4c63d4f6144bce
Opcode Fuzzy Hash: d639118b530322290a5f1bee8f467bbeb531cf101f4d44d80c1da1b7f487d63d
Instruction Fuzzy Hash: 1E116171901746AFDB14DF54C845BAA7BA4FB59720F14436BF8159B290EB70E940C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 005BD460 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000002A,00000000,?), ref: 005BD493

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: FolderPathSpecial
String ID:
API String ID: 994120019-0
Opcode ID: 0673bf1a62dcc934455a1a00234b21d1c96a75fd022bb74ed78826097bcec0ff
Instruction ID: f4b9874b2de2227949bd4d83280653fa19aeddbdf417ecfc56518f859a5c61d9
Opcode Fuzzy Hash: 0673bf1a62dcc934455a1a00234b21d1c96a75fd022bb74ed78826097bcec0ff
Instruction Fuzzy Hash: 01019E30A042199ADB349F20C809BEABBB4AB15304F0001DDD88A57281DBF53A888B91

Uniqueness

Uniqueness Score: -1.00%

Function 005B6C80 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00002710,?,00000000,?), ref: 005B6CC2

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __stdio_common_vsprintf
String ID:
API String ID: 9700413-0
Opcode ID: fa925130abef2fd0653737d9661d91540bb4cba95177cee7a73b5914898fe368
Instruction ID: b91c34c811c7da347d833bcf4c1f5eeb240226c5d7c1edf01f98770445e0f4f3
Opcode Fuzzy Hash: fa925130abef2fd0653737d9661d91540bb4cba95177cee7a73b5914898fe368
Instruction Fuzzy Hash: F7018131600208AFDB00EF58DC8ADAF7BA9FF88310F00449AF90597251CA71BD20DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005BA580 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 005BA58B

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: fclose
String ID:
API String ID: 3125558077-0
Opcode ID: 664900c958c41d3b8199e1141ccdb681a2b8541e1dfc71c11ef125e1a3e5febc
Instruction ID: 4675e8dd557357bb37c1b52d8ee8878264b54e867be05550833463acefeb050f
Opcode Fuzzy Hash: 664900c958c41d3b8199e1141ccdb681a2b8541e1dfc71c11ef125e1a3e5febc
Instruction Fuzzy Hash: 91C04CB5A0571187EB309B18B90878377EC6F04714F05446AE45ED7640D678FE548AA6

Uniqueness

Uniqueness Score: -1.00%

Function 005BA740 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,005B5948), ref: 005BA741

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: edc1526b22e530b89b8c92ded006a130edf5c52d58f95f995f015b39fa0ec412
Instruction ID: 7ff6fd676cb70d33c154b4ed235182bb9b0231efd9b1613bcbb403f0c63beea6
Opcode Fuzzy Hash: edc1526b22e530b89b8c92ded006a130edf5c52d58f95f995f015b39fa0ec412
Instruction Fuzzy Hash: D6B092280096001A9E281A38592C1D92B20E9527A57D85B81D478854F18B3AA94FA592

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 005BAA30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 191fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,\*.*,00000004,00000000,00000000,000000FF,?,?,3A04C82C,75923310,005DEB78,00000000), ref: 005BAAFE
remove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000), ref: 005BAC22
FindNextFileA.KERNEL32(00000000,?), ref: 005BAC33
FindClose.KERNEL32(00000000), ref: 005BAC3F
GetLastError.KERNEL32 ref: 005BAC45

Strings

., xrefs: 005BAB20
\*.*, xrefs: 005BAADE

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNextremove
String ID: .$\*.*
API String ID: 779300091-3701014519
Opcode ID: dfd58d0c696627043632f57356b87071ed2ae9207d9da4a53bc21a99b1bc3765
Instruction ID: 9f72f636bde160100967017ce3587d54553ee5a778bb0df4418436ba72d6ed8c
Opcode Fuzzy Hash: dfd58d0c696627043632f57356b87071ed2ae9207d9da4a53bc21a99b1bc3765
Instruction Fuzzy Hash: 1971AE70800249DFEB25DBA4C899BEEBFB5FB05300F540099E415B7292D7756E89CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 005BA790 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 188fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,\*.*,00000004,00000000,00000000,000000FF,?,?,3A04C82C,75920F00,00000000), ref: 005BA85E

Part of subcall function 005BA430: remove.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,750292F0,?,005BFD6C), ref: 005BA435
Part of subcall function 005BA430: MoveFileExA.KERNEL32(00000000,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 005BA449

FindNextFileA.KERNEL32(00000000,?), ref: 005BA98B
FindClose.KERNEL32(00000000), ref: 005BA997
GetLastError.KERNEL32 ref: 005BA99D

Strings

., xrefs: 005BA880
\*.*, xrefs: 005BA83E

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: FileFind$CloseErrorFirstLastMoveNextremove
String ID: .$\*.*
API String ID: 1879715955-3701014519
Opcode ID: 8ba7bfc24786e2e6b93e5714a0ae7351d9cf6dcb749b7ef78fc5b84997ceb38a
Instruction ID: c636c9c7ebb5c6424adf0da3889787de9fc97160eb95ffc8d6bc3576e22e50de
Opcode Fuzzy Hash: 8ba7bfc24786e2e6b93e5714a0ae7351d9cf6dcb749b7ef78fc5b84997ceb38a
Instruction Fuzzy Hash: E5718D308002599FEF25DBA4C859BEEBFB5FB06304F540199E405B7292DB752E85CF62

Uniqueness

Uniqueness Score: -1.00%

Function 005CC870 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 312COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,005CC4AD,00000010), ref: 005CC8B5
_CxxThrowException.VCRUNTIME140(00000000,005DCCC0,00000000,?,00000000,?,005CC4AD), ref: 005CCC64

Strings

Xf], xrefs: 005CCA66
, xrefs: 005CD1C7

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ExceptionThrowmemmove
String ID: $Xf]
API String ID: 3420374180-1818328592
Opcode ID: c6e89bce823434805611cc5155a9f811212373abf6051988f64f464aa8c0696e
Instruction ID: d81b840a12d242488b3d106174b3c5beb93e56e263332f52ffb210fc82e6be9a
Opcode Fuzzy Hash: c6e89bce823434805611cc5155a9f811212373abf6051988f64f464aa8c0696e
Instruction Fuzzy Hash: 91C1BE709001598FCB18CF68C894AAD7FE5FF89304F4984AEEC59EF256D734AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005B3551 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4), ref: 005B3565

Part of subcall function 005B2450: __std_exception_destroy.VCRUNTIME140(?), ref: 005B2491

__std_exception_copy.VCRUNTIME140(?,?), ref: 005B35EB
_CxxThrowException.VCRUNTIME140(x7],005DCC24), ref: 005B3665
GetLastError.KERNEL32(x7],005DCC24), ref: 005B366E
Sleep.KERNEL32(000001F4), ref: 005B3687
__std_exception_destroy.VCRUNTIME140(?), ref: 005B369E

Strings

post_install, xrefs: 005B3B02
`|9n, xrefs: 005B369E
x7], xrefs: 005B364F, 005B365A
Error %s, xrefs: 005B3AFD

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Sleep__std_exception_destroy$ErrorExceptionLastThrow__std_exception_copy
String ID: Error %s$`|9n$post_install$x7]
API String ID: 3014290511-698563706
Opcode ID: 3e64fbc908652b2c6fc5d9489053db602a2b1698c5875545a1a7d306e4910d99
Instruction ID: 880a6bed3fec0f5fd388414eb76fb62dd5a038e23e51b25ccba37bb26ed93752
Opcode Fuzzy Hash: 3e64fbc908652b2c6fc5d9489053db602a2b1698c5875545a1a7d306e4910d99
Instruction Fuzzy Hash: 4F4100B1D4021E9ADB30DB54CD49BDABFB8BF15304F4442E7E509A2241E774AB88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 005B3294 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 95sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4), ref: 005B32A8

Part of subcall function 005B2450: __std_exception_destroy.VCRUNTIME140(?), ref: 005B2491

__std_exception_copy.VCRUNTIME140(?,?), ref: 005B331A
_CxxThrowException.VCRUNTIME140(x7],005DCC24), ref: 005B3394
GetLastError.KERNEL32(x7],005DCC24), ref: 005B33A3
GetLastError.KERNEL32(?,?,?,00000000,000000FF), ref: 005B33CD
Sleep.KERNEL32(000001F4,?,?,?,00000000,000000FF), ref: 005B33E3
__std_exception_destroy.VCRUNTIME140(?), ref: 005B33FA

Strings

post_install, xrefs: 005B33C0, 005B3B02
`|9n, xrefs: 005B33FA
x7], xrefs: 005B337E, 005B3389
Unknown exception, xrefs: 005B33AB, 005B33B9
Last Error : %d [message : %s] retry count: %d, xrefs: 005B33BB
Error %s, xrefs: 005B3AFD

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ErrorLastSleep__std_exception_destroy$ExceptionThrow__std_exception_copy
String ID: Error %s$Last Error : %d [message : %s] retry count: %d$Unknown exception$`|9n$post_install$x7]
API String ID: 1914385622-1590388844
Opcode ID: bedb00db69b66fa1ab22b28db3831823b716e7b78f191b29ef264f81a7ba8e7b
Instruction ID: 64b25a4ab79faeb04902a46593018ad923569fb483b9ee2ade4ffddc75e78984
Opcode Fuzzy Hash: bedb00db69b66fa1ab22b28db3831823b716e7b78f191b29ef264f81a7ba8e7b
Instruction Fuzzy Hash: B9414CB49012599BDB20DB58CC49BDDBFB4BF54305F4041EAE108A7241EB706B88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 005B3409 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 93sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4), ref: 005B341D

Part of subcall function 005B2450: __std_exception_destroy.VCRUNTIME140(?), ref: 005B2491

__std_exception_copy.VCRUNTIME140(?,?), ref: 005B348F
_CxxThrowException.VCRUNTIME140(x7],005DCC24), ref: 005B3509
GetLastError.KERNEL32(x7],005DCC24), ref: 005B3512
Sleep.KERNEL32(000001F4), ref: 005B352B
__std_exception_destroy.VCRUNTIME140(?), ref: 005B3542

Strings

post_install, xrefs: 005B3B02
`|9n, xrefs: 005B3542
x7], xrefs: 005B34F3, 005B34FE
Error %s, xrefs: 005B3AFD

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Sleep__std_exception_destroy$ErrorExceptionLastThrow__std_exception_copy
String ID: Error %s$`|9n$post_install$x7]
API String ID: 3014290511-698563706
Opcode ID: 6cbc84085559b1ff925d8fa406de9eb0dc4e0917d174a88e31094065c1a8de62
Instruction ID: c5aec037b0af53088c661243380c43c2db75e041aa88b12094da3d7f70e9e623
Opcode Fuzzy Hash: 6cbc84085559b1ff925d8fa406de9eb0dc4e0917d174a88e31094065c1a8de62
Instruction Fuzzy Hash: B9412CB094122D9ADB60DB54CC49BCDBFB8BF15304F5046EAE109A6241EB706BC8CF66

Uniqueness

Uniqueness Score: -1.00%

Function 005CC5E0 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 106COMMON

Download Yara Rule

APIs

__RTDynamicCast.VCRUNTIME140(00000000,00000000,84],84],00000000,?,?,?,?,?,005C9B62,00000000,00000000,00000002,?,3A04C82C), ref: 005CC60F

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__RTDynamicCast.VCRUNTIME140(00000000,00000000,84],84],00000000,?,?,?,?,?,005C9B62,00000000,00000000,00000002,?,3A04C82C), ref: 005CC670
_CxxThrowException.VCRUNTIME140(?,005DCD08,Invalid Argument), ref: 005CC6FE

Strings

Unsupported type, xrefs: 005CC6BF
Invalid Argument, xrefs: 005CC636, 005CC695, 005CC6E0
84], xrefs: 005CC608, 005CC668
84], xrefs: 005CC603
%s (AES) Wrong Arguments, xrefs: 005CC622
Cryptography::cCryptography::encrypt, xrefs: 005CC61D, 005CC67E, 005CC6A6
84], xrefs: 005CC663
%s (RSA) Wrong Arguments, xrefs: 005CC683
%s unsupport type exit }, xrefs: 005CC6AB
cryptography, xrefs: 005CC627, 005CC688, 005CC6B0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CastDynamic$ExceptionThrow
String ID: %s (AES) Wrong Arguments$%s (RSA) Wrong Arguments$%s unsupport type exit }$84]$84]$84]$Cryptography::cCryptography::encrypt$Invalid Argument$Unsupported type$cryptography
API String ID: 2625377109-3487185056
Opcode ID: 0b2b36d51b3453d4ff3783908b0d0e3b6ae07bc9ca850c1018dc844099d5aa4a
Instruction ID: 47c5218affe93f306f2fce14bc74195eaa416064c25173625a80a2428e8cab2a
Opcode Fuzzy Hash: 0b2b36d51b3453d4ff3783908b0d0e3b6ae07bc9ca850c1018dc844099d5aa4a
Instruction Fuzzy Hash: CC21A8357402057BCE34BAAD8D0BFAE7E58BB85B14F10045FF905AB382D6A1A94146E6

Uniqueness

Uniqueness Score: -1.00%

Function 005B6690 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 352COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B66A8
?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B66C0
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B6701
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long), ref: 005B672A
memmove.VCRUNTIME140(?,00000000,?,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B67C9
memmove.VCRUNTIME140(00000000,?,00000000,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B67FB
memmove.VCRUNTIME140(?,?,00000000,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B683D
memmove.VCRUNTIME140(?,?,00000000,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B6883
memmove.VCRUNTIME140(?,?,?,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B68CB
memmove.VCRUNTIME140(?,?,00000000,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B6903

Strings

string too long, xrefs: 005B66FC, 005B6725
invalid string position, xrefs: 005B66A3, 005B66BB

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: memmove$Xlength_error@std@@Xout_of_range@std@@
String ID: invalid string position$string too long
API String ID: 2690457442-4289949731
Opcode ID: e9c4a513b0dac760697accd264d3ae8f96e732c51f959146af0cadf0f9c26f38
Instruction ID: 2f19381d0aeba7e82e502745b6b9cfeb3ff720a6a6e3786fae37c5ddcd938ebe
Opcode Fuzzy Hash: e9c4a513b0dac760697accd264d3ae8f96e732c51f959146af0cadf0f9c26f38
Instruction Fuzzy Hash: 44D13C70700205DBDF24CF48D9C499ABBB6FF88704B248929E8968B346CB34FD95DB95

Uniqueness

Uniqueness Score: -1.00%

Function 005CC710 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 124COMMON

Download Yara Rule

APIs

__RTDynamicCast.VCRUNTIME140(005C9967,00000000,84],84],00000000,?,?,?,?,?,?,005C9967,00000000,00000000), ref: 005CC73F

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__RTDynamicCast.VCRUNTIME140(005C9967,00000000,84],84],00000000,?,?,?,?,?,?,005C9967,00000000,00000000), ref: 005CC79B
_CxxThrowException.VCRUNTIME140(?,005DCD08,Invalid Argument), ref: 005CC81C

Strings

Invalid Argument, xrefs: 005CC761, 005CC7BD, 005CC7FE
84], xrefs: 005CC738, 005CC793
84], xrefs: 005CC733
84], xrefs: 005CC78E
Wrong Arguments, xrefs: 005CC74D, 005CC7A9
%s unsupport type exit }, xrefs: 005CC7CE
Cryptography::cCryptography::decrypt, xrefs: 005CC7C9
cryptography, xrefs: 005CC752, 005CC7AE, 005CC7D3

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CastDynamic$ExceptionThrow
String ID: %s unsupport type exit }$84]$84]$84]$Cryptography::cCryptography::decrypt$Invalid Argument$Wrong Arguments$cryptography
API String ID: 2625377109-1808501998
Opcode ID: 1b3fe50f3a937917d8709ced9baf721cdeb1a2e0db3787f01c8544d00db9f766
Instruction ID: 54ee5bd1c646cd39ce6c9466e99faf87eeb7ccbf8fa614b869aabea2054170e4
Opcode Fuzzy Hash: 1b3fe50f3a937917d8709ced9baf721cdeb1a2e0db3787f01c8544d00db9f766
Instruction Fuzzy Hash: 5331D8357402053BDA347AAC5C4BFAA7E98FB85B10F50046FF909EB3C2D791690146E2

Uniqueness

Uniqueness Score: -1.00%

Function 005B7A80 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,?,?,?,?,?,?,000000FF,005D00D6,000000FF), ref: 005B7A98
?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,?,?,?,?,?,?,?,?,000000FF,005D00D6,000000FF), ref: 005B7AB2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,?,?,?,?,?,?,?,?,000000FF,005D00D6,000000FF), ref: 005B7AED
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 005B7B4D
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 005B7B9D
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 005B7BD7
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 005B7C1C
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 005B7C5F

Strings

string too long, xrefs: 005B7AE8
invalid string position, xrefs: 005B7A93, 005B7AAD

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: memmove$Xout_of_range@std@@$Xlength_error@std@@
String ID: invalid string position$string too long
API String ID: 1729942311-4289949731
Opcode ID: 9dff705a64ed07bf271f9ff88a303022ffca298a31657729d6d81f13767626f3
Instruction ID: 4f4c440e0d8720e6fd49a6e819a10e02d7e7edf7ac60c63dd8a44416d43a7b9b
Opcode Fuzzy Hash: 9dff705a64ed07bf271f9ff88a303022ffca298a31657729d6d81f13767626f3
Instruction Fuzzy Hash: 0CE1097160450ADFCB24CF58D5848AABBB6FFC8344720496EE8469B611DB30FE65CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 005B64A0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 202COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,00000000,00000000,system32,00000008,00000000,?), ref: 005B650D
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B6532
memmove.VCRUNTIME140(?,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B6579
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B65A4
memmove.VCRUNTIME140(?,?,?,?,00000000,00000000,system32,00000008,00000000,?), ref: 005B662D

Strings

string too long, xrefs: 005B652D, 005B659F
invalid string position, xrefs: 005B6508

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@memmove$Xout_of_range@std@@
String ID: invalid string position$string too long
API String ID: 4132317908-4289949731
Opcode ID: d6d78ad15c47d2f4323bee6c59c9689c43cf9c61e246c3324d05145dfc998fc0
Instruction ID: 98bb952ab0a9b6c2b5f116c5da47f20c45b399b80cce0333beb4270486333b53
Opcode Fuzzy Hash: d6d78ad15c47d2f4323bee6c59c9689c43cf9c61e246c3324d05145dfc998fc0
Instruction Fuzzy Hash: 7061B1317002059FDB24CF5CD884AAABFF6FB94711B24892EE846C7381DB75ED508B91

Uniqueness

Uniqueness Score: -1.00%

Function 005C5BC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,00000000,00000000,00000007,?,005C6261,00000000,?,00000000,000000FF,?), ref: 005C5BDA
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000000,00000000,00000007,?,005C6261,00000000,?,00000000,000000FF,?), ref: 005C5BFA
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000000,00000000,00000007,?,005C6261,00000000,?,00000000,000000FF,?), ref: 005C5C15
memmove.VCRUNTIME140(00000000,00000000,?,00000000,00000000,00000007,?,005C6261,00000000,?,00000000,000000FF,?), ref: 005C5C7C
memmove.VCRUNTIME140(00000000,?,00000000,00000000,00000000,00000007,?,005C6261,00000000,?,00000000,000000FF,?), ref: 005C5CC0

Strings

string too long, xrefs: 005C5BF5, 005C5C10
invalid string position, xrefs: 005C5BD5

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@memmove$Xout_of_range@std@@
String ID: invalid string position$string too long
API String ID: 4132317908-4289949731
Opcode ID: 70900809da3ab02473f22651b536f9fed180f73accd709edf9e6673a79eba924
Instruction ID: d779b79ee9bc2645d22083a8ca8005c8f00a275102a53364d5c199ef7cee7079
Opcode Fuzzy Hash: 70900809da3ab02473f22651b536f9fed180f73accd709edf9e6673a79eba924
Instruction Fuzzy Hash: 68417C71700B058FD7248FDCE884E6ABBA5FB94B01B60092EE492C7251EB70FD80C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 005BCAE0 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 005B9440: new.LIBCMT ref: 005B9442

GetCurrentProcess.KERNEL32(00000000,3A04C82C,750292F0,00000000), ref: 005BCBDC
IsWow64Process.KERNEL32(00000000), ref: 005BCBE3
new.LIBCMT ref: 005BCC79

Part of subcall function 005B46A0: memmove.VCRUNTIME140(00000001,9U[,?,00000001,00000000,?,005B5539,00000000,005D3638,00000001), ref: 005B46BB

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

Data, xrefs: 005BCCAB
\MiscStatus\1, xrefs: 005BCC5F, 005BCC6D
SOFTWARE\Classes\CLSID\, xrefs: 005BCC09
{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}, xrefs: 005BCC2C, 005BCC3F

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process$CurrentWow64memmove
String ID: Data$SOFTWARE\Classes\CLSID\$\MiscStatus\1${d07606c8-6532-4d75-a46d-f5f5ac6ef74a}
API String ID: 1129509905-531586979
Opcode ID: 08873bfc81585f815d3d5d988afa90bee19d1efe78608f485a7490e822729c96
Instruction ID: 13d5258446a55733ea8b280097ab817f72695a8524ba37c82a29c1cfa78e6298
Opcode Fuzzy Hash: 08873bfc81585f815d3d5d988afa90bee19d1efe78608f485a7490e822729c96
Instruction Fuzzy Hash: 3AC1DE70A04244DFEF18DF68D849BAEBFB5FF45304F600469E4129B292C771AD45CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 005CC340 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

_CxxThrowException.VCRUNTIME140(?,005DCCC0), ref: 005CC38A
new.LIBCMT ref: 005CC3AD
_CxxThrowException.VCRUNTIME140(?,005DCCC0), ref: 005CC436
memmove.VCRUNTIME140(00000000,?,?,?,?), ref: 005CC495
new.LIBCMT ref: 005CC4BD

Strings

Invalid Argument, xrefs: 005CC382, 005CC42E, 005CC526

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ExceptionThrow$memmove
String ID: Invalid Argument
API String ID: 265668421-3158457447
Opcode ID: 9b6a12a9a10a2eb84a4d10ad50dd62a16fbbfa0c76b1f9e3ff82e13ee9c8c473
Instruction ID: 5687f7acbea9c0804b841378a80bacdfe4a95847488a2c1b56d08d07f301e8b6
Opcode Fuzzy Hash: 9b6a12a9a10a2eb84a4d10ad50dd62a16fbbfa0c76b1f9e3ff82e13ee9c8c473
Instruction Fuzzy Hash: B4516271500209AFCB14AF98D88AFAEBFB8FF44310F04456EF91997352D7B1A954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 005B78B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,?,?,?,?,?,000000FF,005D00D6,000000FF), ref: 005B7920
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,?,?,?,?,?,?,000000FF,005D00D6,000000FF), ref: 005B7949
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF,005D00D6,000000FF), ref: 005B799B
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 005B7A1A
memmove.VCRUNTIME140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,000000FF), ref: 005B7A42

Strings

string too long, xrefs: 005B7944
invalid string position, xrefs: 005B791B

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: memmove$Xlength_error@std@@Xout_of_range@std@@
String ID: invalid string position$string too long
API String ID: 2690457442-4289949731
Opcode ID: 33dd9bb927da2b49e9774d83abbde347b14e4a19c3730cd5c50e51bd9f1434ee
Instruction ID: 7bfc0e0fbbab5c16dd90f7a593002b39396d224966205ea7360e78418ab8fca1
Opcode Fuzzy Hash: 33dd9bb927da2b49e9774d83abbde347b14e4a19c3730cd5c50e51bd9f1434ee
Instruction Fuzzy Hash: 0A61607160460D9FCB24CF58D9848EEBBA6FFC8700720892EE846CB615E731FA55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005CDB10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000000,?,00000000,005CC3D8,?,?,?,?,?,?,?,?,005CC3D8,00000000,?,?), ref: 005CDB33
_CxxThrowException.VCRUNTIME140(?,005DCD08,cPKCS5Padding::createPaddedItem-Parameter Error), ref: 005CDBAB
memmove.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 005CDC0E
_CxxThrowException.VCRUNTIME140(?,005DCD08,cPKCS5Padding: Calculating error), ref: 005CDC92

Strings

cPKCS5Padding: Padding bit error, xrefs: 005CDC39
cPKCS5Padding::createPaddedItem-Parameter Error, xrefs: 005CDB8D
cPKCS5Padding: There is no Padding applied, xrefs: 005CDC58
cPKCS5Padding: Calculating error, xrefs: 005CDC77

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ExceptionThrowmemmove
String ID: cPKCS5Padding: Calculating error$cPKCS5Padding: Padding bit error$cPKCS5Padding: There is no Padding applied$cPKCS5Padding::createPaddedItem-Parameter Error
API String ID: 3420374180-27806664
Opcode ID: 304d05aeab1c6b3b670a033405b12ef78543037a7403f66ef420ec34a8ec3e08
Instruction ID: 77f2ab6f7b749cea8ef7c42575f2adff2f2f083b856f554ccd1e28e346647ad2
Opcode Fuzzy Hash: 304d05aeab1c6b3b670a033405b12ef78543037a7403f66ef420ec34a8ec3e08
Instruction Fuzzy Hash: 334118312002056FCB24AEA8C856FBE7FA5FB85704F64056DE9409B282D7B39D0687F1

Uniqueness

Uniqueness Score: -1.00%

Function 005CDDA6 Relevance: 12.1, APIs: 8, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 005CDDC4
MultiByteToWideChar.KERNEL32(00000000,00000000,005B80C5,?,00000000,00000000,?,?,?,?,?,005B80C5), ref: 005CDDD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,005B80C5), ref: 005CDDE6
GetLastError.KERNEL32(?,?,?,?,?,005B80C5), ref: 005CDDEE
_com_issue_error.COMSUPP ref: 005CDE01
SysAllocString.OLEAUT32(00000000), ref: 005CDE07
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,005B80C5), ref: 005CDE18
_com_issue_error.COMSUPP ref: 005CDE29

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _com_issue_error$free$AllocByteCharErrorLastMultiStringWide
String ID:
API String ID: 2419198754-0
Opcode ID: 2e50800aa42479d011b1d5af398c852389fea8217f6a4efc79fb20203f1bd011
Instruction ID: 9af6f73398ecafcb511a4974e58987e09c0da7b834e8ca4505a532b8e328e3cd
Opcode Fuzzy Hash: 2e50800aa42479d011b1d5af398c852389fea8217f6a4efc79fb20203f1bd011
Instruction Fuzzy Hash: 6C11C671A0021A9FDB206BE4984AF9F7B78FF98750F00013EF905E6180D669A940D6F5

Uniqueness

Uniqueness Score: -1.00%

Function 005CA250 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000009,3A04C82C,00000000,?), ref: 005CA288

Part of subcall function 005CA4C0: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,?,00000000,?,005CAB20,?,3A04C82C,?,00000000,005C862E,005D1728,000000FF), ref: 005CA4EF
Part of subcall function 005CA4C0: memset.VCRUNTIME140(?,00000000,00000000,00000000,?,00000000,?,005CAB20,?,3A04C82C,?,00000000,005C862E,005D1728,000000FF), ref: 005CA50E

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00000104,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005CA2C0
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,00000000,005D1670), ref: 005CA309
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,?,?,?,?,?,?,?,?,?,?,00000000,005D1670,000000FF,?,005CA219), ref: 005CA376
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,005D1670,000000FF,?,005CA219), ref: 005CA466

Part of subcall function 005CA530: memmove.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,005D1670,000000FF), ref: 005CA591

Strings

vector<T> too long, xrefs: 005CA371

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: FileModuleNameXlength_error@std@@$CloseHandleOpenProcessmemmovememset
String ID: vector<T> too long
API String ID: 1534356585-3788999226
Opcode ID: ec146b91da8698ae997a7ce89ff2ae74eb2cb6c75900e0910435bfcb9020b530
Instruction ID: 5a95ac57892357c655417bec56bc5195ae100101c69494c74f3efccf5ae843cb
Opcode Fuzzy Hash: ec146b91da8698ae997a7ce89ff2ae74eb2cb6c75900e0910435bfcb9020b530
Instruction Fuzzy Hash: 6E615C719002499ECF14EBE4CC89FEEBFB9BF85314F140519E816A7292DB70AE05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 005B4370 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B438A

Part of subcall function 005B49E0: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,005B43E3,00000000,0000023A,?,?,00000000,?,005B42CF,?,00000000,0000023A), ref: 005B49F6

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B43AB

Strings

string too long, xrefs: 005B43F1
invalid string position, xrefs: 005B4385, 005B43A6

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position$string too long
API String ID: 1960685668-4289949731
Opcode ID: 80e99309a9fec16884c88e126955ff3e481bbab0b5c8c779315a8684fa49ffbd
Instruction ID: 21907b5c0d9d1611217707d6a81a7c27938b3e66294b7823a3c461afe7263c46
Opcode Fuzzy Hash: 80e99309a9fec16884c88e126955ff3e481bbab0b5c8c779315a8684fa49ffbd
Instruction Fuzzy Hash: 953182323006108BDB309F9CE841B9BFFE5FB95B51F10492FE55687242D7B1A9508BA1

Uniqueness

Uniqueness Score: -1.00%

Function 005B4810 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,00000058,?,00000017,?,005B4130,?,00000017,?,00000040,00000000,?,005BCC26,SOFTWARE\Classes\CLSID\,00000017), ref: 005B482A
?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,00000058,?,00000017,?,005B4130,?,00000017,?,00000040,00000000,?,005BCC26,SOFTWARE\Classes\CLSID\,00000017), ref: 005B484B
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000058,?,00000017,?,005B4130,?,00000017,?,00000040,00000000,?,005BCC26,SOFTWARE\Classes\CLSID\,00000017), ref: 005B4885
memmove.VCRUNTIME140(?,?,?,00000058,?,00000017,?,005B4130,?,00000017,?,00000040,00000000,?,005BCC26,SOFTWARE\Classes\CLSID\), ref: 005B48EE

Strings

string too long, xrefs: 005B4880
invalid string position, xrefs: 005B4825, 005B4846

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xout_of_range@std@@$Xlength_error@std@@memmove
String ID: invalid string position$string too long
API String ID: 3597620626-4289949731
Opcode ID: 5117da969f49a9f25134c4d3bb2cafdb7b221dc07ab5699488e6c0d708005451
Instruction ID: 999b4b59f169fa0019a03cf354b302873704dc46df10711fdbb677e2ac64a158
Opcode Fuzzy Hash: 5117da969f49a9f25134c4d3bb2cafdb7b221dc07ab5699488e6c0d708005451
Instruction Fuzzy Hash: 92318D327057149B87349F68E8848ABFBE5FFD4B113100A2FF556C7612EB31A914CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005B45B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D), ref: 005B45CA
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D), ref: 005B45ED
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D), ref: 005B4608
memmove.VCRUNTIME140(?,?,3A04C82D,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C), ref: 005B466F

Strings

string too long, xrefs: 005B45E8, 005B4603
invalid string position, xrefs: 005B45C5

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@$Xout_of_range@std@@memmove
String ID: invalid string position$string too long
API String ID: 3326265527-4289949731
Opcode ID: cff48654c9acdcb6cc04982ec63b7a0f1f980254d34570fe4c7945cb66cf3cc9
Instruction ID: 7d3efa2316d41ab40820c49b4ba1099f17dddb1ee198a8c5f15cd993a2683101
Opcode Fuzzy Hash: cff48654c9acdcb6cc04982ec63b7a0f1f980254d34570fe4c7945cb66cf3cc9
Instruction Fuzzy Hash: CB31B4723016459FDB348F5CE840AAABBE5FF95B11B10092FE556CB242D771ED008BA5

Uniqueness

Uniqueness Score: -1.00%

Function 005C5854 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C5889

Strings

`|9n, xrefs: 005C5889
5, xrefs: 005C5854
Update libcrypto Error: %s, xrefs: 005C5869
Unknown exception, xrefs: 005C5858, 005C5868
stealth_manager, xrefs: 005C586E

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: 5$Unknown exception$Update libcrypto Error: %s$`|9n$stealth_manager
API String ID: 2453523683-1910171895
Opcode ID: b918909f03590bd30195b1ffc483a203408e604afffc522d8c5cd8f50a23e929
Instruction ID: 3c4050d7d3c3b4db86f7a56bcb9cc4d4eff930bc20af2d55c85576fabc893c1f
Opcode Fuzzy Hash: b918909f03590bd30195b1ffc483a203408e604afffc522d8c5cd8f50a23e929
Instruction Fuzzy Hash: 16E0E670A00618ABDB25E7688C4EAD97EF4BB44301F4040DBA50597341EA745F448E62

Uniqueness

Uniqueness Score: -1.00%

Function 005C5A18 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C5A4D

Strings

`|9n, xrefs: 005C5A4D
Update libssl Error: %s, xrefs: 005C5A2D
;, xrefs: 005C5A18
Unknown exception, xrefs: 005C5A1C, 005C5A2C
stealth_manager, xrefs: 005C5A32

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: ;$Unknown exception$Update libssl Error: %s$`|9n$stealth_manager
API String ID: 2453523683-1428053332
Opcode ID: 7b0dde8d7e2c7e1a01fba412f49071bf7a483151aacbe9d12e6c1eb5938dbc63
Instruction ID: 8f39281961f8ba9ad8385465b1f8c65b4c156735b6dfc09d56f005c5718c0156
Opcode Fuzzy Hash: 7b0dde8d7e2c7e1a01fba412f49071bf7a483151aacbe9d12e6c1eb5938dbc63
Instruction Fuzzy Hash: A4E0E670600614ABDB31E7588D5DBA97EE8BB54305F8000DBA44597341E6745F548A22

Uniqueness

Uniqueness Score: -1.00%

Function 005C531A Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C534F

Strings

`|9n, xrefs: 005C534F
#, xrefs: 005C531A
Update PocoNetSSL Error: %s, xrefs: 005C532F
Unknown exception, xrefs: 005C531E, 005C532E
stealth_manager, xrefs: 005C5334

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: #$Unknown exception$Update PocoNetSSL Error: %s$`|9n$stealth_manager
API String ID: 2453523683-1002488867
Opcode ID: d24e76fa746e444f663b3bb87e98d902b17b10e9a494ebd87ff47cdaa68b2e04
Instruction ID: 67f534972172c204e0815bdfc4e1ed4dd17382e3d459bf8330824f10dc688171
Opcode Fuzzy Hash: d24e76fa746e444f663b3bb87e98d902b17b10e9a494ebd87ff47cdaa68b2e04
Instruction Fuzzy Hash: 8CE08620640206ABDF34ABA88D0DB6A7EF8BB04300F4000EBA40597341F6755F449A22

Uniqueness

Uniqueness Score: -1.00%

Function 005C54D8 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C550D

Strings

`|9n, xrefs: 005C550D
Update PocoUtil Error: %s, xrefs: 005C54ED
), xrefs: 005C54D8
Unknown exception, xrefs: 005C54DC, 005C54EC
stealth_manager, xrefs: 005C54F2

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: )$Unknown exception$Update PocoUtil Error: %s$`|9n$stealth_manager
API String ID: 2453523683-301406755
Opcode ID: 1255b39da62781eb65c5c84c2ccf34ffc2e39cfd99cdf4c9fe747a7bde2e2b58
Instruction ID: cb2e75a1c34fd4b05104484bb187a47cfedfdfebcda632831a53e7ed2168707c
Opcode Fuzzy Hash: 1255b39da62781eb65c5c84c2ccf34ffc2e39cfd99cdf4c9fe747a7bde2e2b58
Instruction Fuzzy Hash: 25E0EC70600614AFDF21E7A88D0DBAA7EE4BB54304F4040EBA445A7341E6B5AE848A22

Uniqueness

Uniqueness Score: -1.00%

Function 005C5696 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C56CB

Strings

`|9n, xrefs: 005C56CB
Update PocoXML Error: %s, xrefs: 005C56AB
Unknown exception, xrefs: 005C569A, 005C56AA
/, xrefs: 005C5696
stealth_manager, xrefs: 005C56B0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: /$Unknown exception$Update PocoXML Error: %s$`|9n$stealth_manager
API String ID: 2453523683-4294564018
Opcode ID: 2c00c44a41a9831790115fb83533354f6658c18ebc0d30425412cb33f3f6a8ee
Instruction ID: fccabc975a2a5ff278441c5f652e03cfcf7d36e6ddcc618bef9d2b3d15c6f11b
Opcode Fuzzy Hash: 2c00c44a41a9831790115fb83533354f6658c18ebc0d30425412cb33f3f6a8ee
Instruction Fuzzy Hash: F1E0E630600214ABDB25A7688D1DAA97FF4FB54704F4045EBA40597342E7B55F848E62

Uniqueness

Uniqueness Score: -1.00%

Function 005B5BF0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,3A04C82C,00000000,?), ref: 005B5C34
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,00000001,?,00000000,000000FF,_%d,00000003,?,00000000,000000FF,?,00000000,000000FF), ref: 005B5D80
wcsnlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000104), ref: 005B5D95
rename.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,00000000), ref: 005B5E00

Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
Part of subcall function 005B4770: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Strings

_%d, xrefs: 005B5D0A

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$_stat64i32_wstat64i32renamewcsnlen
String ID: _%d
API String ID: 1077365053-982369593
Opcode ID: a2bd50b6a92fc97f912725a4409ccf16f0f2442d2728dbdd1b270a2607ebd3f2
Instruction ID: d9c1741c3a082e0429b37d5038a21f9e87f5e71a17b5e371164e1859b628f1c2
Opcode Fuzzy Hash: a2bd50b6a92fc97f912725a4409ccf16f0f2442d2728dbdd1b270a2607ebd3f2
Instruction Fuzzy Hash: 158138709102299BDB24DB54CC99BDABBB9FF54300F5006D9E40AA7191DB75AF88CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 005C4484 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C44C5

Strings

`|9n, xrefs: 005C44C5
Unknown exception, xrefs: 005C4488, 005C449C
check Update %s Error: %s, xrefs: 005C44A5
stealth_manager, xrefs: 005C44AA

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: Unknown exception$`|9n$check Update %s Error: %s$stealth_manager
API String ID: 2453523683-2793709332
Opcode ID: b93955212dd2733c75dd4e6ef7bd91b583ac2bc8dbdfcb083bce0ba2ec479c2f
Instruction ID: 105551cdbeae2c02dc2707bc37e799bbb417255543df98154cd920122c44b75a
Opcode Fuzzy Hash: b93955212dd2733c75dd4e6ef7bd91b583ac2bc8dbdfcb083bce0ba2ec479c2f
Instruction Fuzzy Hash: 91E0C970600259EBEF24DFA9CC58F997AF8BB44201F4044ABE40AA7342D775DA548E21

Uniqueness

Uniqueness Score: -1.00%

Function 005C515C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C5191

Strings

`|9n, xrefs: 005C5191
Update PocoNet Error: %s, xrefs: 005C5171
Unknown exception, xrefs: 005C5160, 005C5170
stealth_manager, xrefs: 005C5176

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: Unknown exception$Update PocoNet Error: %s$`|9n$stealth_manager
API String ID: 2453523683-2902485909
Opcode ID: 3a44aa8c952d759d6e3499f3694e4788c2a747e05b4f0e0167a2218a4141df60
Instruction ID: fb15adaa422c727054e852aa426f21d63b6b0866c3d015ceb9d6c5771964f85e
Opcode Fuzzy Hash: 3a44aa8c952d759d6e3499f3694e4788c2a747e05b4f0e0167a2218a4141df60
Instruction Fuzzy Hash: 84E0E6206003549FEF61E758CC0DB5D7EE4BB44305F4484DBA40AA7341E6755F449F22

Uniqueness

Uniqueness Score: -1.00%

Function 005C4C22 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C4C57

Strings

`|9n, xrefs: 005C4C57
Update PocoCrypto Error: %s, xrefs: 005C4C37
Unknown exception, xrefs: 005C4C26, 005C4C36
stealth_manager, xrefs: 005C4C3C

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: Unknown exception$Update PocoCrypto Error: %s$`|9n$stealth_manager
API String ID: 2453523683-1206655735
Opcode ID: d2499246c6f8334f7ea4fec9d8c9365a7f4845eade22c7a9f8fd36a18d0b1bec
Instruction ID: 65862bb57d6e49ed1028867fb779bfbf8d09ecffd1344791f72c22dc2865ec59
Opcode Fuzzy Hash: d2499246c6f8334f7ea4fec9d8c9365a7f4845eade22c7a9f8fd36a18d0b1bec
Instruction Fuzzy Hash: 97E0EC60701214ABEB70E7688D5DFAABEF8BB44704F4045EBE409A7381E6749F448E22

Uniqueness

Uniqueness Score: -1.00%

Function 005C4DE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C4E15

Strings

Update PocoFoundation Error: %s, xrefs: 005C4DF5
`|9n, xrefs: 005C4E15
Unknown exception, xrefs: 005C4DE4, 005C4DF4
stealth_manager, xrefs: 005C4DFA

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: Unknown exception$Update PocoFoundation Error: %s$`|9n$stealth_manager
API String ID: 2453523683-816698803
Opcode ID: 3fa9ae4406bc7b4b0388dd92929617aa40060952d11446ad71a45c7d41e50f01
Instruction ID: 220d2f3dd508893910bcfd562a36ae6eb5bb5186b4eff1c6586edf044dc56242
Opcode Fuzzy Hash: 3fa9ae4406bc7b4b0388dd92929617aa40060952d11446ad71a45c7d41e50f01
Instruction Fuzzy Hash: E9E0EC70600218ABDB34A7A88D1DBA97EF8BB44705F4044EBA409A7342E6749E448A32

Uniqueness

Uniqueness Score: -1.00%

Function 005C4F9E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 005B2590: new.LIBCMT ref: 005B25C2

__std_exception_destroy.VCRUNTIME140(?), ref: 005C4FD3

Strings

`|9n, xrefs: 005C4FD3
Update PocoJSON Error: %s, xrefs: 005C4FB3
Unknown exception, xrefs: 005C4FA2, 005C4FB2
stealth_manager, xrefs: 005C4FB8

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: __std_exception_destroy
String ID: Unknown exception$Update PocoJSON Error: %s$`|9n$stealth_manager
API String ID: 2453523683-3756654784
Opcode ID: 619e8b7c38ddcff93ddabbb864cd8ef50f53d4c740aa1c55b97ebb83bdc2226b
Instruction ID: 26397a2448784edcbaca80ccf619633102337c428cbbbb5f5a62e5635301adf7
Opcode Fuzzy Hash: 619e8b7c38ddcff93ddabbb864cd8ef50f53d4c740aa1c55b97ebb83bdc2226b
Instruction Fuzzy Hash: 51E0E620600255EFEB30E7A88C1DF5A7EF4BB44705F4044DBA405A7341E7745E44CA32

Uniqueness

Uniqueness Score: -1.00%

Function 005B6E70 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,3FFFFFFF,?,?,005B6E09,?,?,?,?,005B6D58,?), ref: 005B6E8C
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,3FFFFFFF,?,?,005B6E09,?,?,?,?,005B6D58,?), ref: 005B6EA7
new.LIBCMT ref: 005B6EAE
memmove.VCRUNTIME140(00000000,?,?), ref: 005B6ED6

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xbad_alloc@std@@$memmove
String ID:
API String ID: 2874220160-0
Opcode ID: 621b6846db9c97e2ccdb4af69cf27a1b5ff06bbca6beadf69260c4dda5ad78ca
Instruction ID: 940cbc53da0eafdafce03560033b9f98fb4248e23df25b8fa02023ea06bbd0e6
Opcode Fuzzy Hash: 621b6846db9c97e2ccdb4af69cf27a1b5ff06bbca6beadf69260c4dda5ad78ca
Instruction Fuzzy Hash: C311B1BA901103AFC714DF68C895DABBBACFB44310714463AE805C3250EB35FD14C791

Uniqueness

Uniqueness Score: -1.00%

Function 005CA530 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,00000000,00000104,?,005CA2F6,00000000), ref: 005CA54B
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,00000000,00000104,?,005CA2F6,00000000), ref: 005CA562
new.LIBCMT ref: 005CA569
memmove.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,005D1670,000000FF), ref: 005CA591

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xbad_alloc@std@@$memmove
String ID:
API String ID: 2874220160-0
Opcode ID: 8d681dc09a3e8e9da28f9ff7969e62d47d99ea1ffa33deb2776476749755bb81
Instruction ID: a9f09aed42ee05d816b387f8da345e0872f5f447cf0843d4583bedf186acbe2c
Opcode Fuzzy Hash: 8d681dc09a3e8e9da28f9ff7969e62d47d99ea1ffa33deb2776476749755bb81
Instruction Fuzzy Hash: 7A11D0B2900106AFCB14DFA8D885D6EBFA8FF44354350863EE905C3250EB70EA54CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 005B7840 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B7FE9,?,?,?,?,?,?,?,?,00000000,?,005C7015), ref: 005B7850
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B7FE9,?,?,?,?,?,?,?,?,00000000,?,005C7015), ref: 005B7868
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B7FE9,?,?,?,?,?,?,?,?,00000000,?,005C7015), ref: 005B7875
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B7FE9,?,?,?,?,?,?,?,?,00000000,?,005C7015), ref: 005B7882
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B7FE9,?,?,?,?,?,?,?,?,00000000,?,005C7015), ref: 005B788D

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 3b0f20f06f8e82b33d95c011aa618e5ecbe2f9e62ef6ecf8e8a5198118efacac
Instruction ID: e1cdd327647c9d43502d534d88f762c3c7e7480dbf360653e38cd3de160f99e2
Opcode Fuzzy Hash: 3b0f20f06f8e82b33d95c011aa618e5ecbe2f9e62ef6ecf8e8a5198118efacac
Instruction Fuzzy Hash: 56F0543894500E5FD728ABA4D65C5ACBFA6FBE8341B100027F44BC2255DB21E944D627

Uniqueness

Uniqueness Score: -1.00%

Function 005B62E0 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B5F8C,?), ref: 005B62F0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B5F8C,?), ref: 005B6308
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B5F8C,?), ref: 005B6315
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B5F8C,?), ref: 005B6322
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B5F8C,?), ref: 005B632D

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 35810296ba5365477c3274be0209ab1d35bba49bec75ff26b907ab54ed64d717
Instruction ID: 7a2d7edf42937b84e70c3c34362effb9ee7bd5080131fb54bae3ca78254ec52b
Opcode Fuzzy Hash: 35810296ba5365477c3274be0209ab1d35bba49bec75ff26b907ab54ed64d717
Instruction Fuzzy Hash: F5F054349011068BE7186B68D65C6ACBFA5BB54311B10043BE84BC3115DA25EA989623

Uniqueness

Uniqueness Score: -1.00%

Function 005B6E10 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CB815,?,?,?,?,?,?,?,?,?,00000009,00000000,00000009), ref: 005B6E20
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CB815,?,?,?,?,?,?,?,?,?,00000009,00000000,00000009), ref: 005B6E35
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CB815,?,?,?,?,?,?,?,?,?,00000009,00000000,00000009), ref: 005B6E42
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CB815,?,?,?,?,?,?,?,?,?,00000009,00000000,00000009), ref: 005B6E4F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005CB815,?,?,?,?,?,?,?,?,?,00000009,00000000,00000009), ref: 005B6E5A

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 583e8b7b5d456aa4f7f89082075de1869a61e9041fd6ef4c6c4f67ba32bc1c14
Instruction ID: 005b78ba8a7beab9b0eaea2ce2300f466e061f355db0a71b99eddccb16b3e1ec
Opcode Fuzzy Hash: 583e8b7b5d456aa4f7f89082075de1869a61e9041fd6ef4c6c4f67ba32bc1c14
Instruction Fuzzy Hash: F0F0273C8020094BD7286B74D74C1AEBF6ABB14311B000537F85BC1250DB34F9849733

Uniqueness

Uniqueness Score: -1.00%

Function 005B4710 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4720
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4734
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4741
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B474E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4759

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c78359aafc5e86069cad470a4bb4c3d28c97c6ade648de6a019941aad1585857
Instruction ID: 39c434150c60a0374ecebea8e81e48b682166037b7cfda0b92373345e79622f3
Opcode Fuzzy Hash: c78359aafc5e86069cad470a4bb4c3d28c97c6ade648de6a019941aad1585857
Instruction Fuzzy Hash: D4F082349020054BCB286B74DA5D6ACBFA5FB16311B100527E85BC6256DF20A985D963

Uniqueness

Uniqueness Score: -1.00%

Function 005C9A20 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 283COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005C9A55

Part of subcall function 005CE041: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE068

memset.VCRUNTIME140(00000000,00000000,00000488,00000488,3A04C82C,?,FFFFFFFF,?), ref: 005C9A71
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,3A04C82C,?,FFFFFFFF,?), ref: 005C9B12

Part of subcall function 005BA4B0: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,000000FF,750292F0,?,?,?,005C975E), ref: 005BA4BA
Part of subcall function 005BA4B0: new.LIBCMT ref: 005BA4CB

Part of subcall function 005CC5E0: __RTDynamicCast.VCRUNTIME140(00000000,00000000,84],84],00000000,?,?,?,?,?,005C9B62,00000000,00000000,00000002,?,3A04C82C), ref: 005CC60F
Part of subcall function 005CC5E0: _CxxThrowException.VCRUNTIME140(?,005DCD08,Invalid Argument), ref: 005CC6FE

Strings

w, xrefs: 005C9B0E

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CastDynamicExceptionThrow_stat64i32fopenmallocmemset
String ID: w
API String ID: 3122805426-476252946
Opcode ID: 4a643a080731100fbb2f9a44c499f1ad2bfcbe08a1e17848805e264c2d8025b6
Instruction ID: 0b4d66ad86f548d6d1b7694b6ac09978dcf2aba0bb5541275e1dd29416e7f3bc
Opcode Fuzzy Hash: 4a643a080731100fbb2f9a44c499f1ad2bfcbe08a1e17848805e264c2d8025b6
Instruction Fuzzy Hash: 4AB15D70A002169FDB14DF98C89AFAEBBB5FF88300F14405DF505AB292DBB59D45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005B4490 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D,?,?), ref: 005B4508
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,3A04C82C,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D,?,?), ref: 005B4524
memmove.VCRUNTIME140(?,?,?,3A04C82C,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D,?,?), ref: 005B457E

Part of subcall function 005B45B0: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D), ref: 005B45CA
Part of subcall function 005B45B0: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D), ref: 005B45ED
Part of subcall function 005B45B0: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C,3A04C82D), ref: 005B4608
Part of subcall function 005B45B0: memmove.VCRUNTIME140(?,?,3A04C82D,3A04C82C,00000000,?,?,005B44EF,00000000,?,?,3A04C82D,?,?,005B4F78,3A04C82C), ref: 005B466F

Strings

string too long, xrefs: 005B4503, 005B451F

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@$memmove$Xout_of_range@std@@
String ID: string too long
API String ID: 1879775902-2556327735
Opcode ID: 422992bbc61787a9ea028b535237d347ff5b3c08a567f326ce73b9946d7c48b7
Instruction ID: 472f0e05aec69c3470f624409a40ff9fff5b865c77157885026d47aa6df03960
Opcode Fuzzy Hash: 422992bbc61787a9ea028b535237d347ff5b3c08a567f326ce73b9946d7c48b7
Instruction Fuzzy Hash: 7E31FA32300A109BDB349E5CA880AAAFBE5FF95711710452FE542C7783C771FD548BA1

Uniqueness

Uniqueness Score: -1.00%

Function 005B7730 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,005B7004,?,?,?,?,?,?,00000000,00000000), ref: 005B7744
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,005B7004,?,?,?,?,?,?,00000000,00000000), ref: 005B7754

Strings

string too long, xrefs: 005B773F, 005B774F

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: string too long
API String ID: 1004598685-2556327735
Opcode ID: 0d8db47b69f6cb7ac8bc96ded195c5c1505e15f41fa0c95cc15c4af71cc1dbdd
Instruction ID: e5ec398a0856a5733dfd8ac02a75a37b14db26cd82b595803233def8d971dd79
Opcode Fuzzy Hash: 0d8db47b69f6cb7ac8bc96ded195c5c1505e15f41fa0c95cc15c4af71cc1dbdd
Instruction Fuzzy Hash: 7421FB353087549BC7314F6C94005AABFA9FFE9B21F10095FE49287392CB71A504C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 005B4CD0 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(3A04C82C,0000023A,?,00000000), ref: 005B4D58
new.LIBCMT ref: 005B4D5F
new.LIBCMT ref: 005B4D73
memmove.VCRUNTIME140(00000000,?,0000023A,00000000), ref: 005B4DBF

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xbad_alloc@std@@memmove
String ID:
API String ID: 2663607490-0
Opcode ID: f726180fb73b3c2e020b3fcc307b2f3f9a7ac4c43f01558c4f4abcb5126a3990
Instruction ID: 820e8746f16b077ef32bbedd2240077d096e081002d8ef55afab24ad4b31979c
Opcode Fuzzy Hash: f726180fb73b3c2e020b3fcc307b2f3f9a7ac4c43f01558c4f4abcb5126a3990
Instruction Fuzzy Hash: 7D31A0716006019FDB34CF68D985BAABFE5FB45750F500A2DE8628B782E771B904CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005C94B0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 005C94E2

Part of subcall function 005CE041: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,005B4D78,00000001,3A04C82C,0000023A,?,00000000), ref: 005CE068

memset.VCRUNTIME140(00000000,00000000,00000030,00000030,3A04C82C), ref: 005C94F8
memset.VCRUNTIME140(00000000,00000000,?,?), ref: 005C95AF
memmove.VCRUNTIME140(?,00000000,?,00000000,00000000,?,?), ref: 005C95BB

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: memset$mallocmemmove
String ID:
API String ID: 1346079573-0
Opcode ID: c2927a51bf1761f707c6bf0336c328a96e149970590f99f1adde43337867fd24
Instruction ID: 7240a9df0dfb90e68ce0d69d448cdcdabfe666378553b6b3a30028f41ca82302
Opcode Fuzzy Hash: c2927a51bf1761f707c6bf0336c328a96e149970590f99f1adde43337867fd24
Instruction Fuzzy Hash: 333152B1900605AFDB10DF98C985F9EBFB5FF48360F14826DE918A7782D771A950CB90

Uniqueness

Uniqueness Score: -1.00%

Function 005B7F20 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,00000000,?,005C7015,?,?), ref: 005B7F41
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,00000000,?,005C7015,?,?), ref: 005B7F5B
new.LIBCMT ref: 005B7F62

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xbad_alloc@std@@
String ID:
API String ID: 3815834350-0
Opcode ID: 9c295464ba600f15a3818371b39d5924ad7fea2545082ffc53beddeb1ccee3a3
Instruction ID: 40e394fa9869e609823aae06c95e0ac9cdc3728ea6d986fe2e3725ad82d4d845
Opcode Fuzzy Hash: 9c295464ba600f15a3818371b39d5924ad7fea2545082ffc53beddeb1ccee3a3
Instruction Fuzzy Hash: 0B31E5B29041099BCB18EF68C9858AEBBF9FFC8300714456DE84A97351E730BA55C794

Uniqueness

Uniqueness Score: -1.00%

Function 005CB610 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(00000000,00000009,00000000,?,005CB5D9,00000000,005C862E,00000009), ref: 005CB62B
?_Xbad_alloc@std@@YAXXZ.MSVCP140(00000000,00000009,00000000,?,005CB5D9,00000000,005C862E,00000009), ref: 005CB646
new.LIBCMT ref: 005CB64D

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xbad_alloc@std@@
String ID:
API String ID: 3815834350-0
Opcode ID: 9e1605b7db1c738b9dd35cf26a6478c5ca4962fe832d5e4459176078b6500912
Instruction ID: 4fb2291308d65f653db5d0e33a88268e5bf74235b0471c082e583cc159c2dbe7
Opcode Fuzzy Hash: 9e1605b7db1c738b9dd35cf26a6478c5ca4962fe832d5e4459176078b6500912
Instruction Fuzzy Hash: 631190B2500506AFD714DFA8C887E6ABFA8FF48350B14462EF909C7251E771E9A4CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 005CE98D Relevance: 6.1, APIs: 4, Instructions: 53timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 005CE9C1
GetCurrentThreadId.KERNEL32 ref: 005CE9D0
GetCurrentProcessId.KERNEL32 ref: 005CE9D9
QueryPerformanceCounter.KERNEL32(?), ref: 005CE9E6

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2ca6ee8a6ad06e98a9f0361050e4a60358525af1a97f5d455c07baa24a812072
Instruction ID: 05c2e897000d063104ec34671bc5d9c6d06b37a9b87a88076ce2ed9e6673b0c1
Opcode Fuzzy Hash: 2ca6ee8a6ad06e98a9f0361050e4a60358525af1a97f5d455c07baa24a812072
Instruction Fuzzy Hash: 1B114C71D02208DFCB24DBE8D94ABAEBBF4FB18341F51446BD402E7250DB70AA04DB51

Uniqueness

Uniqueness Score: -1.00%

Function 005CB6C0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,005CB7A7,00000009,00000000,00000009,00000000,00000009), ref: 005CB6D9
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,005CB7A7,00000009,00000000,00000009,00000000,00000009), ref: 005CB6F0
new.LIBCMT ref: 005CB6F7

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xbad_alloc@std@@
String ID:
API String ID: 3815834350-0
Opcode ID: 442cd18056cddcea00bbd9e9d0a135b5185e4150e8819701f5d4a45114befc21
Instruction ID: b757a9c4373bd3d012964db1838c7ffaed928b465d3ce662c98d006a4423348e
Opcode Fuzzy Hash: 442cd18056cddcea00bbd9e9d0a135b5185e4150e8819701f5d4a45114befc21
Instruction Fuzzy Hash: 37F0AEB25041000FA718D7F4E857E1E7B94E764360B04013FF41AC6191F725DDD4D655

Uniqueness

Uniqueness Score: -1.00%

Function 005B4770 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4783
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B4790
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B479D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 005B47A8

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 87a96d3cffd786e0f3d7310a07c2b40d6edf459f19347744c0aa07bbba3a04a7
Instruction ID: afdfee7a0622a30fdb43a3fb4e09825516808d18af07e94a5b052b45af7fdd41
Opcode Fuzzy Hash: 87a96d3cffd786e0f3d7310a07c2b40d6edf459f19347744c0aa07bbba3a04a7
Instruction Fuzzy Hash: 4EE092749421055FD724ABA4EA4D5ACBFB9FB22301B004026E54AC5216DF70F955DE73

Uniqueness

Uniqueness Score: -1.00%

Function 005CB720 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(vector<T> too long,00000000,00000009,00000000,00000009), ref: 005CB76F
memmove.VCRUNTIME140(?,00000000,?,?,00000000,00000000,00000000,00000000,00000009,00000000,00000009), ref: 005CB8A7

Strings

vector<T> too long, xrefs: 005CB76A

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@memmove
String ID: vector<T> too long
API String ID: 1146228739-3788999226
Opcode ID: 63274946aaefa7f507812794cf8ca43bab4de0557aed18428c67cf6397ffbb02
Instruction ID: f8a1dc6de3ad69b0a1afe961ab66d7362b02b71995c170b64bff0d91fdbf7c60
Opcode Fuzzy Hash: 63274946aaefa7f507812794cf8ca43bab4de0557aed18428c67cf6397ffbb02
Instruction Fuzzy Hash: 44515171A0011A9FCF14DF68CD85DAA7BA9FF84310B088669FC19DB349E770EA14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 005CA7B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,3A04C82C,?,00000104,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005CA886
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z.MSVCP140(00000001,3A04C82C,?,00000104,00000104), ref: 005CA8A6

Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4720
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4734
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4741
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B474E
Part of subcall function 005B4710: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,005B4B9C,?,?,750292F0,?,750292F0), ref: 005B4759

Strings

string too long, xrefs: 005CA881

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Init@locale@std@@Locimp@12@_Xlength_error@std@@
String ID: string too long
API String ID: 1093751468-2556327735
Opcode ID: 9a42b89808fbe16853654be38e37ac706b0f7a88952434877951201e7f1916d9
Instruction ID: b178db8511707071c215c1d6c00cbaa6bf07db36dda779f6ec3a87d94a3c62f9
Opcode Fuzzy Hash: 9a42b89808fbe16853654be38e37ac706b0f7a88952434877951201e7f1916d9
Instruction Fuzzy Hash: 91513870A00249DFDB14CFA8C849BEEBFF4FF48308F144069E406AB251DB74AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005B4270 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B42E3
memmove.VCRUNTIME140(?,00000000,0000023A,?,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B4337

Part of subcall function 005B4370: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B438A
Part of subcall function 005B4370: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,005B42CF,?,00000000,0000023A,?,?,?,005B10A4,Pacific/Marquesas,00000011), ref: 005B43AB

Strings

string too long, xrefs: 005B42DE

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xout_of_range@std@@$Xlength_error@std@@memmove
String ID: string too long
API String ID: 3597620626-2556327735
Opcode ID: 6a1ff004e906b1912d2d18b7c649b94ce90249b5a415a7c6da5ec625f8e55865
Instruction ID: e05fea5cabb49a8dc33ac90506287da00771fc7e515ec0efa6715a02c38887fd
Opcode Fuzzy Hash: 6a1ff004e906b1912d2d18b7c649b94ce90249b5a415a7c6da5ec625f8e55865
Instruction Fuzzy Hash: DB31E9363006109BD7309E9CA8809AAFFE9FF95721F24092FF59187743C771AC849BA1

Uniqueness

Uniqueness Score: -1.00%

Function 005B40E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000058,00000040,00000000,?,005BCC26,SOFTWARE\Classes\CLSID\,00000017), ref: 005B4147
memmove.VCRUNTIME140(?,00000017,00000000,00000058,00000040,00000000,?,005BCC26,SOFTWARE\Classes\CLSID\,00000017), ref: 005B41A2

Strings

string too long, xrefs: 005B4142

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@memmove
String ID: string too long
API String ID: 1146228739-2556327735
Opcode ID: 3b327dcc0d26eb612799f34095e3e549f419cca2f8691253620865fef49335cb
Instruction ID: d7b5582614fbd06c381559380886f03a823eaab5e36f59fcf2112b0b4486029d
Opcode Fuzzy Hash: 3b327dcc0d26eb612799f34095e3e549f419cca2f8691253620865fef49335cb
Instruction Fuzzy Hash: 4D31A6327047119B8B349E5CE8808AAFBF9FFA5751320092FE146C7612D721B984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 005B6140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,00000000,00000058,00000040,?,005BCC77,\MiscStatus\1,0000000D,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\,00000017), ref: 005B61AD
memmove.VCRUNTIME140(?,00000017,00000000,?,?,00000000,00000058,00000040,?,005BCC77,\MiscStatus\1,0000000D,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}), ref: 005B61E3

Strings

string too long, xrefs: 005B61A8

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@memmove
String ID: string too long
API String ID: 1146228739-2556327735
Opcode ID: a55e4d6181f07233775e8e2d9e18729562aaca3c22b2ec24fcd7c2a37f3efc71
Instruction ID: 5c507c017912d8009352d6290355cdd3719d2859a53c34206a4c000edbdd13b4
Opcode Fuzzy Hash: a55e4d6181f07233775e8e2d9e18729562aaca3c22b2ec24fcd7c2a37f3efc71
Instruction Fuzzy Hash: 0331CE353006149B9B28CE9DEC848AAFBFAFFC5751320452EE446CB202DB34F956C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 005B7470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,005B7104,?,?,?,?,?,?,00000000,00000000), ref: 005B7484
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,005B7104,?,?,?,?,?,?,00000000,00000000), ref: 005B7497

Strings

string too long, xrefs: 005B747F, 005B7492

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: string too long
API String ID: 1004598685-2556327735
Opcode ID: e49ecd172e98c44dfc85f6ad2ec0223159007087c7063eb780fc3c2f77a4e3e2
Instruction ID: 4c343db179d2690a06ddc706ec26f5b3e4d403a6ada327e5a6f5a0323608ec12
Opcode Fuzzy Hash: e49ecd172e98c44dfc85f6ad2ec0223159007087c7063eb780fc3c2f77a4e3e2
Instruction Fuzzy Hash: A221B2317187189BCB345F68B8804A9FFE5FF9C7223104A2FE556C7790D632A914C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 005BD350 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(00000040,00000104,3A04C82C), ref: 005BD3A5

Strings

\system32, xrefs: 005BD42C
\sysnative, xrefs: 005BD423

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: DirectoryWindows
String ID: \sysnative$\system32
API String ID: 3619848164-3725051112
Opcode ID: 883e04514f2e5f29d6e2a009a0554d931ae12a1298df18cbde499f2323b2f46a
Instruction ID: c235629a800b88d6ec33a323ad7ecde392a8c5d909537fd6f2f4ef5561b0018e
Opcode Fuzzy Hash: 883e04514f2e5f29d6e2a009a0554d931ae12a1298df18cbde499f2323b2f46a
Instruction Fuzzy Hash: 09218D70A046589FDB28CF18D80ABEABFF4FB05714F004A9EE54657681D7B46A488FE1

Uniqueness

Uniqueness Score: -1.00%

Function 005B4C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,00000000,?,?,005B486F,00000000,?,00000058,?,00000017,?,005B4130,?,00000017,?,00000040), ref: 005B4C36

Strings

invalid string position, xrefs: 005B4C31

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position
API String ID: 1960685668-1799206989
Opcode ID: aaabfa1f19aae09b526972f24d93823f3087f8ed957bfe58c45736e57ceabfc1
Instruction ID: 802df38ca08a0d7ce05d11ba252a8784e5b35745621b8ecda3333b90beacc243
Opcode Fuzzy Hash: aaabfa1f19aae09b526972f24d93823f3087f8ed957bfe58c45736e57ceabfc1
Instruction Fuzzy Hash: B01193323152149B87349F6DE84489ABBE9FFE4B11301853FE586C7622DB70ED18CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005B4930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,005D3638,005D3638,?,005B5038,005D3638,00000001,3A04C82C,00000001,0000001C), ref: 005B4944
memmove.VCRUNTIME140(005D3638,54205547,20505554,20505554,005D3638,005D3638,?,005B5038,005D3638,00000001,3A04C82C), ref: 005B498A

Strings

string too long, xrefs: 005B493F

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xlength_error@std@@memmove
String ID: string too long
API String ID: 1146228739-2556327735
Opcode ID: 6361152c2bfb3bd8453925a3bca64f8e6695c2f089a0f60c59a8a7553e5f3435
Instruction ID: d9fdf21b84d6ec753d5c9517e01c9d20a1b42538ab580cf37c488440546a08e8
Opcode Fuzzy Hash: 6361152c2bfb3bd8453925a3bca64f8e6695c2f089a0f60c59a8a7553e5f3435
Instruction Fuzzy Hash: 7B11B4361007115BDB319E5CE4856ABBBA6FB91320F044A2EE9D547683C730A844CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 005B49E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,005B43E3,00000000,0000023A,?,?,00000000,?,005B42CF,?,00000000,0000023A), ref: 005B49F6

Strings

invalid string position, xrefs: 005B49F1

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position
API String ID: 1960685668-1799206989
Opcode ID: 835ee59865244a4f4e7c2b3bf59d95c778cc30d0501e38d1d484688d70fac7f7
Instruction ID: 41d5f080462b8fea06e937d4fdda9b6db930e8254a3df335bfcfcdfa870ccaef
Opcode Fuzzy Hash: 835ee59865244a4f4e7c2b3bf59d95c778cc30d0501e38d1d484688d70fac7f7
Instruction Fuzzy Hash: 9411B2323402518FD7309E5CE840A86FBEAFBA5711F14453FE581CB252D7B1E904CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 005CE02B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005CE316
___raise_securityfailure.LIBCMT ref: 005CE3FD

Strings

8], xrefs: 005CE3F8

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8]
API String ID: 3761405300-1406931365
Opcode ID: 993ac94681653d103ec7995447c9546071c1b8cd58e5b621af9d3d8811bcebff
Instruction ID: ca4949504b2674e4478278dc5b1e2e799976e67ac56083abf631628d90dc2146
Opcode Fuzzy Hash: 993ac94681653d103ec7995447c9546071c1b8cd58e5b621af9d3d8811bcebff
Instruction Fuzzy Hash: CF21E6B45422009EE730EF55F9877183BE4BB28398F14555BE5088F3A0F3B06948EF46

Uniqueness

Uniqueness Score: -1.00%

Function 005CD8E0 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_CxxThrowException.VCRUNTIME140(?,005DCD18,00000000), ref: 005CD99B
_CxxThrowException.VCRUNTIME140(005D9344,005DCD18,?,005DCD18,00000000), ref: 005CD9B0

Memory Dump Source

Source File: 00000004.00000002.2192293716.00000000005B1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 005B0000, based on PE: true

Associated: 00000004.00000002.2192243595.00000000005B0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192337315.00000000005D3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192363516.00000000005DE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2192382739.00000000005E1000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5b0000_post_install.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: 11c28b86e41a75c44a859631636a52948b5291dd2cf57fa8ce2e66d03351a3bf
Instruction ID: 907c56afbba7faebc4fe725136d5c6a2d787fd7ae720007b2603bae45b257e71
Opcode Fuzzy Hash: 11c28b86e41a75c44a859631636a52948b5291dd2cf57fa8ce2e66d03351a3bf
Instruction Fuzzy Hash: 5431B6719042096BCB14EFA8CD49FEEBFE8BF49314F14952EF904A2241DBB0A944C6A4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svcAppUpdate.exePID: 4332, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.1%
Total number of Nodes:	1381
Total number of Limit Nodes:	5

Executed Functions

Function 006A2E40 Relevance: 6.1, APIs: 4, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.VCRUNTIME140(?,00000000,00000088,DD4A9CAB), ref: 006A2E94

Part of subcall function 006AA140: GetCurrentProcess.KERNEL32(?,?,?,?), ref: 006AA23C
Part of subcall function 006AA140: IsWow64Process.KERNEL32(00000000,?,?,?,?), ref: 006AA243

wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000100,?,0000000E,0000000E), ref: 006A2F14
StartServiceCtrlDispatcherW.ADVAPI32(?), ref: 006A2F4E
GetLastError.KERNEL32 ref: 006A2F58

Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AB3
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AC0
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2ACD
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AD8

Part of subcall function 006A2A40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A50
Part of subcall function 006A2A40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A64
Part of subcall function 006A2A40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A71
Part of subcall function 006A2A40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A7E
Part of subcall function 006A2A40: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A89

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process$CtrlCurrentDispatcherErrorLastServiceStartWow64memsetwcscpy_s
String ID:
API String ID: 2974385897-0
Opcode ID: 2baa2f4532972f0b741c6f7df44f70978ef3d42679b1d85a1380b0f8e9a1cd6a
Instruction ID: 4892238321049bdca4c992d76a11652992b3668ca43b6fa91d72194e2fddea0a
Opcode Fuzzy Hash: 2baa2f4532972f0b741c6f7df44f70978ef3d42679b1d85a1380b0f8e9a1cd6a
Instruction Fuzzy Hash: 4F418C70941119AFDB60EFA4DD59BDEB7B9EF09300F2041E9E409A2290EB349F84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006A1BC0 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 256
registrysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMT ref: 006A1C05

Part of subcall function 006AD23C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006A1B67,0000001C,DD4A9CAB,?,?,?,006AE36F,000000FF,?,006A212F,ws_update_service,%s enter {,ServiceWorkerThread,DD4A9CAB), ref: 006AD263

Part of subcall function 006A3200: GetFileAttributesA.KERNELBASE(0000001C,.txt,00000004,000000FF,00000100,?,006AE5A3,DD4A9CAB), ref: 006A333E
Part of subcall function 006A3200: _mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(0000001C,?,?,?,?,?,?,?,?,?,?,?,?,00000000,006AE5A3,000000FF), ref: 006A3356
Part of subcall function 006A3200: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,006AE5A3,000000FF,?,006A1C45,?), ref: 006A3363

new.LIBCMT ref: 006A1C56

Part of subcall function 006AD23C: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006A1B67,0000001C,DD4A9CAB,?,?,?,006AE36F,000000FF,?,006A212F,ws_update_service,%s enter {,ServiceWorkerThread,DD4A9CAB), ref: 006AD244

Part of subcall function 006A4D80: new.LIBCMT ref: 006A4DDD
Part of subcall function 006A4D80: InitializeCriticalSection.KERNEL32(00000004), ref: 006A4DF4

memset.VCRUNTIME140(?,00000000,00000088,ws_update_service,ServiceMain: service started), ref: 006A1CB3
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000064,?,?,0000000E,ServiceMain: service started), ref: 006A1D4F
RegisterServiceCtrlHandlerW.ADVAPI32(?,006A2060), ref: 006A1D64
SetServiceStatus.SECHOST(00000000,006B4768), ref: 006A1E6C
GetLastError.KERNEL32 ref: 006A1E78
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 006A1E95
GetLastError.KERNEL32 ref: 006A1EB3
SetServiceStatus.ADVAPI32(006B4768), ref: 006A1ECF
GetLastError.KERNEL32 ref: 006A1ED9
SetServiceStatus.ADVAPI32(006B4768), ref: 006A1F26
GetLastError.KERNEL32 ref: 006A1F2C
CloseHandle.KERNEL32 ref: 006A1F47
CreateThread.KERNELBASE(00000000,00000000,Function_000020F0,00000000,00000000,00000000), ref: 006A1F6C
CloseHandle.KERNEL32 ref: 006A1F8E
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 006A1FA7
FindCloseChangeNotification.KERNELBASE ref: 006A1FB3
SetServiceStatus.ADVAPI32(006B4768), ref: 006A1FEC
GetLastError.KERNEL32 ref: 006A1FF2

Part of subcall function 006A1AA0: new.LIBCMT ref: 006A1AD2

Strings

ServiceMain: Can't create thread, xrefs: 006A1F76
ServiceMain: SetServiceStatus "stopped" returned error [%d], xrefs: 006A1EDC
ServiceMain: SetServiceStatus to "start pending" returned error [%d], xrefs: 006A1E7B
ServiceMain: SetServiceStatus to "stopped" returned error [%d], xrefs: 006A1FF5
ws_update_service, xrefs: 006A1C97, 006A1E80, 006A1EE1, 006A1F34, 006A1F7B, 006A1FFA
ServiceMain: SetServiceStatus to "running" returned error [%d], xrefs: 006A1F2F
ServiceMain: service started, xrefs: 006A1C92

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: ErrorLastService$Status$Close$CreateHandle$AttributesChangeCriticalCtrlEventFileFindHandlerInitializeNotificationObjectRegisterSectionSingleThreadWait_callnewh_errno_mkdirmallocmemsetwcscpy_s
String ID: ServiceMain: Can't create thread$ServiceMain: SetServiceStatus "stopped" returned error [%d]$ServiceMain: SetServiceStatus to "running" returned error [%d]$ServiceMain: SetServiceStatus to "start pending" returned error [%d]$ServiceMain: SetServiceStatus to "stopped" returned error [%d]$ServiceMain: service started$ws_update_service
API String ID: 138789579-4288471160
Opcode ID: cc4110207d4262d14f64a17312d1de8034882adbec3c662c628203102463a1a5
Instruction ID: 1f65b16308341eb4cf80581723d187228d895e179e85a495c59705368018020b
Opcode Fuzzy Hash: cc4110207d4262d14f64a17312d1de8034882adbec3c662c628203102463a1a5
Instruction Fuzzy Hash: 8BB1BEB0A403159FEB60FF64DD15BAA7BB7EB53304F1012A8E509A6292DFB05E84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 006A3530 Relevance: 33.6, APIs: 13, Strings: 6, Instructions: 386
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,DD4A9CAB,?,?,?,?,006AE628,000000FF), ref: 006A3614
GetFileAttributesA.KERNEL32(00000000,00000000,00000000,000000FF,?,00000000,000000FF), ref: 006A36DE
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,006B0880,006B036C), ref: 006A3728
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,00000000), ref: 006A378C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 006A3793
_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?,?,?,?,?,?,000000FF), ref: 006A3802
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,006B0880,?,?,?,?,?,000000FF), ref: 006A3960
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 006A3981
_wsplitpath_s.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,00000000,00000000,00000000,00000000,?,00000104,?,00000100), ref: 006A39AE
wcscat_s.API-MS-WIN-CRT-STRING-L1-1-0(?,00000105,?), ref: 006A39C7
GetCurrentProcessId.KERNEL32(DEBUG,?), ref: 006A3A3E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,00000000,?,?,?,?,?,?,?,?,?), ref: 006A3AA4
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,?), ref: 006A3AAB

Strings

windows_hook_helper, xrefs: 006A35B3
%s %s [%d] <%s> [%s]: %s, xrefs: 006A3A47
%s Continue on next file -->, xrefs: 006A374B
windows_hook_manager, xrefs: 006A3567
DEBUG, xrefs: 006A3A35, 006A3A3D
ERROR, xrefs: 006A3A2A

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: File_stat64i32fclosefopenfwrite$AttributesCurrentModuleNameProcess_wsplitpath_swcscat_s
String ID: %s Continue on next file -->$%s %s [%d] <%s> [%s]: %s$DEBUG$ERROR$windows_hook_helper$windows_hook_manager
API String ID: 3352214153-4226532283
Opcode ID: 49b5fb01723fecc6a9d78df871bf1f52e57bdbb7297fd700cb36f4ed052770f8
Instruction ID: 3ddf64cd3f89a44ee4b21c76bf663f8e312a45e6afca82d7f55ee17158804364
Opcode Fuzzy Hash: 49b5fb01723fecc6a9d78df871bf1f52e57bdbb7297fd700cb36f4ed052770f8
Instruction Fuzzy Hash: 06F192709042289BDF64EF54DC95BEAB7BAAF16300F4401DAF50A67282DB719F84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 006A2200 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 81
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4b,DD4A9CAB,?,?,?,006AE456,000000FF), ref: 006A223D
new.LIBCMT ref: 006A224F

Part of subcall function 006AD23C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006A1B67,0000001C,DD4A9CAB,?,?,?,006AE36F,000000FF,?,006A212F,ws_update_service,%s enter {,ServiceWorkerThread,DD4A9CAB), ref: 006AD263

new.LIBCMT ref: 006A226F

Part of subcall function 006AD23C: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006A1B67,0000001C,DD4A9CAB,?,?,?,006AE36F,000000FF,?,006A212F,ws_update_service,%s enter {,ServiceWorkerThread,DD4A9CAB), ref: 006AD244

memset.VCRUNTIME140(00000000,00000000,00000038,?,?,006AE456,000000FF), ref: 006A2285

Part of subcall function 006A6010: new.LIBCMT ref: 006A606A
Part of subcall function 006A6010: InitializeCriticalSection.KERNEL32(00000004), ref: 006A6081
Part of subcall function 006A6010: new.LIBCMT ref: 006A608C
Part of subcall function 006A6010: InitializeConditionVariable.KERNEL32(00000004), ref: 006A60A3
Part of subcall function 006A6010: new.LIBCMT ref: 006A60AE
Part of subcall function 006A6010: new.LIBCMT ref: 006A60DC
Part of subcall function 006A6010: new.LIBCMT ref: 006A6107
Part of subcall function 006A6010: new.LIBCMT ref: 006A6135

WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000038,?,?,006AE456,000000FF), ref: 006A22B9
CloseHandle.KERNEL32(00000000,?,00000038,?,?,006AE456,000000FF), ref: 006A22C0

Strings

Exit update service, xrefs: 006A22CF
ws_update_service, xrefs: 006A22D4
Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4b, xrefs: 006A222B

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Initialize$CloseConditionCreateCriticalEventHandleObjectSectionSingleVariableWait_callnewhmallocmemset
String ID: Exit update service$Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4b$ws_update_service
API String ID: 2975680148-3142918566
Opcode ID: 8bc2c88faf0e97585bb64049316fd43eb929020d8e7117a20e52132fd632d206
Instruction ID: 774084dc9a413cb9f2d9ed14b1302b2553df7ed251f5e69c6800134cd4991bd9
Opcode Fuzzy Hash: 8bc2c88faf0e97585bb64049316fd43eb929020d8e7117a20e52132fd632d206
Instruction Fuzzy Hash: 6821B471A40344ABE710ABA4CC46B9EBFE5EF86B10F10426DF5059B3C1DBB15D448BA2

Uniqueness

Uniqueness Score: -1.00%

Function 006A3200 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(0000001C,.txt,00000004,000000FF,00000100,?,006AE5A3,DD4A9CAB), ref: 006A333E
_mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(0000001C,?,?,?,?,?,?,?,?,?,?,?,?,00000000,006AE5A3,000000FF), ref: 006A3356
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,006AE5A3,000000FF,?,006A1C45,?), ref: 006A3363
GetFileAttributesA.KERNELBASE(0000001C,.txt,00000004,000000FF,00000100,?,006AE5A3,DD4A9CAB), ref: 006A3382
GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,000000FF,0000001C,00000000,000000FF,.txt,00000004,000000FF,00000100,?,006AE5A3,DD4A9CAB), ref: 006A341F
_mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,006AE5A3,000000FF), ref: 006A343A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,006AE5A3,000000FF), ref: 006A3447

Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AB3
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AC0
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2ACD
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AD8

Strings

.txt, xrefs: 006A3318

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AttributesFile$_errno_mkdir
String ID: .txt
API String ID: 231429698-2195685702
Opcode ID: 6ab3bef86531c2a6254831af3f706f2cbb20799a112ce008a503299e29521ccc
Instruction ID: ebc2227fba2ca815ce1624c2fc0aedb29681500ea2af47faf077032bea9b469e
Opcode Fuzzy Hash: 6ab3bef86531c2a6254831af3f706f2cbb20799a112ce008a503299e29521ccc
Instruction Fuzzy Hash: 6BA18C70904254DFEF14EF68C844BAEBBB6EF06310F540559E452AB392CB71AE85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 006AA140 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006A89F0: new.LIBCMT ref: 006A89F2

GetCurrentProcess.KERNEL32(?,?,?,?), ref: 006AA23C
IsWow64Process.KERNEL32(00000000,?,?,?,?), ref: 006AA243
new.LIBCMT ref: 006AA2D9

Part of subcall function 006A29D0: memmove.VCRUNTIME140(00000001,006A34BC,458BFFFE,00000001,00000000,?,006A34BC,00000000,006B036C,00000001), ref: 006A29EB

Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AB3
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AC0
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2ACD
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AD8

Strings

\MiscStatus\1, xrefs: 006AA2BF, 006AA2CD
{d07606c8-6532-4d75-a46d-f5f5ac6ef74a}, xrefs: 006AA28C, 006AA29F
Data, xrefs: 006AA30B
SOFTWARE\Classes\CLSID\, xrefs: 006AA269

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process$CurrentWow64memmove
String ID: Data$SOFTWARE\Classes\CLSID\$\MiscStatus\1${d07606c8-6532-4d75-a46d-f5f5ac6ef74a}
API String ID: 1129509905-531586979
Opcode ID: 8d1724d1b23b6712b356b1c2773503dbf69277b3e3546c9df31c1990d568a532
Instruction ID: 0d7748faaa62a1b25a7538e2aa055708063d4b1dd89fd4f925171893741e5e22
Opcode Fuzzy Hash: 8d1724d1b23b6712b356b1c2773503dbf69277b3e3546c9df31c1990d568a532
Instruction Fuzzy Hash: 94C18070A04204DFEB14EFA8D844BAEBBB6FF06304F10455EE4129B292C7B59D45CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 006A2060 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006A1B30: new.LIBCMT ref: 006A1B62

SetServiceStatus.ADVAPI32(006B4768), ref: 006A20BC
GetLastError.KERNEL32 ref: 006A20C6

Part of subcall function 006A1AA0: new.LIBCMT ref: 006A1AD2

SetEvent.KERNEL32 ref: 006A20E5

Strings

ServiceCtrlHandler : CtrlCode = 0x%x, xrefs: 006A2068
ws_update_service, xrefs: 006A206D, 006A20D2
ServiceCtrlHandler: SetServiceStatus returned error [%d], xrefs: 006A20CD

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: ErrorEventLastServiceStatus
String ID: ServiceCtrlHandler : CtrlCode = 0x%x$ServiceCtrlHandler: SetServiceStatus returned error [%d]$ws_update_service
API String ID: 1851023558-1142061411
Opcode ID: a0c296a956e5463bc5d5b079233acfe2558189303fe4769cd6b8d5891a06ef79
Instruction ID: 66a6c2bc099c6856c0f3eead5d99b1f925a3f5c0a0a62f31c0f84b37cdf8a4ec
Opcode Fuzzy Hash: a0c296a956e5463bc5d5b079233acfe2558189303fe4769cd6b8d5891a06ef79
Instruction Fuzzy Hash: 42F0A9F6580310ABE7203BA4AE19B873EA7EB53754F015220F60511262DFB108C4CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 006A20F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006A1B30: new.LIBCMT ref: 006A1B62

WaitForSingleObject.KERNEL32(00000000), ref: 006A213A

Part of subcall function 006A2200: CreateEventW.KERNEL32(00000000,00000001,00000000,Global\Exit_7a176276-e800-4daa-b5e8-7febbd3efc4b,DD4A9CAB,?,?,?,006AE456,000000FF), ref: 006A223D
Part of subcall function 006A2200: new.LIBCMT ref: 006A224F
Part of subcall function 006A2200: new.LIBCMT ref: 006A226F
Part of subcall function 006A2200: memset.VCRUNTIME140(00000000,00000000,00000038,?,?,006AE456,000000FF), ref: 006A2285
Part of subcall function 006A2200: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000038,?,?,006AE456,000000FF), ref: 006A22B9
Part of subcall function 006A2200: CloseHandle.KERNEL32(00000000,?,00000038,?,?,006AE456,000000FF), ref: 006A22C0

Strings

%s enter {, xrefs: 006A2120
%s exit }, xrefs: 006A215C
ServiceWorkerThread, xrefs: 006A211B, 006A2157
ws_update_service, xrefs: 006A2125, 006A2161

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: ObjectSingleWait$CloseCreateEventHandlememset
String ID: %s enter {$%s exit }$ServiceWorkerThread$ws_update_service
API String ID: 2403714371-878017133
Opcode ID: 9d3702215f206935332d70bad10446b5b5f82689b633d830d2fe784b793a3115
Instruction ID: 8ec7a6889eea3eba9124aea344ce83e5b7a50207767172a0969d54e7539f559f
Opcode Fuzzy Hash: 9d3702215f206935332d70bad10446b5b5f82689b633d830d2fe784b793a3115
Instruction Fuzzy Hash: 31012BF6A84304BBD350BB58DD03F8BBFAAE746B60F010329F515926C1EA7119108F60

Uniqueness

Uniqueness Score: -1.00%

Function 006A9AE0 Relevance: 6.0, APIs: 4, Instructions: 41
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadId.KERNEL32(?), ref: 006A9B02
GetCurrentThreadId.KERNEL32 ref: 006A9B0A
CloseHandle.KERNEL32(?), ref: 006A9B18
CreateThread.KERNELBASE(00000000,00000000,Function_00009C10,?,00000000,?), ref: 006A9B3C

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Thread$CloseCreateCurrentHandle
String ID:
API String ID: 2527425298-0
Opcode ID: a666ae15956a8ab2d5fec6c9f47182acf6967eb9a66a862ca5ff876c74e3c1ef
Instruction ID: 961016d2980f8573f18ac72ae5c9b412360234a4e802a519c1b2f6b7daa7bdd7
Opcode Fuzzy Hash: a666ae15956a8ab2d5fec6c9f47182acf6967eb9a66a862ca5ff876c74e3c1ef
Instruction Fuzzy Hash: 8F014F74600208AFD710EF65EC49B5AFBE9FF49711F204269E909D7240DB70A990CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006A22F3 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006A1AA0: new.LIBCMT ref: 006A1AD2

_CxxThrowException.VCRUNTIME140(00000000,00000000), ref: 006A2312

Strings

ws_update_service, xrefs: 006A2301
Error loading information %s, xrefs: 006A22FC

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: ExceptionThrow
String ID: Error loading information %s$ws_update_service
API String ID: 432778473-4076271563
Opcode ID: 453d2bd84b5a63aa8211eb92e528176546206b246c7b761d69187fda21f23f63
Instruction ID: 31119c292b7078cb1b2b1a3bb4f96e4f4446bafe6b4557d7aae163af4c03fa85
Opcode Fuzzy Hash: 453d2bd84b5a63aa8211eb92e528176546206b246c7b761d69187fda21f23f63
Instruction Fuzzy Hash: DD01B5B5A44204AFE710EF58C815F9ABBEAEF0AB10F10416DF915977C1DBB56D008B94

Uniqueness

Uniqueness Score: -1.00%

Function 006A1B30 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMT ref: 006A1B62

Part of subcall function 006AD23C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006A1B67,0000001C,DD4A9CAB,?,?,?,006AE36F,000000FF,?,006A212F,ws_update_service,%s enter {,ServiceWorkerThread,DD4A9CAB), ref: 006AD263

Part of subcall function 006A4D80: new.LIBCMT ref: 006A4DDD
Part of subcall function 006A4D80: InitializeCriticalSection.KERNEL32(00000004), ref: 006A4DF4

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: CriticalInitializeSectionmalloc
String ID:
API String ID: 4141300597-0
Opcode ID: d24aceaa50ec36213ee5d6b0e75caf0b58a96a78b76ca395bbfe08c448e6f74e
Instruction ID: ea9ccc4234003d4ab0f673a416c638f0cc39c6221e5ff44a5fd7b2e679059fbf
Opcode Fuzzy Hash: d24aceaa50ec36213ee5d6b0e75caf0b58a96a78b76ca395bbfe08c448e6f74e
Instruction Fuzzy Hash: 641184B1A10649AFDB04EF55CD01BAA77E9FB46710F10436AE81597390FBB0ED40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 006AAAC0 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000002A,00000000,?), ref: 006AAAF3

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: FolderPathSpecial
String ID:
API String ID: 994120019-0
Opcode ID: 37b9be6b38899aa05e2b484e053a9dc086584c7df2b3246d7c91c7a57373e2fa
Instruction ID: 3eaab6950b2ea99f456a5b4441242679fafa6c9cc0ce94b0345e1f7b148d78d5
Opcode Fuzzy Hash: 37b9be6b38899aa05e2b484e053a9dc086584c7df2b3246d7c91c7a57373e2fa
Instruction Fuzzy Hash: 4C01D470A042189BDB24EF24CC157FABBB6AB06304F0002DED58657381DBB55EC9CF91

Uniqueness

Uniqueness Score: -1.00%

Function 006A4F80 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00002710,?,00000000,?), ref: 006A4FC2

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: __stdio_common_vsprintf
String ID:
API String ID: 9700413-0
Opcode ID: 3cae84d183857a3bb6afce12c1f7507bb00247dfafae94f02a6f52a10e996ba4
Instruction ID: a3a08c40c10daf5fdf3a4450ff879bce827f349078d27d1aee265786d9dc6f60
Opcode Fuzzy Hash: 3cae84d183857a3bb6afce12c1f7507bb00247dfafae94f02a6f52a10e996ba4
Instruction Fuzzy Hash: C101A471600208AFDB04EF58DC99EAF77BAEF89310F004099F90997241CB71AE60DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006A9A70 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 006A9A91

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c91e600038048cfc8a51a875021ca60d7ca736ab877104e6bc5c5989afc84154
Instruction ID: 71afca75e0383bd1a4a05ac8199a80fdd896006ecad9f23dcde6ba4e0b75b743
Opcode Fuzzy Hash: c91e600038048cfc8a51a875021ca60d7ca736ab877104e6bc5c5989afc84154
Instruction Fuzzy Hash: 51F0A4705003095BD724FF54D9557AABFE6EF06300F10445DEE8697341DB71AD84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006A9880 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,006A38C8), ref: 006A9881

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bdb9e38e0ae27caadb66b2360009cbde2139d3eacd24fe323ce07644fddbd80e
Instruction ID: a41fb3102c7f2638a7dba00368ded52b22ea1f4ed65595d537452d41c0475b1c
Opcode Fuzzy Hash: bdb9e38e0ae27caadb66b2360009cbde2139d3eacd24fe323ce07644fddbd80e
Instruction Fuzzy Hash: 34B0926440160005AE282AB85A086DA2B1359873E5BE82F91D4748A3E1CA3D9C4BE921

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 006AB670 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 194serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 006A1B30: new.LIBCMT ref: 006A1B62

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,DD4A9CAB,00000000,00000000), ref: 006AB6BF
_CxxThrowException.VCRUNTIME140(?,006B3210,?,Error on service control manager), ref: 006AB717
GetLastError.KERNEL32 ref: 006AB6CB

Part of subcall function 006A1AA0: new.LIBCMT ref: 006A1AD2

CreateServiceA.ADVAPI32(00000000,?,?,C0000012,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 006AB7E3
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000005,?,00000004,?,00000003), ref: 006AB7EF
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000005,?,00000004,?,00000003), ref: 006AB7F8
ChangeServiceConfig2W.ADVAPI32(00000000,00000002,00000004,?,?,?,?,?,?,?,00000005,?), ref: 006AB893
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000005,?), ref: 006AB8A0
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000005,?), ref: 006AB8A3

Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AB3
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AC0
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2ACD
Part of subcall function 006A2AA0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AD8

Strings

Error Creating services, xrefs: 006AB81F
ServiceExe path: %s, xrefs: 006AB75E
%s enter {, xrefs: 006AB6A4
Error on service control manager, xrefs: 006AB6F2
stealth_manager, xrefs: 006AB6A9, 006AB6D7, 006AB763, 006AB77E, 006AB799, 006AB810, 006AB8AF
Error Creating services %d, xrefs: 006AB80B
%s exit }, xrefs: 006AB8AA
Service Display name: %s, xrefs: 006AB794
Service name: %s, xrefs: 006AB779
Error on service control manager: %d, xrefs: 006AB6D2
CStealthManager::setupStartUpService, xrefs: 006AB69F, 006AB8A5

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Service$_invalid_parameter_noinfo_noreturn$CloseHandle$ErrorLast$ChangeConfig2CreateExceptionManagerOpenThrow
String ID: %s enter {$%s exit }$CStealthManager::setupStartUpService$Error Creating services$Error Creating services %d$Error on service control manager$Error on service control manager: %d$Service Display name: %s$Service name: %s$ServiceExe path: %s$stealth_manager
API String ID: 1505281203-3321287816
Opcode ID: 7a9fe8523f35c1f920a618048eddbec40d5602407cf986efc5e5ffc1b30e2fb8
Instruction ID: 9e09a2819a69a90ddfcb005798905b70d2769e7abb4a322eb45e3c1323d99799
Opcode Fuzzy Hash: 7a9fe8523f35c1f920a618048eddbec40d5602407cf986efc5e5ffc1b30e2fb8
Instruction Fuzzy Hash: 807161B0A40258EFEB10EBA4CC56BEEBBBAEF46700F500019F501AB1C2D7B55D858F65

Uniqueness

Uniqueness Score: -1.00%

Function 006AB940 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 212serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 006A1B30: new.LIBCMT ref: 006A1B62

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,DD4A9CAB,00000000,00000000), ref: 006AB98F
CreateServiceA.ADVAPI32(00000000,?,?,C0000012,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 006ABA66
GetLastError.KERNEL32(?,?,?,?,?,?,?,0000000B,?,0000000A,?,00000009), ref: 006ABA76
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0000000B,?,0000000A,?,00000009), ref: 006ABA7F

Part of subcall function 006A1AA0: new.LIBCMT ref: 006A1AD2

_CxxThrowException.VCRUNTIME140(?,006B3210,?,00000000,?,?,?,?,?,?,?,?,?,?,0000000B,?), ref: 006ABAB9
ChangeServiceConfig2W.ADVAPI32(00000000,00000002,0000000A,?,?,?,?,?,?,?,0000000B,?), ref: 006ABB98
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0000000B,?), ref: 006ABBA5
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0000000B,?), ref: 006ABBA8
GetLastError.KERNEL32 ref: 006ABC27

Strings

CStealthManager::setupProcessMonitorService, xrefs: 006AB96F, 006ABC0B
%s enter {, xrefs: 006AB974
stealth_manager, xrefs: 006AB979, 006AB9E6, 006ABA01, 006ABA1C, 006ABA93, 006ABC15
Error Creating services %d, xrefs: 006ABA8E
%s exit }, xrefs: 006ABC10
Service name: %s, xrefs: 006AB9FC
Error on service control manager: %d, xrefs: 006ABC30
Service display name: %s, xrefs: 006ABA17
Service path: %s, xrefs: 006AB9E1

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Service$CloseHandle$ErrorLast$ChangeConfig2CreateExceptionManagerOpenThrow
String ID: %s enter {$%s exit }$CStealthManager::setupProcessMonitorService$Error Creating services %d$Error on service control manager: %d$Service display name: %s$Service name: %s$Service path: %s$stealth_manager
API String ID: 2238952430-1689939351
Opcode ID: 087d9b2ffc1d6ea2a2d61d9194d976d9d2dca6f64be3c935f37fb9e0cb81987d
Instruction ID: 8518a6da1d63e7882bdb4ed3ee7ff8c15c15eb80390de67c0eec28b0ad6b9b09
Opcode Fuzzy Hash: 087d9b2ffc1d6ea2a2d61d9194d976d9d2dca6f64be3c935f37fb9e0cb81987d
Instruction Fuzzy Hash: 07815FB0A40218EFEB10EB94CC56BEEBBB6EB06700F504159F505BB2C2DBB15D858F65

Uniqueness

Uniqueness Score: -1.00%

Function 006A9C72 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 006A1AA0: new.LIBCMT ref: 006A1AD2

CreateEventW.KERNEL32(00000000,00000001,00000000,Global\Exit_5491c4d3-0a5f-4898-bec4-cd906998e306), ref: 006A9CA1
SetEvent.KERNEL32(00000000), ref: 006A9CAE
CloseHandle.KERNEL32(00000000), ref: 006A9CB5
__std_exception_destroy.VCRUNTIME140(?), ref: 006A9CC6

Strings

Global\Exit_5491c4d3-0a5f-4898-bec4-cd906998e306, xrefs: 006A9C96
Thread error: %s, xrefs: 006A9C84
Unknown exception, xrefs: 006A9C76, 006A9C83
fxstd, xrefs: 006A9C89

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Event$CloseCreateHandle__std_exception_destroy
String ID: Global\Exit_5491c4d3-0a5f-4898-bec4-cd906998e306$Thread error: %s$Unknown exception$fxstd
API String ID: 1146585969-2499111489
Opcode ID: e82e196a3aeb268d751834f7d2ba190c40db65f4062a2a51cd13e8013a980381
Instruction ID: d12f8e997ffa5c1839508c6ed9cf7dd91b3469c9e316e3d4027a208af571b88e
Opcode Fuzzy Hash: e82e196a3aeb268d751834f7d2ba190c40db65f4062a2a51cd13e8013a980381
Instruction Fuzzy Hash: 3BF0A0F0F81601ABFB107B609C0EFDF7EA7AF05705F100114F906B6282D7A58D858B65

Uniqueness

Uniqueness Score: -1.00%

Function 006A59D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,?,?,?,?,00000000,006AEB96,000000FF), ref: 006A5A40
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,?,?,?,?,?,00000000,006AEB96,000000FF), ref: 006A5A69
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,00000000,006AEB96,000000FF), ref: 006A5ABB
memmove.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,006AEB96), ref: 006A5B3A
memmove.VCRUNTIME140(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,006AEB96), ref: 006A5B62

Strings

string too long, xrefs: 006A5A64
invalid string position, xrefs: 006A5A3B

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: memmove$Xlength_error@std@@Xout_of_range@std@@
String ID: invalid string position$string too long
API String ID: 2690457442-4289949731
Opcode ID: 14ebc1175d683a147506ec3bfcdea9ac397e1360b4097c50bab9f79a8734bef7
Instruction ID: 9981cefa43118db079b4ede67595d6957d91416d97df645f5db2580732f20675
Opcode Fuzzy Hash: 14ebc1175d683a147506ec3bfcdea9ac397e1360b4097c50bab9f79a8734bef7
Instruction Fuzzy Hash: 79614C71700609DFCB24DF58D9908AAB7A7FF86315720866EE946CB210D731ED56CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 006A6010 Relevance: 12.1, APIs: 8, Instructions: 94COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 006A606A

Part of subcall function 006AD23C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006A1B67,0000001C,DD4A9CAB,?,?,?,006AE36F,000000FF,?,006A212F,ws_update_service,%s enter {,ServiceWorkerThread,DD4A9CAB), ref: 006AD263

InitializeCriticalSection.KERNEL32(00000004), ref: 006A6081
new.LIBCMT ref: 006A608C

Part of subcall function 006AD23C: _callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006A1B67,0000001C,DD4A9CAB,?,?,?,006AE36F,000000FF,?,006A212F,ws_update_service,%s enter {,ServiceWorkerThread,DD4A9CAB), ref: 006AD244

InitializeConditionVariable.KERNEL32(00000004), ref: 006A60A3
new.LIBCMT ref: 006A60AE

Part of subcall function 006AD23C: Concurrency::cancel_current_task.LIBCPMT ref: 006AD25B

new.LIBCMT ref: 006A60DC
new.LIBCMT ref: 006A6107
new.LIBCMT ref: 006A6135

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Initialize$Concurrency::cancel_current_taskConditionCriticalSectionVariable_callnewhmalloc
String ID:
API String ID: 1909774165-0
Opcode ID: db6604cab5fe2729cf1dadcbcd6cab5155629483ec0083ca0b2f168b3b89eef1
Instruction ID: b1af8968f000f6350d5f844641c5054f729efd859b89be03f291ce250d99f249
Opcode Fuzzy Hash: db6604cab5fe2729cf1dadcbcd6cab5155629483ec0083ca0b2f168b3b89eef1
Instruction Fuzzy Hash: 984104B0910705AFE3009F61C849B96BFE5FF85310F15C65AE5098B7A1E7B9A984CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 006A28B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,006A280F,?,00000000,0000023A,?,?,?,006A10E4,Pacific/Marquesas,00000011), ref: 006A28CA

Part of subcall function 006A2BA0: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,006A2923,00000000,0000023A,?,?,00000000,?,006A280F,?,00000000,0000023A), ref: 006A2BB6

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,00000000,?,006A280F,?,00000000,0000023A,?,?,?,006A10E4,Pacific/Marquesas,00000011), ref: 006A28EB

Strings

string too long, xrefs: 006A2931
invalid string position, xrefs: 006A28C5, 006A28E6

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xout_of_range@std@@
String ID: invalid string position$string too long
API String ID: 1960685668-4289949731
Opcode ID: 1701a84c75b155ff2a274aeae83a241425122f4ba7163a1b3219d6d17347dd14
Instruction ID: 1641c05d0b9e33ac5a4468345372bb554485eeee0a02b9d4e32f67e493edabef
Opcode Fuzzy Hash: 1701a84c75b155ff2a274aeae83a241425122f4ba7163a1b3219d6d17347dd14
Instruction Fuzzy Hash: 1F31A2323403128FD720AF5DE850B5BF7E6EB96B61F100A6EE586C7641D7B29C408BE5

Uniqueness

Uniqueness Score: -1.00%

Function 006A4290 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,006A41E0,?,?,?,?,?,?,006AA286,SOFTWARE\Classes\CLSID\), ref: 006A42AA
?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,006A41E0,?,?,?,?,?,?,006AA286,SOFTWARE\Classes\CLSID\), ref: 006A42CB
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,006A41E0,?,?,?,?,?,?,006AA286,SOFTWARE\Classes\CLSID\), ref: 006A4305
memmove.VCRUNTIME140(?,?,?,?,?,?,?,006A41E0,?,?,?,?,?,?,006AA286,SOFTWARE\Classes\CLSID\), ref: 006A436E

Strings

string too long, xrefs: 006A4300
invalid string position, xrefs: 006A42A5, 006A42C6

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xout_of_range@std@@$Xlength_error@std@@memmove
String ID: invalid string position$string too long
API String ID: 3597620626-4289949731
Opcode ID: d90d0e0005b9531165c7fa5edcf82fbd1926c7824b2a0b94d92636ca27c002d3
Instruction ID: 05c529892e0932828e910cbdc4bb7bcd553293561d38c0c8baa00891649fc72c
Opcode Fuzzy Hash: d90d0e0005b9531165c7fa5edcf82fbd1926c7824b2a0b94d92636ca27c002d3
Instruction Fuzzy Hash: A1319D32304310DB8B24AF59EC8096BF7E6EFD67113110A6EE556C7210DFB1AD51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006A4670 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,DD4A9CAB,00000000,?,?,006A45AF,00000000,?,?,DD4A9CAC,?,?,006A9908,DD4A9CAB,DD4A9CAC), ref: 006A468A
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,DD4A9CAB,00000000,?,?,006A45AF,00000000,?,?,DD4A9CAC,?,?,006A9908,DD4A9CAB,DD4A9CAC), ref: 006A46AD
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,DD4A9CAB,00000000,?,?,006A45AF,00000000,?,?,DD4A9CAC,?,?,006A9908,DD4A9CAB,DD4A9CAC), ref: 006A46C8
memmove.VCRUNTIME140(?,?,DD4A9CAC,DD4A9CAB,00000000,?,?,006A45AF,00000000,?,?,DD4A9CAC,?,?,006A9908,DD4A9CAB), ref: 006A472F

Strings

string too long, xrefs: 006A46A8, 006A46C3
invalid string position, xrefs: 006A4685

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xlength_error@std@@$Xout_of_range@std@@memmove
String ID: invalid string position$string too long
API String ID: 3326265527-4289949731
Opcode ID: c552bede234a3a6be0d466cd06dd89545dd12663f9e6102116ba146e9c35296d
Instruction ID: 5f98c1f509dd58eda8ae2693599590cf91e9c01903f73d487f4106651908a789
Opcode Fuzzy Hash: c552bede234a3a6be0d466cd06dd89545dd12663f9e6102116ba146e9c35296d
Instruction Fuzzy Hash: 5D319F323012418FDB24AF5CEC80A6BB7E6EFD6751B100A6EE456C7251DBB1EC40CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006A2A40 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A50
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A64
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A71
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A7E
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A49EC,?,?,?), ref: 006A2A89

Strings

Ij, xrefs: 006A2A43

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Ij
API String ID: 3668304517-1760422038
Opcode ID: a6d745edd926885f616f9539c3844dddc6d76251444b3f9f3893c75ceafa6973
Instruction ID: adac05ba77cfb92c7a633fff79da208c2294717e1624767fae1cbf2a5afecd41
Opcode Fuzzy Hash: a6d745edd926885f616f9539c3844dddc6d76251444b3f9f3893c75ceafa6973
Instruction Fuzzy Hash: 0CF01C705402064BEB6C7BFCECAD56F7B97AB0A325B101728EA57C2651DA219CD0CE15

Uniqueness

Uniqueness Score: -1.00%

Function 006A4490 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,?,?,?,?,006AA2B8,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\), ref: 006A44AA
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,006AA2B8,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\), ref: 006A44CD
memmove.VCRUNTIME140(?,?,00000000,?,?,?,?,?,?,006AA2B8,?,00000000,000000FF,{d07606c8-6532-4d75-a46d-f5f5ac6ef74a},00000026,SOFTWARE\Classes\CLSID\), ref: 006A4511

Strings

string too long, xrefs: 006A44C8
invalid string position, xrefs: 006A44A5

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xlength_error@std@@Xout_of_range@std@@memmove
String ID: invalid string position$string too long
API String ID: 1352685159-4289949731
Opcode ID: 49ad5b62babe9b518e1dbeecb1565b41972f37bd95ddc56fb2304dc472fb56a0
Instruction ID: 3ada127d32dfaf0c8709e7febfa3bdea40348f9f2dfa53972ee676d9643a01eb
Opcode Fuzzy Hash: 49ad5b62babe9b518e1dbeecb1565b41972f37bd95ddc56fb2304dc472fb56a0
Instruction Fuzzy Hash: D421BD713002059F9724EF5DEC80A9AB7EBEF89754300453DE405C7200DBB0EC55CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006A48D0 Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(DD4A9CAB,?,?,?), ref: 006A4954
?_Xbad_alloc@std@@YAXXZ.MSVCP140(DD4A9CAB,?,?,?), ref: 006A496A
new.LIBCMT ref: 006A4971
new.LIBCMT ref: 006A4985

Part of subcall function 006AD23C: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,006A1B67,0000001C,DD4A9CAB,?,?,?,006AE36F,000000FF,?,006A212F,ws_update_service,%s enter {,ServiceWorkerThread,DD4A9CAB), ref: 006AD263

memmove.VCRUNTIME140(00000000,?,?,?), ref: 006A49D3

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xbad_alloc@std@@$mallocmemmove
String ID:
API String ID: 186744070-0
Opcode ID: cac2d5458aed09e70425bc89bd85185881fdbbb391baff0729413b29c0901ec2
Instruction ID: 8dc2892324a74d499e65d98bdd28d20e3ac706e841f3089645c59578c49c9298
Opcode Fuzzy Hash: cac2d5458aed09e70425bc89bd85185881fdbbb391baff0729413b29c0901ec2
Instruction Fuzzy Hash: B44193B16006009BDB24EF28DD8166BB7EAEB86750B20072DE456C7790EBB0ED15CF65

Uniqueness

Uniqueness Score: -1.00%

Function 006A5170 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,3FFFFFFF,?,?,006A5109,?,?,?,?,006A5058,?), ref: 006A518C
?_Xbad_alloc@std@@YAXXZ.MSVCP140(?,?,3FFFFFFF,?,?,006A5109,?,?,?,?,006A5058,?), ref: 006A51A7
new.LIBCMT ref: 006A51AE
memmove.VCRUNTIME140(00000000,?,?), ref: 006A51D6

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xbad_alloc@std@@$memmove
String ID:
API String ID: 2874220160-0
Opcode ID: e1ed50747ce39a95e4a0df899d9e8d32ca29eac059f9ca56359602f794be1d6b
Instruction ID: 9b5dd5032b4f9ac1d46084fb97f1924e83995e731d795c1eb83e6f90e281bd09
Opcode Fuzzy Hash: e1ed50747ce39a95e4a0df899d9e8d32ca29eac059f9ca56359602f794be1d6b
Instruction Fuzzy Hash: 5E11B1B1A10A02AFD718FF68C881A7EF7AAFB463407104639E916C3250E771ED15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 006A4860 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A3F0C,?), ref: 006A4870
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A3F0C,?), ref: 006A4888
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A3F0C,?), ref: 006A4895
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A3F0C,?), ref: 006A48A2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A3F0C,?), ref: 006A48AD

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: fcf77e5bf584fcf84beeec32c56d5b9dee160e2ab07dfa9dfeb2057505eea920
Instruction ID: cba97d862e76862f0526c8c11dbd943343689ada9111757314db551c7a34cfde
Opcode Fuzzy Hash: fcf77e5bf584fcf84beeec32c56d5b9dee160e2ab07dfa9dfeb2057505eea920
Instruction Fuzzy Hash: 85F05E745001444FFB5C7BECAC9866E3BA7EB86361B100669E803C2211DEA5ECC0CE11

Uniqueness

Uniqueness Score: -1.00%

Function 006A5110 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A4EC7,?,?,?,?,?,006AE7D0,000000FF,?,006A4E1B), ref: 006A5120
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A4EC7,?,?,?,?,?,006AE7D0,000000FF,?,006A4E1B), ref: 006A5135
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A4EC7,?,?,?,?,?,006AE7D0,000000FF,?,006A4E1B), ref: 006A5142
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A4EC7,?,?,?,?,?,006AE7D0,000000FF,?,006A4E1B), ref: 006A514F
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,006A4EC7,?,?,?,?,?,006AE7D0,000000FF,?,006A4E1B), ref: 006A515A

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 1acce069a8803f2df443ac96e4060db8cb0b5cc375bcbd010cb4d2afbc5981d4
Instruction ID: 16057dda0ecd3268d03b035c7407024c2d4b91924e5a2b5163617b87ee61af27
Opcode Fuzzy Hash: 1acce069a8803f2df443ac96e4060db8cb0b5cc375bcbd010cb4d2afbc5981d4
Instruction Fuzzy Hash: E5F0A0705006044BEB5CBBECA89D67F7B67EB06321B100729F823C1650DB319CC0CE11

Uniqueness

Uniqueness Score: -1.00%

Function 006A4550 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,DD4A9CAC,?,?,006A9908,DD4A9CAB,DD4A9CAC,?,?), ref: 006A45C8
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,DD4A9CAB,DD4A9CAC,?,?,006A9908,DD4A9CAB,DD4A9CAC,?,?), ref: 006A45E4
memmove.VCRUNTIME140(?,?,?,DD4A9CAB,DD4A9CAC,?,?,006A9908,DD4A9CAB,DD4A9CAC,?,?), ref: 006A463E

Part of subcall function 006A4670: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,DD4A9CAB,00000000,?,?,006A45AF,00000000,?,?,DD4A9CAC,?,?,006A9908,DD4A9CAB,DD4A9CAC), ref: 006A468A
Part of subcall function 006A4670: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,DD4A9CAB,00000000,?,?,006A45AF,00000000,?,?,DD4A9CAC,?,?,006A9908,DD4A9CAB,DD4A9CAC), ref: 006A46AD
Part of subcall function 006A4670: ?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,DD4A9CAB,00000000,?,?,006A45AF,00000000,?,?,DD4A9CAC,?,?,006A9908,DD4A9CAB,DD4A9CAC), ref: 006A46C8
Part of subcall function 006A4670: memmove.VCRUNTIME140(?,?,DD4A9CAC,DD4A9CAB,00000000,?,?,006A45AF,00000000,?,?,DD4A9CAC,?,?,006A9908,DD4A9CAB), ref: 006A472F

Strings

string too long, xrefs: 006A45C3, 006A45DF

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xlength_error@std@@$memmove$Xout_of_range@std@@
String ID: string too long
API String ID: 1879775902-2556327735
Opcode ID: d1a78d5ceb63a37b9b2c6c852a31caf8b57ebe193ce85bc2d3f239922b6703ee
Instruction ID: b3ac46349f6da7b90b5c422eff68774df84bf9d30929a79e5b9461a4f29aaa37
Opcode Fuzzy Hash: d1a78d5ceb63a37b9b2c6c852a31caf8b57ebe193ce85bc2d3f239922b6703ee
Instruction Fuzzy Hash: A131A4327002109BE724BE5CEC8096AF7A7EBD7751720452EE49287751CBB1DC458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 006A58C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,006A53A3,?,?,?,?,?,?,00000000), ref: 006A58D4
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,006A53A3,?,?,?,?,?,?,00000000), ref: 006A58E4

Strings

string too long, xrefs: 006A58CF, 006A58DF

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xlength_error@std@@
String ID: string too long
API String ID: 1004598685-2556327735
Opcode ID: 7e3e233f2b72e4d8bc555a2cee7f1141d92c82020914eadf9eb0d89cf793dabd
Instruction ID: 6b208bb560c810cc34a766d9fe4d1e005582fb18adda41f458c8feaf23bf5fde
Opcode Fuzzy Hash: 7e3e233f2b72e4d8bc555a2cee7f1141d92c82020914eadf9eb0d89cf793dabd
Instruction Fuzzy Hash: E0215332704B90CBD731AA5CE800757FBE6ABA7731F11096EE1978B651C7B19C44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 006A2C40 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140(DD4A9CAB,0000023A,?,00000000), ref: 006A2CC8
new.LIBCMT ref: 006A2CCF
new.LIBCMT ref: 006A2CE3
memmove.VCRUNTIME140(00000000,?,0000023A,00000000), ref: 006A2D2F

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xbad_alloc@std@@memmove
String ID:
API String ID: 2663607490-0
Opcode ID: 7301485aa669089b13c2c554c052f4e2f83571e81418c4c1b1d8cf1d795f00f3
Instruction ID: ae7a4e0c8d2d42b07b62768d4468a33badee520cb47158a0c5847b91c0519485
Opcode Fuzzy Hash: 7301485aa669089b13c2c554c052f4e2f83571e81418c4c1b1d8cf1d795f00f3
Instruction Fuzzy Hash: A031AEB16506029BD724BF2CC89076AB7E6EF46760F500A2DE85387782D771AD44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 006A4A70 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 006A4A89
?_Xbad_alloc@std@@YAXXZ.MSVCP140 ref: 006A4A9F
new.LIBCMT ref: 006A4AA6

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xbad_alloc@std@@
String ID:
API String ID: 3815834350-0
Opcode ID: 36c175023a5f3967d172e54f74fed0957f60e029d946e71a000301baf5a216e1
Instruction ID: 87f3fc06474ba8fd9e5fc79e28c23053c72948076292815effbf67eb41453704
Opcode Fuzzy Hash: 36c175023a5f3967d172e54f74fed0957f60e029d946e71a000301baf5a216e1
Instruction Fuzzy Hash: DAF027F26001400BE718F7B4AC06A2E778A9BA5314700023EF31BC7290FA31DD54DA1D

Uniqueness

Uniqueness Score: -1.00%

Function 006A2AA0 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AB3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AC0
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2ACD
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 006A2AD8

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 95ae80a75ff3640d6aa0c61b7ff58e49d24813e57251368edd5848d35445fccb
Instruction ID: 12717b10dbaa56c2c05f0d18ec717f480bbea97004114a9bcbe5e50185c0c351
Opcode Fuzzy Hash: 95ae80a75ff3640d6aa0c61b7ff58e49d24813e57251368edd5848d35445fccb
Instruction Fuzzy Hash: 6CE092701402064BEB587BEC9D6D16F7B97AB023517004614EA07D5610D630ECD0CE21

Uniqueness

Uniqueness Score: -1.00%

Function 006A4190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,?,?,?,?,006AA286,SOFTWARE\Classes\CLSID\,?,?,?,?,?,?,00000017), ref: 006A41F7
memmove.VCRUNTIME140(?,?,00000000,?,?,?,?,006AA286,SOFTWARE\Classes\CLSID\,?,?,?,?,?,?,00000017), ref: 006A4252

Strings

string too long, xrefs: 006A41F2

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xlength_error@std@@memmove
String ID: string too long
API String ID: 1146228739-2556327735
Opcode ID: 66a6f4c7d23ecda68a566cd996e3ec99f0be08e4ce1faffa6bc908b9d9b1fbe7
Instruction ID: 0cff46d599a4a72fe12b16d2f33c68c2e58a280e271a4fc664fefc3cac1fbb2e
Opcode Fuzzy Hash: 66a6f4c7d23ecda68a566cd996e3ec99f0be08e4ce1faffa6bc908b9d9b1fbe7
Instruction Fuzzy Hash: 053181323046148B8624AE5CEC8087AF7F7EFE6751360062FE146C7610DFA2AD458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 006A5520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,-=j,00000000,00000000,00000000,00000000,00000002,75029350), ref: 006A557E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,-=j,?,00000000,00000000,00000000,00000000), ref: 006A55C8

Strings

-=j, xrefs: 006A5534, 006A55BA, 006A5575

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: -=j
API String ID: 626452242-140233817
Opcode ID: 9441453eb1e9fd14710cda08aa45d28db82746c992e9610bd1c372b4bb722da5
Instruction ID: 08d56944e0f592023c1c9416d4684008d0ea233c66baccf94000c1d5cb7fd72f
Opcode Fuzzy Hash: 9441453eb1e9fd14710cda08aa45d28db82746c992e9610bd1c372b4bb722da5
Instruction Fuzzy Hash: 2921D371208301AFE710EF28DC82B6BBBE5EB89704F000A1DFA499A2C1C670DD44CF96

Uniqueness

Uniqueness Score: -1.00%

Function 006AA9B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,DD4A9CAB), ref: 006AAA05

Strings

\system32, xrefs: 006AAA8C
\sysnative, xrefs: 006AAA83

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: DirectoryWindows
String ID: \sysnative$\system32
API String ID: 3619848164-3725051112
Opcode ID: c923e4afa7541dd706499c1b0e18fafd0527b422aaea95d6ec25a2b010010105
Instruction ID: e6dd893cc45b6471b8a76ffe557d402e7fba42bf60341d8568dbdff9394592c7
Opcode Fuzzy Hash: c923e4afa7541dd706499c1b0e18fafd0527b422aaea95d6ec25a2b010010105
Instruction Fuzzy Hash: 9221EFB0A043489FDB24EF54C905BEABBF5EB06700F00429EE2465B681CBB55E88CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 006A2AF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(string too long,006B036C,006B036C,?,006A4B78,006B036C,00000001,DD4A9CAB,00000001,0000001C), ref: 006A2B04
memmove.VCRUNTIME140(006B036C,3A6E6961,4D656369,4D656369,006B036C,006B036C,?,006A4B78,006B036C,00000001,DD4A9CAB), ref: 006A2B4A

Strings

string too long, xrefs: 006A2AFF

Memory Dump Source

Source File: 00000005.00000002.2223130294.00000000006A1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000005.00000002.2223055763.00000000006A0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223155630.00000000006B0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223176350.00000000006B4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000005.00000002.2223199623.00000000006B7000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_svcAppUpdate.jbxd

Similarity

API ID: Xlength_error@std@@memmove
String ID: string too long
API String ID: 1146228739-2556327735
Opcode ID: 9cff78eb073b1c974420425850bbe9513b89fed4c2e240c0f0a9cd28a23c57a0
Instruction ID: 56f790bf4ddd9dfaa6b7a657d803f969a603efd5f8b5632bbc8a8f45ee5c505a
Opcode Fuzzy Hash: 9cff78eb073b1c974420425850bbe9513b89fed4c2e240c0f0a9cd28a23c57a0
Instruction Fuzzy Hash: 1411B7325407025BD731AE5CD881AAAB7A7EF92330F054A6DE99647251C7709C44CFB1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5006_2.6.2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Windows Provisioning\ProtocolFilters.dll

C:\Program Files (x86)\Windows Provisioning\Windows Provisioning.exe

C:\Program Files (x86)\Windows Provisioning\app_data\cfg_tmp.xml

C:\Program Files (x86)\Windows Provisioning\app_data\configurations.dat

C:\Program Files (x86)\Windows Provisioning\app_data\ddmstore.db

C:\Program Files (x86)\Windows Provisioning\app_data\ddmstore.db-journal

C:\Program Files (x86)\Windows Provisioning\app_data\de_netfilter\SSL\DigiCert SHA2 Extended Validation Server CA 3.cer

C:\Program Files (x86)\Windows Provisioning\app_data\de_netfilter\SSL\cert.db

C:\Program Files (x86)\Windows Provisioning\app_data\phoenix_db.db

C:\Program Files (x86)\Windows Provisioning\app_data\phoenix_db.db-journal

C:\Program Files (x86)\Windows Provisioning\app_data\rmt_cmd_store.db

C:\Program Files (x86)\Windows Provisioning\app_data\rmt_cmd_store.db-journal

Windows Analysis Report
5006_2.6.2.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre